WordPress has released version 7.0.4, a security-focused update addressing a critical remote code execution (RCE) vulnerability identified as CVE-2026-65640. This flaw affects sites utilizing the Imagick extension in conjunction with Ghostscript for image processing. Site administrators are strongly advised to update immediately to mitigate potential risks.
The vulnerability allows authenticated users with Author-level privileges to execute arbitrary code by uploading specially crafted files. The issue stems from WordPress’s reliance on ImageMagick for resizing and processing images in the Media Library. ImageMagick supports various formats, including PostScript, EPS, and PDF, delegating their rendering to Ghostscript. This delegation can be exploited to execute unintended commands.
Technical Details
The core of the problem lies in the discrepancy between file type identification methods. ImageMagick determines a file’s type by inspecting its actual content, whereas WordPress’s `WP_Image_Editor_Imagick::load()` method primarily relies on the file extension. Consequently, a file named with a benign extension like `.png` could contain malicious PostScript code. Such a file could bypass upload checks and be processed by Imagick, which would recognize the embedded PostScript and invoke Ghostscript, leading to code execution.
Standard upload processes in WordPress typically utilize the `wp_check_filetype_and_ext()` function to detect such mismatches. However, certain upload pathways, such as the XML-RPC `wp.uploadFile` method and the cover-art extraction routine for MP3 files, use `wp_upload_bits()` instead. This function does not perform content inspection, providing attackers with alternative vectors to upload malicious payloads.
Mitigation Measures
The recent update addresses these vulnerabilities by modifying the `load()` function to inspect the actual content of uploaded files before processing them with Imagick. The updated function now scans the initial portion of each file, blocking those with PostScript or EPS signatures, fake PDFs lacking the genuine `%PDF-` header, and compressed files like gzip or bzip2 that ImageMagick would otherwise unpack silently.
Additionally, the update prevents attackers from using format specifiers in filenames (e.g., `EPS:innocent.png`) to force ImageMagick to use a dangerous decoder. The new code strips and validates these prefixes, ensuring compatibility across different operating systems, and applies the same scrutiny to filenames from remote URLs or streams.
Exploitation of this vulnerability requires at least Author-level access, meaning unauthenticated attacks are not possible. However, the risk varies depending on the site’s user base. Multi-author blogs, membership platforms, and client sites with open or loosely managed contributor access are at higher risk, as any Author can attempt to upload a malicious file disguised as an image. Sites with a small, trusted editorial team face comparatively lower risk.
WordPress has backported these fixes through the 4.7 branch and into the upcoming 7.1 RC3 release. However, full ongoing support is provided only for the latest version. Site administrators should verify their current version and update without delay, especially if upload privileges extend beyond a core trusted team.
This incident underscores the importance of robust input validation and the need for continuous vigilance in managing user privileges. As attackers increasingly exploit complex interactions between software components, maintaining up-to-date systems and implementing strict access controls are essential steps in safeguarding websites against emerging threats.
