WordPress 7.0.4 Patches RCE Flaw in Imagick/Ghostscript

WordPress 7.0.4 Closes a High-Severity Upload-to-RCE Gap

WordPress released version 7.0.4 on August 13, 2026, patching a single High-severity vulnerability tracked as CVE-2026-65640, a common identifier assigned to publicly disclosed software flaws. The flaw allows a user with Author-level permissions or higher to achieve remote code execution on sites that run the Imagick PHP extension alongside Ghostscript, a widely used open-source interpreter for PostScript and PDF files, by uploading a specially crafted Postscript file through the media library. WordPress.org lists the update as a security release, and site owners running affected configurations should apply it without delay.

Imagick is a PHP wrapper for the ImageMagick image-processing library, commonly used by WordPress core and plugins to generate thumbnails and process media uploads. When a server also has Ghostscript installed, ImageMagick can hand off certain file types, including files disguised as images but containing Postscript instructions, to Ghostscript for processing. That handoff is the mechanism researchers say attackers can abuse: a malicious file uploaded through WordPress's normal media library can trigger code execution on the server rather than simply being rendered as an image.

Who Is Actually Exposed

Not every WordPress site is equally at risk from CVE-2026-65640. Exploitation depends on three conditions lining up: the server must have the Imagick PHP extension enabled, Ghostscript must be installed and reachable by ImageMagick's delegate configuration, and the attacker must control an account with Author-level privileges or above, a tier that includes Authors, Editors, and Administrators. Many managed WordPress hosts either disable Ghostscript delegates by default or run ImageMagick in a restricted policy mode, which narrows real-world exposure. Shared hosting environments, self-managed servers, and sites that accept guest-author or contributor registrations without strict vetting carry the highest practical risk.

The Author-level requirement is a meaningful mitigating factor compared with an unauthenticated flaw, but it should not be read as low risk. WordPress sites routinely accumulate Author and Editor accounts over time, guest bloggers, former staff, marketing contractors, and syndication partners, and any one of those credentials being reused, phished, or brute-forced turns this into a practical attack path. Credential stuffing against WordPress login endpoints remains one of the most common automated attack patterns security researchers observe, which is precisely the access level this bug requires.

A Reminder That WordPress Core RCE Bugs Aren't Rare This Year

CVE-2026-65640 arrives against a backdrop of more severe, actively exploited WordPress issues. In July 2026, a GitHub Security Advisory disclosed CVE-2026-63030, referred to by researchers as "wp2shell," an unauthenticated remote code execution vulnerability in WordPress core. Unlike the newly patched flaw, wp2shell requires no login at all, and researchers assigned the issue a combined CVSS score of 9.8 out of 10 when chained with a related weakness, CVSS, the Common Vulnerability Scoring System, is the industry-standard scale used to rate the severity of software vulnerabilities from 0 to 10. Researchers have reported active exploitation attempts against wp2shell in the wild.

The two issues are unrelated in mechanism but reinforce the same operational lesson: WordPress core, plugins, and server-side dependencies like Ghostscript form a chain that attackers probe continuously. Sites that fall behind on core updates accumulate multiple unpatched paths to compromise at once, which is why security teams generally treat prompt core updates as a baseline control rather than optional maintenance.

What This Means For Your Business

For healthcare practices, tax professionals, and small businesses running WordPress for patient portals, client intake forms, or public-facing marketing sites, this update deserves prompt attention rather than a routine patch-cycle wait. Recommended actions:

• Update to WordPress 7.0.4 immediately on any self-hosted site, and confirm managed hosting providers have applied the patch if they handle core updates on your behalf.
• Audit Author, Editor, and Administrator accounts. Remove or downgrade accounts for former employees, inactive contractors, or guest contributors who no longer need publishing access.
• Enforce multi-factor authentication on every account with Author-level access or higher, this single control blocks the most common route to obtaining the permissions this flaw requires.
• Check whether Ghostscript is actually needed on your hosting environment; if your site doesn't process Postscript files or complex PDF conversions, disabling the Ghostscript delegate in ImageMagick's policy configuration removes the vulnerable code path entirely.
• Review recent media library uploads for unfamiliar file types, particularly files with image extensions that don't match their actual content, and consult your hosting provider or a security professional if anything looks suspicious.

Organizations subject to HIPAA, IRS Publication 4557 safeguards, or similar data-protection obligations should treat an unpatched, internet-facing RCE vulnerability as a documentation gap worth closing quickly. Regulators and auditors increasingly expect evidence of timely patch management as part of a reasonable security program, even when the underlying platform is open-source software maintained by a third party.