ImageMagick Engine < 1.7.6 - PHAR Deserialization via CSRF

Description

The plugin does not validate the cli_path parameter and does not have CSRF check, which could allow attackers to make a logged in admin call a file with a PHAR wrapper via a CSRF attack. This could lead to PHAR deserialization when a suitable gadget chain is present on the blog and the attacker managed to upload a file with the payload