CVE-2026-65640 in WordPress
Summary
by MITRE • 08/17/2026
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability
This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
A critical remote code execution vulnerability exists within the WordPress content management system, specifically affecting its image processing pipeline when integrated with external libraries such as Imagick and Ghostscript. This flaw allows an attacker who possesses at least Author-level privileges or higher capabilities, including the ability to upload files, to execute arbitrary commands on the underlying server infrastructure. The root cause of this vulnerability lies in how WordPress handles file uploads for images processed by these specific extensions. When a user uploads a maliciously crafted Postscript file, the system passes it through Ghostscript without adequate sanitization or validation of the input content. This lack of proper input validation enables an attacker to inject shell commands that are subsequently executed by the server during the image processing phase.
The operational impact of this vulnerability is severe due to its potential for full system compromise. Since Ghostscript operates with the privileges of the web server process, successful exploitation grants the attacker a foothold on the host machine. This can lead to unauthorized access to sensitive data, modification or deletion of website files, and further lateral movement within the network environment. The requirement that the user must have upload capabilities means that authenticated attackers, including those who may have obtained credentials through phishing or credential stuffing attacks, are in a prime position to exploit this flaw. It is important to note that while unauthenticated users cannot directly trigger this specific vector due to permission restrictions, the existence of such high-privilege access points significantly expands the attack surface for malicious actors targeting WordPress installations.
From a technical classification perspective, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection). The failure lies in the application's inability to neutralize special elements within user-controlled input before incorporating them into code or commands executed by Ghostscript. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving system-level command execution via uploaded files. The vulnerability highlights the risks associated with integrating powerful external processing tools like Imagick without implementing strict allow-lists for file types or rigorous content validation mechanisms.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply the security patches released in WordPress version 7.0.4, which have been backported to all supported branches starting from version 4.7. Administrators should verify their installation versions and update immediately if they are running any older release. Beyond patching, organizations should enforce strict file upload policies by disabling unnecessary image processing features or restricting the use of Imagick and Ghostscript where not strictly required for business operations. Implementing a Web Application Firewall can also provide an additional layer of defense by detecting and blocking malicious Postscript payloads before they reach the vulnerable code paths. Regular security audits and monitoring of server logs for unusual Ghostscript activity are recommended to detect potential exploitation attempts in real time.