CVE-2026-11367 is a directory traversal vulnerability (CWE-22) in the PixMagix – WordPress Image Editor plugin for WordPress, affecting all versions up to 1.7.2. The vulnerability arises from improper sanitization of the 'layers[].id' parameter in the move_image_on_server function, which is concatenated into a filesystem path and passed to PHP's copy() function. This allows authenticated attackers with author-level access or higher to write arbitrary files to locations outside the intended upload directory by using path traversal sequences such as '../../'. The save_template REST endpoint, which triggers this function, requires the create_projects permission held by author-level users by default, making exploitation feasible by any author-level user on affected sites.

An attacker with author-level access can write files with attacker-controlled content to arbitrary locations on the server. This could lead to unauthorized file placement, potentially enabling further attacks such as web shell deployment or other malicious file execution. The vulnerability does not directly impact confidentiality or availability but has a high impact on integrity due to unauthorized file writes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict author-level user permissions if possible and monitor for suspicious activity related to file uploads or REST API usage. Consider disabling or removing the PixMagix plugin if author-level users cannot be fully trusted. Follow vendor advisories for updates on remediation.