WordPress: Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File

WordPress Patches Critical RCE Vulnerability in Imagick Extension

WordPress has released version 7.0.4, a security update addressing a remote code execution (RCE) vulnerability (CVE-2026-65640, GHSA-8vr3-7mxf-gx8w) in sites using the Imagick extension with Ghostscript. The flaw, disclosed by researchers at pwn.ai, allows authenticated Author-level users to execute arbitrary code via crafted file uploads.

The vulnerability stems from ImageMagick’s handling of non-image files, such as PostScript, EPS, and PDFs, which it processes using Ghostscript a tool historically prone to exploitation. WordPress’s WP_Image_Editor_Imagick::load() method previously relied on file extensions rather than content inspection, enabling attackers to bypass checks by disguising malicious payloads (e.g., a .png file containing PostScript code).

Exploitation was possible through alternate upload paths, including XML-RPC’s wp.uploadFile and MP3 cover-art extraction, which skipped WordPress’s wp_check_filetype_and_ext() validation. The patch (commit 7daaa50) now scans file headers to block PostScript, EPS, fake PDFs, and compressed formats, while also stripping format specifiers (e.g., EPS:innocent.png) that could force unsafe decoding.

While the flaw requires Author-level access, sites with multi-author or open contributor models face heightened risk. WordPress has backported fixes to the 4.7 branch and the upcoming 7.1 RC3, though only the latest version receives full support. Administrators are advised to update immediately, particularly on sites with broad upload privileges.

Source: https://cybersecuritynews.com/wordpress-imagick-rce-vulnerability/

WordPress cybersecurity rating report: https://www.rankiteo.com/company/wordpress

"id": "WOR1786595022",
"linkid": "wordpress",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Sites with multi-author or open '
                                              'contributor models using '
                                              'Imagick extension',
                        'industry': 'Technology/Web Development',
                        'name': 'WordPress',
                        'type': 'Content Management System (CMS)'}],
 'attack_vector': 'File upload (crafted PostScript/EPS/PDF disguised as '
                  'images)',
 'data_breach': {'file_types_exposed': ['PostScript',
                                        'EPS',
                                        'PDF',
                                        'Compressed formats']},
 'description': 'WordPress has released version 7.0.4, a security update '
                'addressing a remote code execution (RCE) vulnerability '
                '(CVE-2026-65640, GHSA-8vr3-7mxf-gx8w) in sites using the '
                'Imagick extension with Ghostscript. The flaw allows '
                'authenticated Author-level users to execute arbitrary code '
                'via crafted file uploads due to improper handling of '
                'non-image files like PostScript, EPS, and PDFs.',
 'impact': {'operational_impact': 'Potential arbitrary code execution on '
                                  'affected systems',
            'systems_affected': 'WordPress sites using Imagick extension with '
                                'Ghostscript'},
 'investigation_status': 'Patched',
 'lessons_learned': 'File extension validation is insufficient; content '
                    'inspection is critical for security. Alternate upload '
                    'paths (e.g., XML-RPC) can bypass security checks.',
 'post_incident_analysis': {'corrective_actions': 'Implemented file header '
                                                  'scanning, blocked unsafe '
                                                  'formats, and stripped '
                                                  'format specifiers in '
                                                  'WordPress 7.0.4.',
                            'root_causes': 'Reliance on file extensions '
                                           'instead of content inspection; '
                                           "Ghostscript's historical "
                                           'vulnerability to exploitation.'},
 'recommendations': 'Update to WordPress 7.0.4 or later immediately. Restrict '
                    'Author-level access where possible. Monitor for '
                    'suspicious file uploads.',
 'references': [{'source': 'WordPress Security Advisory'},
                {'source': 'pwn.ai Research'}],
 'response': {'communication_strategy': 'Security advisory released; '
                                        'administrators advised to update '
                                        'immediately',
              'containment_measures': 'Patch released (version 7.0.4) to scan '
                                      'file headers and block unsafe formats',
              'remediation_measures': 'Updated WP_Image_Editor_Imagick::load() '
                                      'to inspect file content, strip format '
                                      'specifiers, and block '
                                      'PostScript/EPS/fake PDFs',
              'third_party_assistance': 'Researchers at pwn.ai'},
 'stakeholder_advisories': 'Administrators advised to update immediately, '
                           'especially on sites with broad upload privileges.',
 'title': 'WordPress Patches Critical RCE Vulnerability in Imagick Extension',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-65640 (GHSA-8vr3-7mxf-gx8w)'}