WordPress 7.0.4 Fixes Critical Remote Code Execution Vulnerability

Post Views: 13

WordPress released an updated version to address a critical remote code execution vulnerability impacting its platform.

Overview of the Vulnerability

WordPress released an updated version to address a critical remote code execution vulnerability impacting its platform. The flaw, designated CVE-2026-65640 with a CVSS score of 8.8, allows authenticated users with Author-level privileges or higher to execute arbitrary code through specific file upload mechanisms. The issue stems from how the system processes PostScript files via the Ghostscript component when integrated with ImageMagick. The vulnerability affects installations utilizing both Imagick and Ghostscript, as identified in the handling of embedded files within the Ghostscript framework.

Root Cause and Technical Details

Exploitation requires an attacker to have file upload capabilities, enabling them to upload a maliciously crafted file that triggers execution. The WordPress team confirmed that version 7.0.4 includes a fix, with the patch also applied to older branches dating back to 4.7 as a precautionary measure. Technical analysis from vulnerability management firm Patchstack highlights the root cause: ImageMagick evaluates file content while WordPress relies on file extensions. This discrepancy creates a pathway for exploitation when a PNG file containing embedded PostScript is uploaded.

Content Verification and Bypass Risks

Although WordPress includes content verification mechanisms, certain upload methods bypass these checks, allowing malicious files to bypass detection. The update modifies the load() function to validate file contents prior to processing by Imagick, mitigating the risk.

Impact and Mitigation Measures

Patchstack emphasized the practicality of this threat in environments with multiple contributors, noting that a compromised Author account could introduce malicious files without requiring elevated privileges. The advisory underscores the importance of immediate updates for all affected installations. The vulnerability’s severity and exploitability profile necessitate urgent action to prevent potential compromise.

“The update modifies the load() function to validate file contents prior to processing by Imagick, mitigating the risk.”