A Critical Vulnerability in WordPress Allows Attackers to Execute Code Remotely
WordPress, one of the most widely used content management systems (CMS) online, has just patched a high-severity vulnerability that enables authenticated attackers to execute arbitrary code on affected sites. The issue, tracked as CVE-2026-65640 with a CVSS score of 8.8, affects only installations that use Imagick and Ghostscript, and requires an attacker to have Author-level user or higher permissions.
The vulnerability resides in the way ImageMagick (through the Imagick extension) and WordPress handle various types of files. While WordPress checks the file extension before passing it to ImageMagick for processing, the latter looks at the contents of the file. This allows an attacker to upload a PNG file containing PostScript code, which will be executed by Ghostscript as a PostScript program. The attack can succeed even if the uploaded file has a valid PNG extension, making it difficult for administrators to detect.
According to Patchstack, a vulnerability management firm that explained the issue in detail, WordPress passes an uploaded file to ImageMagick based on its extension, but ImageMagick looks at the content and calls Ghostscript to render it if it detects PostScript inside. This creates a window of opportunity for attackers to exploit, especially in cases where upload methods do not perform content checks.
The patch addresses this security defect by modifying the load() function to check the file’s contents before passing it to Imagick, preventing PostScript execution and blocking attempts to manipulate ImageMagick into using Ghostscript. The fix has been included in WordPress version 7.0.4 and backported to all branches from 4.7.
For website owners and administrators, this vulnerability is a stark reminder of the importance of keeping software up-to-date and being mindful of file uploads. “If you run a multi-author publication, a membership site, or a client site with contributors,” notes Patchstack, “an Author uploading a booby-trapped ‘image’ is a genuinely realistic threat, not a theoretical one.” To mitigate this risk, users should ensure that all software is updated to the latest version and implement strict access controls on file uploads.
In conclusion, the recent WordPress vulnerability highlights the need for vigilance in website security. By staying informed about potential threats and taking proactive measures to protect against attacks, site owners can safeguard their online presence and prevent costly downtime.
Source: SecurityWeek — 2026-08-13