WordPress has issued version 7.0.4, a crucial security update addressing a severe remote code execution (RCE) vulnerability. This flaw affects websites utilizing the Imagick extension to manage images, coupled with Ghostscript.
Immediate Update Recommended
The WordPress security team strongly advises site owners to implement the update immediately. This can be done via the Dashboard’s Updates screen or by downloading it directly from WordPress.org. Sites with automatic background updates should have received this patch already.
The vulnerability, labeled CVE-2026-65640 and documented in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai. It enables an authenticated user with Author-level access to execute remote code by uploading a specially crafted file.
Understanding the Vulnerability
This exploit arises due to WordPress’s dependency on ImageMagick for processing images in the Media Library. ImageMagick handles not only JPEGs and PNGs but also PostScript, EPS, and PDF files, delegating the rendering of these formats to Ghostscript, which has a history of being exploited to run unintended commands.
The security flaw is reminiscent of the “ImageTragick” vulnerabilities from previous years. The issue primarily stems from a mismatch in file identification methods. ImageMagick reads the actual file contents to determine type, while WordPress’s WP_Image_Editor_Imagick::load() method relied heavily on file extensions.
Enhanced Security Measures
To mitigate this, the recent update modifies the load() function to inspect the actual content of files before using Imagick. It now scrutinizes the initial bytes of every uploaded file to block those containing PostScript or EPS signatures, fake PDFs lacking the genuine %PDF- header, and compressed files that ImageMagick might unpack silently.
The patch also prevents a tactic where attackers could use a format specifier such as EPS:innocent.png to force ImageMagick to a risky decoder. The new code carefully strips and validates such prefixes, ensuring no false positives occur, particularly on Windows drive letters.
Implications for Site Owners
While the exploit requires Author-level access, making it less of a threat for sites with tightly controlled user permissions, multi-author blogs and platforms with less restrictive access controls are at greater risk. Any Author could potentially upload a disguised malicious file.
WordPress is backporting these fixes through the 4.7 branch and into the forthcoming 7.1 RC3 release, though comprehensive support is only available for the latest version. Administrators should promptly verify their WordPress version and update to enhance security, especially where upload rights are extended beyond a core trusted team.
[Live Webinar] Join Elastic & UnderDefense to explore how small security teams can integrate AI visibility and responsive actions into a unified model -> Register Now
