WordPress on Wednesday announced fixes for a high-severity vulnerability that allows authenticated attackers to execute arbitrary code remotely.
Tracked as CVE-2026-65640 (CVSS score of 8.8), the security flaw could be exploited by attackers with author user level or higher permissions by maliciously uploading a Postscript file.
According to WordPress’ consultativethe problem only affects installations that use Imagick and Ghostscript, as it was discovered when processing certain embedded files from Ghostscript. Successful exploitation requires the attacker to have file upload rights.
“A version of WordPress 7.0.4 has been released containing a patch for the vulnerability, and as a courtesy to users of older branches, the patch has been rolled back to all branches back to 4.7,” the web content management system’s maintainers announced.
The vulnerability is in the way ImageMagick (via the Imagick extension) and WordPress handle different file types: ImageMagick looks at the content while WordPress looks at the file extension, vulnerability management firm Patchstack explains.
As WordPress passes an uploaded file to ImageMagick based on its extension, ImageMagick examines the content and, if it detects PostScript inside, calls Ghostscript to render it.
This allows an attacker to upload a PNG file containing PostScript that will be executed in Ghostscript as a PostScript program. While WordPress contains a feature that performs content checks, some upload methods do not, opening the door to exploitation, Patchstack says.
WordPress addressed the security flaw by modifying the load() function to check the contents of the file before passing it to Imagick, preventing PostScript from executing. The patch also prevents attackers from using filenames to manipulate Imagick into using Ghostscript.
“If you’re running a multi-author publication, membership site, client site with contributors, or anything else with open or loosely managed registration, (…) An author uploading a trapped ‘image’ is really a real threat, not a theoretical one,” notes Pachstack.
Related: Fortinet fixes authentication flaws in FortiWeb and FortiManager
Related: Over 2,500 Organizations Affected by LiteLLM Supply Chain Attack
Related: Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
Related: SAP fixes critical code injection, memory corruption vulnerabilities
