Medium cybersecurity update: Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
WordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript. The WordPress security team is urging site owners to update immediately, either through the Dashboard’s Updates screen or by downloading the release directly from WordPress.org, since sites with automatic […] The post Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File appeared first on Cyber Security News . Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File WordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript. The WordPress security team is urging site owners to update immediately, either through the Dashboard’s Updates screen or by downloading the release directly from WordPress.org, since sites with automatic background updates should already be receiving the patch. The flaw, tracked as CVE-2026-65640 and detailed in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai and allows an authenticated Author-level user to achieve remote code execution through a crafted file upload. The issue arises from WordPress’s reliance on ImageMagick to resize and process Media Library images. ImageMagick doesn’t stop at JPEGs and PNGs; it also opens PostScript, EPS, and PDF files, and to render those formats it hands the work off to Ghostscript, a tool with a long history of being tricked into executing unintended commands. Security researchers will recognize this as the same family of bugs behind the notorious “ImageTragick” vulnerabilities from years past.
Technical Details
ImageMagick determines a file’s type by reading its actual contents, while WordPress’s WP_Image_Editor_Imagick::load() method was largely trusting the file extension instead. That meant a file named something innocent like holiday.png could actually contain PostScript code, sail past upload checks, and still get handed to Imagick, which would recognize the embedded PostScript and invoke Ghostscript to execute it. Normally, WordPress’s wp_check_filetype_and_ext() function catches this kind of mismatch during standard uploads, but not every upload path runs through that check. XML-RPC’s wp.uploadFile method and the cover-art extraction routine for uploaded MP3 files both write bytes directly using wp_upload_bits() , which skips content inspection entirely, giving attackers an alternate route to plant a malicious payload. The fix, shipped in commit 7daaa50, rewrites the load() function so it inspects a file’s actual content before ever constructing an Imagick object. It now scans the first chunk of every uploaded file and blocks anything bearing PostScript or EPS signatures, fake PDFs that claim the extension but lack the genuine %PDF- header, and compressed files like gzip or bzip2 that ImageMagick would otherwise silently unpack. The patch also closes a sneakier trick where attackers could prefix a filename with a format specifier, such as EPS:innocent.png , to force ImageMagick toward the dangerous decoder; the new code strips and validates these prefixes while carefully avoiding false positives on Windows drive letters, and applies the same scrutiny to filenames arriving via remote URLs or streams. Exploitation requires Author-level access or higher, so this isn’t a drive-by, unauthenticated attack. That said, the real-world risk depends heavily on who holds accounts on a given site.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. Multi-author publications, membership platforms, and client sites with open or loosely managed contributor access face genuine exposure, since any Author can attempt to upload a booby-trapped file disguised as an image. Sites limited to a small, trusted editorial team carry comparatively low risk. According to WordPress, the fixes are being backported through the 4.7 branch and into the upcoming 7.1 RC3 release, though only the latest WordPress version receives full ongoing support. Site administrators should verify their version and update without delay, particularly on sites where upload privileges extend beyond a core trusted team. [Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response New “City-Forum” Hackers Attacking Salesforce and ServiceNow Instances Worldwide Mindgard Raises $30 Million to Tackle AI’s Fastest-Growing Attack Surface China-linked Hackers Using AI Agents to Attack Taiwan Government Websites Critical Adobe ColdFusion Vulnerabilities Allow Attackers to Execute Arbitrary Code WhatsApp Unveils New Scam Alert Feature to Protect Users from Social Engineering Attacks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage Your Incident Response Plan Has a Dependency You Never Approved Security in the AI Era Starts with First Principles Planning Your AI Security – How will You Manage All Your Resources?
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: Cybersecurity News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from Cybersecurity News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
