CVE-2026-65640

WordPress core is vulnerable to remote code execution when a user with Author-level privileges or higher (holding the upload_files capability) uploads a malicious Postscript file that the server processes using the Imagick image library with Ghostscript. Exploitation requires two server prerequisites: Imagick must be in use and Ghostscript must be installed, and the attacker needs an account with upload rights, so unauthenticated attacks are not possible. A successful attacker gains code execution on the web server with high impact on confidentiality, integrity, and availability (CVSS 8.8). All versions of WordPress are affected; a fix shipped in WordPress 7.0.4 and was backported as a courtesy to all branches back to 4.7. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns a 1.9% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is documented.

What to do: Update WordPress to 7.0.4 or apply the corresponding patched point release for your branch (fixes are backported to all branches back to 4.7). If you cannot update immediately, check whether Imagick and Ghostscript are enabled on the server and consider disabling Ghostscript-based processing of uploaded Postscript files or restricting accounts with the upload_files capability. Review upload logs for Postscript-family files (e.g., .ps/.eps) uploaded by Author-level or higher users as a precaution.