CVE-2024-6486: Orangelab ImageMagick Engine

High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days.

The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.

Affected products

• Orangelab ImageMagick Engine: before 1.7.11 (fixed in 1.7.11)

Published 2025-05-15. Last modified 2026-06-17.