WordPress on Wednesday announced patches for a high-severity vulnerability that allows authenticated attackers to execute arbitrary code remotely.
Tracked as CVE-2026-65640 (CVSS score of 8.8), the security defect can be exploited by attackers with Author-level user or higher permissions via malicious Postscript file uploads.
According to WordPress’ advisory, the issue affects only installations that use Imagick and Ghostscript, as it was discovered in Ghostscript’s handling of certain embedded files. Successful exploitation requires that an attacker has file upload rights.
“WordPress version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches, the fix has been backported to all branches back to 4.7,” the web content management system’s maintainers announced.
The vulnerability resides in how ImageMagick (through the Imagick extension) and WordPress handle various types of files: ImageMagick looks at the contents, while WordPress looks at the file extension, vulnerability management firm Patchstack explains.
While WordPress passes an uploaded file to ImageMagick based on its extension, ImageMagick looks at the content and, if it detects PostScript inside, calls Ghostscript to render it.
This allows an attacker to upload a PNG file containing PostScript, which will be executed in Ghostscript as a PostScript program. While WordPress does contain a function that performs content checks, some upload methods do not, opening the door for exploitation, Patchstack says.
WordPress addressed the security defect by modifying the load() function to check the file’s contents before passing it to Imagick, preventing PostScript execution. The fix also prevents attackers from using filenames to manipulate Imagick into using Ghostscript.
“If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, […] an Author uploading a booby-trapped ‘image’ is a genuinely realistic threat, not a theoretical one,” Patchstack notes.
Related: Fortinet Patches Authentication Flaws in FortiWeb and FortiManager
Related: Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack
Related: Critical VMware vCenter Vulnerability in Attackers’ Crosshairs
Related: SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
