When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.
WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.
- Patched in WordPress 7.0.4 maintenance release
- Author-level remote code execution via crafted image upload
- Issue lies in media handoff to ImageMagick
- No CVE ID or in-the-wild exploitation cited
- Vendors
- WordPressPatchstack
- Products
- WordPressImageMagick
From the original article
The latest WordPress maintenance release 7. 0. 4 includes a quiet but important security fix, and it’s one worth understanding rather than just clicking “update” past.
By Dave Jong · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.