# WordPress 7.0.4 fixes an Author-level file upload path to remote code execution WordPress 7.0.4 patches a high-severity remote code execution vulnerability that can be triggered by a user with file-upload permission on servers using Imagick and Ghostscript. WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7. - Status: Active - Published: 2026-08-15T17:44:09+12:00 - Updated: 2026-08-15T17:44:09+12:00 - Categories: Web Development, WordPress - Tags: CVE-2026-65640, Ghostscript, Imagick, security, WordPress 7.0.4 - Canonical HTML: https://beyondthe.news/dossiers/wordpress-7-0-4-fixes-author-upload-rce ## What changed WordPress released 7.0.4 on August 12, 2026 to fix CVE-2026-65640, a high-severity remote code execution vulnerability involving malicious PostScript uploads on installations that use Imagick and Ghostscript. The project has also issued patched backports for older branches through WordPress 4.7. ## Why it matters This is not a generic hardening update. A user with Author-level privileges or another role carrying the upload_files capability can potentially turn a permitted media upload into server-side code execution when the vulnerable image-processing stack is present. Sites with contributor workflows, multi-author publishing, membership plugins or delegated content teams therefore have a meaningful privilege-boundary risk even if anonymous uploads are disabled. ## The vulnerability sits behind a normal WordPress capability The WordPress security advisory describes a remote code execution path through a malicious PostScript file uploaded by a user with the upload_files capability. Author-level users normally have that capability, so exploitation does not require administrator access. The server must also be using Imagick and Ghostscript; the underlying weakness is in Ghostscript's handling of certain embedded files. ## 7.0.4 is the current fix, with backports for older branches WordPress 7.0.4 contains the fix for the current 7.0 branch. The security advisory lists patched releases for every maintained backport line through WordPress 4.7, including 6.9.7, 6.8.8, 6.7.7 and corresponding point releases for older branches. WordPress.org recommends updating immediately and notes that only the latest release line is actively supported even though this fix was backported as a courtesy. ## Why multi-user sites should treat this differently from an anonymous upload bug The prerequisite is low privilege rather than no privilege. That narrows the attack surface, but it also makes role design relevant: editorial sites, agencies, communities and applications that grant upload capability to non-admin users should not assume that trusted-but-limited accounts are harmless. Builders should verify both the WordPress version and whether the host's media stack includes Imagick and Ghostscript. ## Key details - WordPress 7.0.4 was released on August 12, 2026 as a security release. - The vulnerability is CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w and is rated High with a CVSS v3 score of 8.8. - Exploitation requires a malicious user with the upload_files capability, typically available to Author-level users or higher. - The affected server configuration uses Imagick and Ghostscript; the advisory says the weakness is in Ghostscript handling of certain embedded files. - The advisory lists patched backports for branches from 7.0 down through 4.7. ## Builder takeaways - Update WordPress to 7.0.4 if you are on the 7.0 branch; if you are pinned to an older branch, verify that the corresponding patched backport listed in the advisory is installed. - Check whether your production images use both Imagick and Ghostscript. If they do, treat this patch as higher priority for any site where non-admin users can upload media. - Audit which roles and custom capabilities include upload_files. Membership, marketplace and editorial plugins can widen the set of accounts able to reach this path beyond the default Author role. - Do not use role restrictions as a substitute for patching. The advisory's attack requirements reduce exposure but still allow a compromised or malicious low-privilege account to cross into server-side execution. ## What to watch - Whether hosting providers automatically deploy the backported releases across older WordPress branches. - Whether exploitation attempts or public proof-of-concept material emerge now that the advisory is public. - Whether WordPress or Ghostscript publishes additional hardening guidance for PostScript processing in media workflows. ## Uncertainties - The advisory establishes the required configuration and privileges, but it does not quantify how many WordPress installations use the vulnerable Imagick-plus-Ghostscript path or grant upload_files to untrusted users. ## Timeline - **2026-08-12 — WordPress 7.0.4 released:** WordPress publishes 7.0.4 as a security release and recommends immediate updating. - **2026-08-12 — Security advisory published:** GHSA-8vr3-7mxf-gx8w documents CVE-2026-65640, the affected and patched versions, prerequisites and CVSS 8.8 severity. ## Sources - [WordPress 7.0.4 Release](https://wordpress.org/news/2026/08/wordpress-7-0-4-release/) — WordPress.org · official_release · 2026-08-12T00:00:00+12:00. Official release announcement and immediate-update guidance. - [Remote code execution vulnerability via malicious file upload by an Author level user or higher](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w) — WordPress / GitHub Security Advisory · security_advisory · 2026-08-12T00:00:00+12:00. Primary advisory for affected versions, patched versions, prerequisites, CVSS score and CVE identifier.