WordPress has launched model 7.0.4, a security-focused replace that closes a remote code execution vulnerability affecting websites that course of photos with the Imagick extension and Ghostscript.
The WordPress safety crew is urging web site house owners to replace instantly, both by means of the Dashboard’s Updates display or by downloading the discharge straight from WordPress.org, since websites with automated background updates ought to already be receiving the patch.
The flaw, tracked as CVE-2026-65640 and detailed in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai and permits an authenticated Writer-level person to realize distant code execution by means of a crafted file add.
The problem arises from WordPress’s reliance on ImageMagick to resize and course of Media Library photos. ImageMagick doesn’t cease at JPEGs and PNGs; it additionally opens PostScript, EPS, and PDF recordsdata, and to render these codecs it palms the work off to Ghostscript, a instrument with a protracted historical past of being tricked into executing unintended instructions.
WordPress Imagick RCE Vulnerability
Safety researchers will acknowledge this as the identical household of bugs behind the infamous “ImageTragick” vulnerabilities from years previous.
The core downside was a mismatch in how recordsdata get recognized. ImageMagick determines a file’s kind by studying its precise contents, whereas WordPress’s WP_Image_Editor_Imagick::load() technique was largely trusting the file extension as a substitute.
That meant a file named one thing harmless like vacation.png may truly include PostScript code, sail previous add checks, and nonetheless get handed to Imagick, which might acknowledge the embedded PostScript and invoke Ghostscript to execute it.
Usually, WordPress’s wp_check_filetype_and_ext() perform catches this type of mismatch throughout customary uploads, however not each add path runs by means of that verify.
XML-RPC’s wp.uploadFile technique and the cover-art extraction routine for uploaded MP3 recordsdata each write bytes straight utilizing wp_upload_bits(), which skips content material inspection solely, giving attackers an alternate path to plant a malicious payload.
The repair, shipped in commit 7daaa50, rewrites the load() perform so it inspects a file’s precise content material earlier than ever establishing an Imagick object.
It now scans the primary chunk of each uploaded file and blocks something bearing PostScript or EPS signatures, pretend PDFs that declare the extension however lack the real %PDF- header, and compressed recordsdata like gzip or bzip2 that ImageMagick would in any other case silently unpack.
The patch additionally closes a sneakier trick the place attackers may prefix a filename with a format specifier, corresponding to EPS:harmless.png, to drive ImageMagick towards the damaging decoder; the brand new code strips and validates these prefixes whereas rigorously avoiding false positives on Home windows drive letters, and applies the identical scrutiny to filenames arriving through distant URLs or streams.
Exploitation requires Writer-level entry or greater, so this isn’t a drive-by, unauthenticated assault. That stated, the real-world threat relies upon closely on who holds accounts on a given web site.
Multi-author publications, membership platforms, and shopper websites with open or loosely managed contributor entry face real publicity, since any Writer can try and add a booby-trapped file disguised as a picture. Websites restricted to a small, trusted editorial crew carry comparatively low threat.
According to WordPress, the fixes are being backported by means of the 4.7 department and into the upcoming 7.1 RC3 launch, although solely the newest WordPress model receives full ongoing assist. Web site directors ought to confirm their model and replace immediately, significantly on websites the place add privileges lengthen past a core trusted crew.
[Live Webinar] Be a part of Elastic & UnderDefense to learn the way small safety groups can unify AI visibility and agentic response into one working mannequin -> Register Now
