WordPress has rolled out security updates to address a critical vulnerability that could allow attackers with certain permissions to execute code remotely. This flaw, identified as CVE-2026-65640 with a CVSS score of 8.8, poses a significant threat to systems running affected versions.
Key Details of the Vulnerability
The vulnerability specifically targets WordPress installations utilizing Imagick and Ghostscript. It allows attackers with Author-level or higher permissions to upload malicious Postscript files. The issue arises from Ghostscript’s processing of particular embedded files, requiring the attacker to have file upload capabilities.
WordPress has released version 7.0.4 to address this issue. Additionally, the security fix has been applied to all versions back to 4.7, ensuring comprehensive coverage for users on older branches. The update modifies the load() function to verify file content before passing it to Imagick, preventing unauthorized PostScript execution.
Technical Explanation and Impact
The vulnerability is rooted in the discrepancy between how ImageMagick, through the Imagick extension, and WordPress manage file types. While WordPress checks the file extension, ImageMagick analyzes the content. If PostScript is detected, Ghostscript processes it, potentially executing harmful code.
Attackers could exploit this by uploading seemingly harmless files like PNGs that contain embedded PostScript code. Although WordPress has mechanisms to check file content, certain upload methods bypass these checks, increasing the risk of exploitation.
WordPress Security Measures and Recommendations
By changing the load() function, WordPress has enhanced its security posture, preventing the trickery of filenames to trigger Ghostscript. This update is crucial for sites with multiple authors, open registration, or any environment where file uploads are frequent.
Patchstack emphasizes that sites with multiple contributors should prioritize this update to mitigate potential threats. The vulnerability is not merely theoretical; it is a real risk that could compromise site integrity.
With cyber threats continuously evolving, keeping WordPress installations updated is vital to maintaining security and protecting user data.
