CVE-2026-11367 | andrasweb PixMagix Plugin up to 1.7.2 on WordPress REST Endpoint copy layers[].id path traversal

A vulnerability, which was classified as critical, was found in andrasweb PixMagix Plugin up to 1.7.2 on WordPress. Affected by this issue is the function copy of the component REST Endpoint. Executing a manipulation of the argument layers[].id can lead to path traversal.

This vulnerability is tracked as CVE-2026-11367. The attack can be launched remotely. No exploit exists.