Key details

  1. WordPress 7.0.4 was released on August 12, 2026 as a security release.
  2. The vulnerability is CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w and is rated High with a CVSS v3 score of 8.8.
  3. Exploitation requires a malicious user with the upload_files capability, typically available to Author-level users or higher.
  4. The affected server configuration uses Imagick and Ghostscript; the advisory says the weakness is in Ghostscript handling of certain embedded files.
  5. The advisory lists patched backports for branches from 7.0 down through 4.7.

What builders should take away

  1. Update WordPress to 7.0.4 if you are on the 7.0 branch; if you are pinned to an older branch, verify that the corresponding patched backport listed in the advisory is installed.
  2. Check whether your production images use both Imagick and Ghostscript. If they do, treat this patch as higher priority for any site where non-admin users can upload media.
  3. Audit which roles and custom capabilities include upload_files. Membership, marketplace and editorial plugins can widen the set of accounts able to reach this path beyond the default Author role.
  4. Do not use role restrictions as a substitute for patching. The advisory's attack requirements reduce exposure but still allow a compromised or malicious low-privilege account to cross into server-side execution.

What changed

WordPress released 7.0.4 on August 12, 2026 to fix CVE-2026-65640, a high-severity remote code execution vulnerability involving malicious PostScript uploads on installations that use Imagick and Ghostscript. The project has also issued patched backports for older branches through WordPress 4.7.

Why it matters

This is not a generic hardening update. A user with Author-level privileges or another role carrying the upload_files capability can potentially turn a permitted media upload into server-side code execution when the vulnerable image-processing stack is present. Sites with contributor workflows, multi-author publishing, membership plugins or delegated content teams therefore have a meaningful privilege-boundary risk even if anonymous uploads are disabled.

The vulnerability sits behind a normal WordPress capability

The WordPress security advisory describes a remote code execution path through a malicious PostScript file uploaded by a user with the upload_files capability. Author-level users normally have that capability, so exploitation does not require administrator access. The server must also be using Imagick and Ghostscript; the underlying weakness is in Ghostscript's handling of certain embedded files.

7.0.4 is the current fix, with backports for older branches

WordPress 7.0.4 contains the fix for the current 7.0 branch. The security advisory lists patched releases for every maintained backport line through WordPress 4.7, including 6.9.7, 6.8.8, 6.7.7 and corresponding point releases for older branches. WordPress.org recommends updating immediately and notes that only the latest release line is actively supported even though this fix was backported as a courtesy.

Why multi-user sites should treat this differently from an anonymous upload bug

The prerequisite is low privilege rather than no privilege. That narrows the attack surface, but it also makes role design relevant: editorial sites, agencies, communities and applications that grant upload capability to non-admin users should not assume that trusted-but-limited accounts are harmless. Builders should verify both the WordPress version and whether the host's media stack includes Imagick and Ghostscript.

Timeline

2026-08-12

WordPress 7.0.4 released

WordPress publishes 7.0.4 as a security release and recommends immediate updating.
2026-08-12

Security advisory published

GHSA-8vr3-7mxf-gx8w documents CVE-2026-65640, the affected and patched versions, prerequisites and CVSS 8.8 severity.

What to watch next

  • Whether hosting providers automatically deploy the backported releases across older WordPress branches.
  • Whether exploitation attempts or public proof-of-concept material emerge now that the advisory is public.
  • Whether WordPress or Ghostscript publishes additional hardening guidance for PostScript processing in media workflows.

Still unclear

  • The advisory establishes the required configuration and privileges, but it does not quantify how many WordPress installations use the vulnerable Imagick-plus-Ghostscript path or grant upload_files to untrusted users.

Sources

Direct reading behind this dossier.

2 sources
WordPress 7.0.4 Release
WordPress.org official_release

Official release announcement and immediate-update guidance.