WordPress Releases Patch for RCE Vulnerability via Image File Processing

441/69 Friday, August 14, 2026 WordPress has released a security update to fix CVE-2026-65640, a High-severity vulnerability with a CVSS score of 8.8. The vulnerability could allow an authenticated attacker with Author-level privileges or higher to execute code on the system by uploading a specially crafted file. Exploitation requires file upload privileges and affects only WordPress sites using Imagick and Ghostscript. The vulnerability is related to how WordPress and ImageMagick process and validate files through the Imagick extension. WordPress checks file types based on file extensions, while ImageMagick inspects the file content. If PostScript data is detected, Ghostscript is invoked to process it. As a result, an attacker could upload a file, such as a PNG image containing embedded PostScript data, and cause Ghostscript to process the content. Some file upload methods did not sufficiently validate file content before processing. WordPress addressed the vulnerability by improving the load() function to inspect file content before passing it to Imagick, preventing PostScript processing. WordPress version 7.0.4 has been released, and the fix has been backported to all release branches starting from version 4.7. Website administrators should check and update WordPress to a fixed version as soon as possible, especially sites that allow users with Author-level privileges or higher to upload files. Source: https://www.securityweek.com/wordpress-7-0-4-patches-remote-code-execution-vulnerability/