CVE-2026-65640

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 1.94%
EPSS Percentile: 79.95%
CISA KEV: Not listed

Description

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Technical Details

CVSS Version: 3.0
CNA / NVD Source: [email protected]
Published: 18-Aug-2026 04:16
Last Modified: 04-Sep-2026 00:02
EPSS Date: 2026-10-23
CWE: CWE-434

CVSS Vector


            CVSS:3.0                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

[email protected]

Last enrichment sync: 24-Oct-2026 15:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Elementor Pro Flaw Allows Unauthenticated PHP Upload and Remote Code Execution
Tracked as CVE-2026-65640 (CVSS score of 8.8), the security defect can be exploited by attackers with Author-level user or higher permissions via malicious Postscript file uploads. WordPress 7.0.4 Patches Authenticated RCE via Malicious PostScript Uploads

CVE (1)

People (1)

MITRE ATT&CK (1)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.