Remote code execution affecting WordPress
A vulnerability affecting WordPress would allow an authenticated attacker to remotely execute code on affected systems.
Description
Technical context and vulnerability details
WordPress is a content management system (CMS) widely used for creating websites and blogs. This product is affected by a vulnerability labeled CVE-2026-65640 which results from inadequate management of uploaded Postscript files. Exploitation of this vulnerability would allow an authenticated malicious actor, with at least the author role, to upload a malicious Postscript file. This could lead to arbitrary code execution on the underlying server. It is classified high with a severity score of 8.8 according to CVSS V3.1
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- This vulnerability only affects installations where Imagick and Ghostscript are used and where a malicious user has the upload_files capability;
- All WordPress versions prior to 7.0.4;
- WordPress versions prior to patched on branches 4.7 and later;
- All WordPress versions prior to 7.0.4;
- WordPress versions prior to patched on branches 4.7 and later;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Check if the operating prerequisites (use of Imagick and Ghostscript, and presence of a user with upload_files capability) are met on the systems concerned before any other action;
- Update WordPress to version 7.0.4 or later, or to the patched version available for earlier branches (from 4.7);
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.