WordPress 7.0.4 fixes Ghostscript code-execution via images

WordPress released version 7.0.4 on Wednesday to fix CVE-2026-65640, a high-severity remote code execution flaw. The vulnerability has a CVSS score of 8.8 and affects sites that use the Imagick PHP extension together with Ghostscript. Exploitation requires an account with file upload rights, typically Author-level or higher.

The flaw arose from a mismatch in how WordPress and ImageMagick determine file types. WordPress often relied on a file’s extension to decide how to process uploads, while ImageMagick inspects the file’s actual contents. If ImageMagick detected embedded PostScript, it invoked Ghostscript to render the file. An attacker could upload a file with a benign extension such as .png that contained PostScript code; Ghostscript would then execute that code.

Vulnerability researchers at Patchstack found that some upload paths did not invoke WordPress’s content checks, leaving a route for exploitation. A successful attack required both the Imagick extension and Ghostscript to be present on the server and an account with permission to upload files.

WordPress modified the Imagick load() workflow to verify a file’s contents before handing it to Imagick and added checks to block filename manipulation that could force a Ghostscript call. The fix is included in version 7.0.4 and has been backported to branches back to 4.7.

Patchstack warned, “If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, an Author uploading a booby-trapped ‘image’ is a genuinely realistic threat, not a theoretical one.”

Administrators are advised to install version 7.0.4 or apply the backported fixes for older branches to close the vulnerability. Sites that do not use Imagick or that lack Ghostscript on the server are not affected by this specific flaw. Administrators are also advised to review file upload handling and account privileges to limit exposure.