A high-severity vulnerability, 'CVE-2026-65640,' has been reported in the content management system 'WordPress,' potentially allowing remote arbitrary code execution under specific conditions. This vulnerability poses a risk of exploitation by attackers with Author-level privileges or higher, in environments using the image processing libraries Imagick and Ghostscript. The WordPress development team has released a patched version, 'WordPress 7.0.4,' to address this issue and is urging users to update promptly. While no active exploitation of this vulnerability has been confirmed at present, its potential impact is significant, requiring a swift response.
Immediate Actions
- ✓**Update WordPress to the patched version 7.0.4:** Update manually from the admin screen, or check the application status if automatic background updates are enabled.
- ✓**Check patch application status for older versions:** Backporting efforts for older branches up to WordPress 4.7 are also underway; consider applying them once released.
- ✓**Check for signs of compromise:** Review system logs and WordPress activity logs for suspicious file uploads, unexpected code execution, or privilege changes.
Vulnerability Overview and Scope of Impact
'CVE-2026-65640' is a vulnerability residing in the core of WordPress, rated with a CVSSv3.0 base score of 8.8 (Severity: High) by the Common Vulnerability Scoring System. This vulnerability allows a user with Author-level privileges or higher to remotely execute arbitrary code by uploading a specially crafted PostScript file in environments where WordPress uses 'Imagick' and 'Ghostscript' for image processing. As a result, significant impacts such as site compromise by attackers or arbitrary program execution on the server may occur.
Specific Impacts and Attack Scenarios
In an attack scenario exploiting this vulnerability, an attacker first obtains an account with Author-level privileges or higher on a WordPress site through some means. Then, using that account, they upload a deliberately crafted PostScript file (e.g., a malicious file disguised as an image file) via the WordPress media library or similar means. When ImageMagick or Ghostscript processes this file, the vulnerability is triggered, and arbitrary code intended by the attacker is executed on the server. This can lead to website defacement, data theft, and even a compromise of the entire server. According to statistics from web technology research company W3Techs, WordPress is used by 41.2% of all websites, making it a foundational presence on the internet.
Response Steps and Verification Methods
Log in to the WordPress admin panel and apply the update to the latest version, 7.0.4, from 'Dashboard' -> 'Updates'. Even if automatic updates are configured, it is crucial to confirm that the latest version has been applied. Additionally, check for any suspicious files uploaded in the past, especially unexpected PostScript files (.ps, .eps, etc.) or unfamiliar PHP files in the `/wp-content/uploads/` directory. Server access logs and error logs should also be checked for suspicious requests or errors.
📦