CVE-2022-3568 ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization

🗓️ 09 Feb 2023 23:34:58Reported by GoogleType

osv🔗 osv.dev👁 24 Views

The ImageMagick Engine plugin for WordPress has a deserialization vulnerability in the 'cli_path' parameter, allowing unauthenticated users to call files using a PHAR wrapper

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2022-3568	10 Feb 202300:15	–	attackerkb
Circl	CVE-2022-3568	10 Feb 202316:57	–	circl
CNNVD	WordPress plugin ImageMagick Engine 跨站请求伪造漏洞	9 Feb 202300:00	–	cnnvd
CVE	CVE-2022-3568	9 Feb 202323:34	–	cve
Cvelist	CVE-2022-3568 ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization	9 Feb 202323:34	–	cvelist
EUVD	EUVD-2022-42932	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3568	10 Feb 202300:15	–	nvd
Prion	Deserialization of untrusted data	10 Feb 202300:15	–	prion
RedhatCVE	CVE-2022-3568	6 Feb 202500:43	–	redhatcve
Vulnrichment	CVE-2022-3568 ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization	9 Feb 202323:34	–	vulnrichment

Source	Link
github	www.github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php
github	www.github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4a2ca2f0-1d4a-4614-86ba-a46e765f4a9f
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/4a2ca2f0-1d4a-4614-86ba-a46e765f4a9f
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3568.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-3568

15 Jul 2026 01:49Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.8

EPSS0.00626