AI analysis
WordPress core is vulnerable to remote code execution when a user with Author-level privileges or higher (holding the upload_files capability) uploads a malicious Postscript file that the server processes using the Imagick image library with Ghostscript. Exploitation requires two server prerequisites: Imagick must be in use and Ghostscript must be installed, and the attacker needs an account with upload rights, so unauthenticated attacks are not possible. A successful attacker gains code execution on the web server with high impact on confidentiality, integrity, and availability (CVSS 8.8). All versions of WordPress are affected; a fix shipped in WordPress 7.0.4 and was backported as a courtesy to all branches back to 4.7. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns a 1.9% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is documented.
What to do: Update WordPress to 7.0.4 or apply the corresponding patched point release for your branch (fixes are backported to all branches back to 4.7). If you cannot update immediately, check whether Imagick and Ghostscript are enabled on the server and consider disabling Ghostscript-based processing of uploaded Postscript files or restricting accounts with the upload_files capability. Review upload logs for Postscript-family files (e.g., .ps/.eps) uploaded by Author-level or higher users as a precaution.
Affected
| WordPress (core) | All versions prior to the fix; fixed in 7.0.4, with the fix backported to all branches back to 4.7 |
Estimated exposure
masstens of millions of WordPress sites (core powers roughly 43% of the web), with the exploitable subset being sites running Imagick + Ghostscript and granting… — WordPress core is deployed on tens of millions of websites (~43% of all sites per public market-share measurements), but only servers with Imagick and Ghostscript enabled and accounts with upload_files capability are actually exploitable,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.