cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

WordPress 7.0.4 Patches Authenticated RCE via Malicious PostScript Uploads

· Original article ↗

Summary

WordPress patched CVE-2026-65640, an 8.8-rated RCE affecting installations using Imagick and Ghostscript. An authenticated user with upload rights could exploit crafted PostScript content; fixes are available in WordPress 7.0.4 and older branches back to 4.7.

Key points

  • CVE-2026-65640 has a CVSS score of 8.8 and requires an authenticated user with Author-level permissions or higher and file-upload rights.
  • The issue affects WordPress installations using Imagick and Ghostscript.
  • According to Patchstack, an attacker could disguise PostScript content as a PNG; Imagick may pass the content to Ghostscript for rendering and execution.
  • WordPress fixed the issue by checking file contents before passing files to Imagick and preventing filenames from manipulating Imagick into using Ghostscript.
  • WordPress 7.0.4 includes the fix, which maintainers also backported to branches as far back as version 4.7.

Article Details

Vulnerability Types
  • Remote code execution
Severity
High (CVSS 8.8)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAn authenticated attacker can exploit the WordPress vulnerability through a malicious file upload to execute code remotely.

CVE

CVE-2026-65640Tracked as CVE-2026-65640 (CVSS score of 8.8), the security defect can be exploited by attackers with Author-level user or higher permissions via malicious Postscript file uploads.

Products

GhostscriptAccording to WordPress’ advisory, the issue affects only installations that use Imagick and Ghostscript, as it was discovered in Ghostscript’s handling of certain embedded files.ImageMagickThe vulnerability resides in how ImageMagick (through the Imagick extension) and WordPress handle various types of files: ImageMagick looks at the contents, while WordPress looks at the file extension, vulnerabilityImagickAccording to WordPress’ advisory, the issue affects only installations that use Imagick and Ghostscript, as it was discovered in Ghostscript’s handling of certain embedded files.WordPressWordPress on Wednesday announced patches for a high-severity vulnerability that allows authenticated attackers to execute arbitrary code remotely.

Related Articles