WordPress 7.0.4 Fixes a Flaw That Let a Disguised Image Run Code on Your Server

WordPress released version 7.0.4 today, a security-only update that closes a hole letting a logged-in Author account turn a fake image upload into code execution on your server. Every WordPress site from version 4.7 through 7.0 is affected. Update now.

What happened

WordPress uses the Imagick extension to resize and process images you upload to your Media Library. Imagick, in turn, can hand certain files off to a separate program called Ghostscript, which knows how to read PostScript, EPS, and PDF files. The problem: WordPress decided how to process an uploaded file by looking at its file extension, while Imagick actually reads the file’s contents to figure out what it is. According to a technical writeup from security firm Patchstack, that mismatch meant a file named holiday.png could actually contain PostScript code. WordPress would wave it through as an image, Imagick would spot the PostScript inside, and hand it to Ghostscript to render, which has a long history of being tricked into running commands it shouldn’t.

That gave any user with at least an Author role, someone who can normally just publish their own posts, a path to run malicious code on the server. WordPress credits the team at pwn.ai for finding and reporting the bug, tracked as CVE-2026-65640.

Who is at risk

Any site running WordPress 4.7 through 7.0 that has the Imagick extension and Ghostscript installed on its server is exposed, and that combination is common on shared hosting. You don’t need a vulnerable plugin or theme, this is a flaw in WordPress core itself. The risk depends on trusting your Author-level users: if you only publish through vetted staff, your exposure is lower than a site that opens Author accounts to outside contributors.

What to do

Update to 7.0.4 now. WordPress has backported the fix all the way back to the 4.7 branch, so there’s a patched release for your version no matter how old your install is. Check Dashboard → Updates, or download it directly from WordPress.org. Sites with automatic background updates should already be patched, but don’t assume, check. The same fix has also been rolled into RC3 of WordPress 7.1, which is still on track for a final release on August 19. We covered the 7.0.3 security release five days ago; this is a separate, unrelated flaw.

End of article