WordPress 7.0.4 Patches Critical RCE Flaw CVE-2026-65640

WordPress released version 7.0.4 on Wednesday to address a high-severity remote code execution vulnerability tracked as CVE-2026-65640, carrying a CVSS score of 8.8. The flaw allows authenticated attackers with Author-level permissions or higher to execute arbitrary code on the target server by uploading specially crafted Postscript files. According to the WordPress advisory, the issue resides in the interaction between ImageMagick (via the Imagick PHP extension) and Ghostscript, both of which are commonly deployed in WordPress hosting environments. The fix has also been backported to all supported branches dating back to 4.7, ensuring that legacy installations receive protection as well.

The vulnerability, analyzed in detail by vulnerability management firm Patchstack, stems from a mismatch between how WordPress and ImageMagick interpret uploaded files. WordPress validates a file based on its extension, while ImageMagick inspects the actual content. When ImageMagick detects PostScript inside an uploaded file, it delegates rendering to Ghostscript. This means an attacker can upload a file with a legitimate image extension, such as .png, that secretly contains PostScript code, which Ghostscript will then execute as a program. While WordPress includes content-checking routines, several upload paths bypass these safeguards, leaving the door open for exploitation. WordPress addressed the defect by modifying the load() function to validate file contents before passing them to Imagick, effectively blocking PostScript execution pathways and preventing filename-based manipulation.

The realistic threat surface is significant for multi-author blogs, membership platforms, and any WordPress site with open or loosely managed registration. Patchstack emphasized that an Author uploading a booby-trapped "image" represents a practical, not theoretical, risk. Site administrators are urged to update to 7.0.4 immediately and audit their contributor accounts, particularly those of former staff or guest authors. Organizations managing multiple WordPress deployments should also verify that supporting libraries, including Ghostscript and ImageMagick, are patched to their latest stable versions. Administrators can use our port scanner to confirm their web servers are not exposing unnecessary management interfaces, and our password checker to evaluate the strength of credentials protecting Author, Editor, and Administrator accounts that could serve as the initial access point for this type of attack. Additional hardening, such as restricting file upload types at the web server level and monitoring outbound traffic from PHP processes, is also recommended to mitigate residual risk.