CVE-2024-6486

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6486
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ Exploit Third Party Advisory
https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:orangelab:imagemagick_engine:*:*:*:*:*:wordpress:*:*
History

11 Jun 2025, 15:40

Type Values Removed Values Added
CWE CWE-78
First Time Orangelab
Orangelab imagemagick Engine
References () https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ - () https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ - Exploit, Third Party Advisory
CPE cpe:2.3:a:orangelab:imagemagick_engine:*:*:*:*:*:wordpress:*:*

20 May 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
References () https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ - () https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/ -

16 May 2025, 14:42

Type Values Removed Values Added
Summary
  • (es) El complemento ImageMagick Engine ImageMagick Engine WordPress para WordPress (versión anterior a la 1.7.11) es vulnerable a la inyección de comandos del sistema operativo mediante el parámetro "cli_path". Esto permite a atacantes autenticados, con permisos de administrador, ejecutar comandos arbitrarios del sistema operativo en el servidor, lo que provoca la ejecución remota de código.

15 May 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-15 20:15

Updated : 2025-06-11 15:40

NVD link : CVE-2024-6486

Mitre link : CVE-2024-6486

CVE.ORG link : CVE-2024-6486

JSON object : View

Products Affected

orangelab

  • imagemagick_engine
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')