WordPress 7.0.4 Patches Remote Code Execution Vulnerability

Summary

WordPress has released version 7.0.4 to address a high-severity remote code execution vulnerability (CVE-2026-65640) that allows authenticated attackers with Author-level permissions or higher to execute arbitrary code. The flaw, which has a CVSS score of 8.8, is exploitable when users upload malicious Postscript files, particularly affecting installations using Imagick and Ghostscript. The vulnerability arises from how ImageMagick and WordPress handle embedded files, allowing a crafted PNG file to execute Postscript code within Ghostscript.

Full text

WordPress on Wednesday announced patches for a high-severity vulnerability that allows authenticated attackers to execute arbitrary code remotely. Tracked as CVE-2026-65640 (CVSS score of 8.8), the security defect can be exploited by attackers with Author-level user or higher permissions via malicious Postscript file uploads. According to WordPress’ advisory, the issue affects only installations that use Imagick and Ghostscript, as it was discovered in Ghostscript’s handling of certain embedded files. Successful exploitation requires that an attacker has file upload rights. “WordPress version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches, the fix has been backported to all branches back to 4.7,” the web content management system’s maintainers announced. The vulnerability resides in how ImageMagick (through the Imagick extension) and WordPress handle various types of files: ImageMagick looks at the contents, while WordPress looks at the file extension, vulnerability management firm Patchstack explains. While WordPress passes an uploaded file to ImageMagick based on its extension, ImageMagick looks at the content and, if it detects PostScript inside, calls Ghostscript to render it.Advertisement. Scroll to continue reading. This allows an attacker to upload a PNG file containing PostScript, which will be executed in Ghostscript as a PostScript program. While WordPress does contain a function that performs content checks, some upload methods do not, opening the door for exploitation, Patchstack says. WordPress addressed the security defect by modifying the load() function to check the file’s contents before passing it to Imagick, preventing PostScript execution. The fix also prevents attackers from using filenames to manipulate Imagick into using Ghostscript. “If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, […] an Author uploading a booby-trapped ‘image’ is a genuinely realistic threat, not a theoretical one,” Patchstack notes. Related: Fortinet Patches Authentication Flaws in FortiWeb and FortiManager Related: Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack Related: Critical VMware vCenter Vulnerability in Attackers’ Crosshairs Related: SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Ceva Logistics Operations Disrupted by CyberattackOver 2,500 Organizations Impacted by LiteLLM Supply Chain AttackFresh Windows Zero-Day Exploited in North Korean CyberattacksIvanti EPM Update Patches Remotely Exploitable FlawsSonicWall Patches Critical Vulnerabilities in Discontinued GMS PlatformAugust 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-DayAdobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic FlawsZoom Patches Zero-Click Code Execution Vulnerability Latest News Venture Firm Team8 Secures Additional $365 MillionFortinet Patches Authentication Flaws in FortiWeb and FortiManagerWhite House Mobilizes Security Firms for Operations Against Foreign Cybercrime GangsCritical VMware vCenter Vulnerability in Attackers’ CrosshairsNightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’SharePoint Vulnerability Exploited Shortly After PoC ReleaseMindgard Raises $30 Million to Protect AI SystemsStealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveErika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.John Opala has joined Ralph Lauren as Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-65640

Entities