The PixMagix – WordPress Image Editor plugin contains a directory traversal flaw where the layers[].id parameter is unsanitized and concatenated into a filesystem path used by PHP's copy() function, allowing an authenticated user with author-level access to write arbitrary files that the web server can serve, potentially leading to code execution, site defacement, or data exposure. This is a classic CWE‑22 vulnerability.

Any WordPress site that has the PixMagix plugin installed at version 1.7.2 or earlier is affected. The flaw exists in the rest-callback-save-template API endpoint invoked through the move_image_on_server function, which is available to users who possess the create_projects permission—a permission that Author users inherit by default after plugin activation.

The vulnerability carries a CVSS score of 6.5 and is not listed in the CISA KEV catalog. The attack vector requires legitimate author or higher credentials but because most WordPress sites grant many users the Author role, a large attack surface exists. Exploiting the flaw involves sending a crafted layers[].id value containing traversal sequences such as ../../ and relying on the copy() operation to create a file at an arbitrary path, with the resulting file content supplied by the attacker. Since no additional conditions are required beyond the normal plugin usage, the likelihood of exploitation is moderate, and the impact could be severe if a PHP file is written and executed.