WordPress 7.0.4 Patches High-Severity RCE Flaw

WordPress 7.0.4 shipped a security release patching a high-severity remote code execution vulnerability affecting WordPress 4.7 through 7.0.3. The fix is backported across all affected branches. SecurityWeek reported the disclosure on August 13 and the advisory is tracked publicly on GitHub as CVE-2026-65640, CVSS 8.8 (High). Update now.

What the Flaw Does

The vulnerability lives at the intersection of WordPress’s file-upload validation and how ImageMagick processes image files. WordPress checks files by extension when they’re uploaded. ImageMagick, however, checks by examining file contents. An attacker with Author-level permissions or higher can craft an image file with a benign extension — say, PNG — that contains embedded PostScript code in its data. When WordPress passes that file to the PHP Imagick extension for processing, ImageMagick recognizes the PostScript content and hands it to Ghostscript for rendering. Ghostscript executes it.

The outcome is code execution on the web server under the permissions of the web server process — and from there, depending on the server setup, the attacker’s options expand.

Three conditions must all be true for the flaw to be exploitable:

• The WordPress account used for the upload has Author, Editor, or Administrator privileges
• The PHP Imagick extension is installed on the server
• Ghostscript is installed on the server

Imagick with Ghostscript is common in managed WordPress hosting environments where rich image processing is enabled by default. It’s not universal, but it’s not rare.

The Fix

WordPress 7.0.4 modifies the file load function to verify file contents before passing them to Imagick — the check happens before Ghostscript ever processes the input. Per Patchstack’s analysis cited in SecurityWeek’s coverage, the patch closes the validation gap that allowed the content-type mismatch to be exploited.

If your WordPress installation is on auto-updates, check Dashboard → Updates to confirm 7.0.4 is applied. If you’re managing updates manually or through a deployment pipeline, prioritize this cycle.

What to Do

1. Update to WordPress 7.0.4 (or the backported version for your branch, per the GitHub advisory). This is the only fix.
2. Check your extension stack. If Imagick isn’t required for your workflows, removing it eliminates this attack surface — and a class of similar file-processing vulnerabilities that follow the same pattern.
3. Scope your Author accounts. Exploitation requires authenticated upload access. Reduce the number of accounts with that permission level to what the site actually needs. Unused contributor accounts are standing attack surface.
4. Managed hosting customers — your provider may have already applied server-level mitigations or pre-applied the WordPress update. Don’t assume; verify independently through the admin dashboard.

The authentication requirement puts this below the critical-tier threshold compared to unauthenticated RCE, but contributor and author accounts are targets. Credential stuffing against WordPress login pages is a reliable attacker playbook, and a valid Author session unlocks this vulnerability completely.

Related: BdThemes Supply Chain Creates Rogue WordPress Admins covered a recent attack that seeded unauthorized admin accounts across plugin-using sites — another demonstration that the contributor/admin account layer is an active attack target. And Three CVEs Chain to Admin Takeover in WordPress Login Plugin shows the plugin ecosystem adding its own exposure on top of core.

Check the full list of actively exploited vulnerabilities on our KEV tracker.