When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.
WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.
- Patched in WordPress 7.0.4 maintenance release
- Author-level remote code execution via crafted image upload
- Issue lies in media handoff to ImageMagick
- No CVE ID or in-the-wild exploitation cited
The latest WordPress maintenance release 7.0.4 includes a quiet but important security fix, and it’s one worth understanding rather than just clicking “update” past. It changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your […]
This source does not provide full text. Read it at patchstack.com.