ZeroHour
Patchstackpublished ()ingested Dave Jong

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

highVulnerabilityimportance 68
AI summary · glm-5.3-flash

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

  • Patched in WordPress 7.0.4 maintenance release
  • Author-level remote code execution via crafted image upload
  • Issue lies in media handoff to ImageMagick
  • No CVE ID or in-the-wild exploitation cited
Full article

The latest WordPress maintenance release 7.0.4 includes a quiet but important security fix, and it’s one worth understanding rather than just clicking “update” past. It changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your […]

This source does not provide full text. Read it at patchstack.com.