What changed
WordPress released 7.0.4 on August 12, 2026 to fix CVE-2026-65640, a high-severity remote code execution vulnerability involving malicious PostScript uploads on installations that use Imagick and Ghostscript. The project has also issued patched backports for older branches through WordPress 4.7.
Why it matters
This is not a generic hardening update. A user with Author-level privileges or another role carrying the upload_files capability can potentially turn a permitted media upload into server-side code execution when the vulnerable image-processing stack is present. Sites with contributor workflows, multi-author publishing, membership plugins or delegated content teams therefore have a meaningful privilege-boundary risk even if anonymous uploads are disabled.
The vulnerability sits behind a normal WordPress capability
The WordPress security advisory describes a remote code execution path through a malicious PostScript file uploaded by a user with the upload_files capability. Author-level users normally have that capability, so exploitation does not require administrator access. The server must also be using Imagick and Ghostscript; the underlying weakness is in Ghostscript's handling of certain embedded files.
7.0.4 is the current fix, with backports for older branches
WordPress 7.0.4 contains the fix for the current 7.0 branch. The security advisory lists patched releases for every maintained backport line through WordPress 4.7, including 6.9.7, 6.8.8, 6.7.7 and corresponding point releases for older branches. WordPress.org recommends updating immediately and notes that only the latest release line is actively supported even though this fix was backported as a courtesy.
Why multi-user sites should treat this differently from an anonymous upload bug
The prerequisite is low privilege rather than no privilege. That narrows the attack surface, but it also makes role design relevant: editorial sites, agencies, communities and applications that grant upload capability to non-admin users should not assume that trusted-but-limited accounts are harmless. Builders should verify both the WordPress version and whether the host's media stack includes Imagick and Ghostscript.