WordPress has released an emergency patch to fix a high-severity vulnerability that can allow attackers with Author-level user permissions or higher to execute arbitrary code remotely. The issue, tracked as CVE-2026-65640, affects only WordPress installations that use Imagick and Ghostscript, and requires an attacker to have file upload rights.
The vulnerability stems from the way ImageMagick (through the Imagick extension) and WordPress handle certain types of files. While WordPress checks the file extension, ImageMagick looks at the contents, which creates a window for exploitation. According to Patchstack, a vulnerability management firm, attackers can exploit this by uploading a PNG file containing PostScript code, which will be executed in Ghostscript as a PostScript program.
This means that even if an attacker doesn’t have direct access to sensitive files or databases, they can still cause significant harm by manipulating the system through Ghostscript. WordPress has addressed the issue by modifying the load() function to check the file’s contents before passing it to Imagick, preventing PostScript execution and other types of manipulation.
The patch is included in version 7.0.4 of WordPress, but it also backports the fix to all branches from 4.7 onwards as a courtesy to users on older versions. This means that even if you’re running an older version of WordPress, you should update to the latest available version to ensure your site is secure.
This vulnerability highlights the importance of monitoring file uploads and checking the contents of files before passing them to ImageMagick or other external libraries. It also underscores the risks associated with using Ghostscript in web applications, which can provide an entry point for attackers if not properly secured.
If you’re responsible for managing a WordPress site, it’s essential to apply the patch as soon as possible and ensure that all users have appropriate permissions. Remember that even if you don’t run a high-traffic or sensitive website, an attacker with Author-level user permissions can still cause significant harm – so updating your WordPress installation is crucial.
As always, keeping your software up-to-date is key to maintaining the security of your online presence. In this case, applying the patch for CVE-2026-65640 will not only fix the current vulnerability but also prevent potential future attacks that may target similar weaknesses in your system.
Source: SecurityWeek — 2026-08-13