WordPress RCE Vulnerability Lets Authenticated Authors Execute Remote Code

WordPress has released version 7.0.4 to address a high-impact authenticated remote code execution (RCE) vulnerability. This flaw could allow users with Author-level privileges or higher to execute code on affected websites.

The vulnerability, tracked as CVE-2026-65640 and GHSA-8vr3-7mxf-gx8w, affects WordPress installations that use the Imagick extension alongside Ghostscript to process uploaded files. The security release is considered urgent, and administrators are advised to update affected sites immediately.

WordPress RCE Vulnerability

The vulnerability was responsibly disclosed by the security research team at pwn.ai. According to their advisory, a malicious file upload could be exploited by an authenticated Author or higher to achieve remote code execution under specific server configurations.

Since Authors are typically allowed to upload media files and publish their own posts, this issue is particularly significant for multi-author websites, newsrooms, community platforms, blogs, and managed WordPress environments that frequently grant authoring permissions to multiple users.

The attack vector relies on interactions among WordPress media handling, the Imagick PHP extension, and Ghostscript. WordPress widely uses Imagick to process images and create thumbnails.

At the same time, Ghostscript is frequently installed to render and convert PostScript and PDF documents. Improper handling of a specially crafted file in this processing chain could allow an attacker to manipulate Ghostscript to interpret controlled content, leading to arbitrary command execution on the web server.

Successful exploitation requires a valid, authenticated account with Author-level access or higher, thereby reducing the risk compared to unauthenticated RCE flaws.

However, the required privilege level should not be seen as a strong security boundary. Threat actors often obtain legitimate WordPress credentials through phishing, password reuse, credential stuffing, compromised administrator devices, or vulnerable third-party plugins.

Therefore, a compromised author account could become an entry point for server-side compromises, web shell deployment, persistence mechanisms, data theft, or lateral movement within the hosting environment.

WordPress version 7.0.4 includes the security fix and is now available through the Dashboard → Updates interface or as a direct download from WordPress.org.

Sites configured for automatic background updates should start receiving the patch shortly. The WordPress security team has also confirmed that the fix will be backported to the 4.7 branch and the upcoming WordPress 7.1 RC3 release, although only the latest WordPress version remains actively supported.

Administrators should prioritize updating production sites, especially where Imagick and Ghostscript are installed. Security teams should review author and editor accounts, revoke unnecessary permissions, reset credentials for suspicious users, enforce multi-factor authentication, and inspect web server logs for unusual uploads or unexpected Ghostscript-related activity.

Monitoring for newly created PHP files, modified themes or plugin directories, outbound connections, and anomalous process execution can help identify potential post-exploitation behavior.

This release was led by John Blackbourn, with significant contributions from Dennis Snell, Jeremy Felt, and the wider WordPress contributor community.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world