CVE-2026-65640: WordPress 7.0.4 Patches Imagick+Ghostscript Upload RCE
WordPress 7.0.4 shipped 12 Aug as an emergency release for CVE-2026-65640 (CVSS 8.8), an Imagick+Ghostscript upload RCE. Author+ is enough. Affects 4.7–7.0. XML-RPC and MP3 cover extraction bypass upload checks.
On 12 Aug 2026, WordPress Security released 7.0.4, patching a high-severity RCE spanning nearly 10 years of releases: CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w, CVSS 8.8. Responsible disclosure by pwn.ai. Root cause is a validation gap in the Imagick+Ghostscript pipeline. An attacker with Author or higher uploads a file that looks like a PNG and executes arbitrary code on the server.
Incident overview
The bug is in `WP_Image_Editor_Imagick::load()`. WordPress historically classifies uploads by extension and MIME type. ImageMagick identifies format from content (magic bytes). When those trust boundaries misalign: an attacker uploads a fake image containing PostScript, renamed to `.png`. WordPress allows it on extension alone. ImageMagick reads the real bytes, identifies PostScript, and hands it to Ghostscript. Ghostscript has a long history of design flaws that allow embedded command execution. Result: arbitrary command execution as the PHP worker. The patch is backported to all supported branches from 4.7 through 7.0.x.
Technical details
Three-component trust mismatch
- WordPress validation: extension / client-declared MIME type;
- ImageMagick validation: real identification from leading bytes (magic);
- Ghostscript interpretation: executes embedded instructions on PostScript/EPS/PDF.
The three components disagree on file type, so a PostScript payload crosses every boundary. This is a regression of the 2016 ImageTragick family in a new context—structural fragility in the image-processing pipeline vs. file-type validation.
Two hidden paths around upload checks
The standard Media Library path runs `wp_check_filetype_and_ext()` and can block the payload. Patchstack notes two bypasses: XML-RPC `wp.uploadFile`, and automatic MP3 cover extraction. Both write via lower-level functions and skip that check, so the PostScript payload reaches the vulnerable decoder. XML-RPC is on by default in WordPress; the remote endpoint is reachable without logging into wp-admin. That side door turns a theoretical bug into a weaponizable path.
Impact
The bug has real attack value for three reasons:
- Author is an easy bar: multi-author sites, membership communities, guest-blog networks, outsourced editor accounts. Author accounts are common and often unaudited after staff turnover;
- Credential stuffing is common: password spraying against WordPress login is among the highest-volume automated attacks. Weak Author passwords are widely exposed;
- Reach-back to 4.7, nearly 10 years: every unpatched site is in scope. Attackers get a stable, well-understood exploit chain.
Exploitation requires both the Imagick PHP extension and the Ghostscript binary. Sites using only the GD image library are not hit by this path. Still patch, so a later stack change does not re-enable the chain.
Remediation
Immediate
- Log in to wp-admin → Dashboard → Updates; upgrade to 7.0.4;
- On 6.9.x / 6.8.x and other older branches, install the matching minor (6.9.7 / 6.8.8, etc.);
- 4.6 and below are EOL. Plan a full-site upgrade or decommission.
Defense in depth
- Tools → Site Health → Info → Media Handling: confirm whether Imagick+Ghostscript is enabled;
- Audit Author / Editor / Administrator accounts. Disable or demote former staff, contractors, guest authors;
- If not required, disable XML-RPC (`disable-xmlrpc` plugin, or WAF rule blocking POST to `xmlrpc.php`);
- Deploy WAF rules to block PostScript/EPS/PDF uploads; stop cross-format attacks.
References
- Falcon Internet: CVE-2026-65640 technical analysis
- WordPress 7.0.4 security release notes
- Bellator Cyber: WordPress 7.0.4 RCE risk assessment