Wordfence says its Argus research tool found a critical flaw in Ghostscript, the program many servers use to turn uploaded PDFs into preview images. This is not a WordPress plugin problem. It sits in software your host or operating system installs.
What happened
The flaw is tracked as CVE-2026-39919 and scores 9.8 out of 10 on the CVSS severity scale. A crafted PDF that contains a JPEG 2000 image can make Ghostscript write data past the end of a memory buffer. That kind of memory corruption can let an attacker run their own code.
Wordfence says it reported the bug sixteen days before Artifex released the fix in Ghostscript 10.08.0 on September 8. Wordfence also says it turned the bug into unauthenticated remote code execution on a purpose-built WordPress test site. That means an attacker needed no login. The company says its exploits were specific to the exact Ghostscript build they were prepared for.
Wordfence tested ten Linux package environments on September 15. The official WordPress Docker image snapshot it tested was one of the vulnerable ones.
What to do
Because Ghostscript comes from the server, there is nothing to update in your WordPress dashboard.
- Ask your hosting provider whether Ghostscript has been patched for CVE-2026-39919. Most managed hosts update system software for you.
- If you run your own server, update Ghostscript through your operating system’s package manager. Wordfence says your distribution may add the fix to an older version number, so the full package revision matters more than the version number Ghostscript reports.
- If your site runs in a container, rebuild and redeploy it from an updated base image.
This is the second server-level image library flaw Wordfence has reported in recent weeks. It also found a critical libheif flaw in September, which affects how servers open iPhone photos.
End of article