WordPress RCE Flaw (CVE-2026-65640) Patched

Executive Summary

The WordPress security team has released WordPress 7.0.4, a critical security update that patches a high-severity remote code execution (RCE) vulnerability. The flaw, tracked as CVE-2026-65640 with a CVSS score of 8.8, affects WordPress sites that use the Imagick PHP extension and the Ghostscript library for image processing. An authenticated attacker with at least 'Author'-level permissions (i.e., the ability to upload files) can upload a malicious file disguised as an image to trigger the vulnerability and achieve full server compromise. The fix has been backported to all WordPress versions since 4.7. Due to the widespread use of WordPress, immediate updates are strongly recommended for all site administrators.

Vulnerability Details

The vulnerability is an authenticated RCE that stems from a file type validation bypass in the media upload process. Here's how it works:

1. An attacker with upload_files capability (typically 'Author' role and above) uploads a file.
2. The file is crafted to have a benign extension like .png but contains malicious PostScript code within its content.
3. WordPress checks the file extension, which appears safe, and accepts the upload.
4. When WordPress processes the uploaded file for thumbnail generation or other modifications, it passes the file to the Imagick library.
5. Imagick, in turn, inspects the file's content (not its extension), recognizes the PostScript code, and hands it off to the underlying Ghostscript interpreter for execution.
6. Ghostscript executes the malicious code, resulting in RCE on the server in the context of the web server user.

This attack is only possible on servers where the Imagick PHP extension is installed and enabled.

Affected Systems

• WordPress versions prior to 7.0.4.
• Patches have been backported, so all versions from 4.7 to 7.0.3 are vulnerable.
• The server environment must have the Imagick PHP extension and Ghostscript installed.

This vulnerability poses the greatest risk to multi-author blogs, news sites, and community forums where non-administrator users are permitted to upload media files.

Exploitation Status

As of the disclosure, there are no known active exploits in the wild. However, the vulnerability was responsibly disclosed by researchers at pwn.ai, and now that the details and patch are public, the development of exploit code by malicious actors is highly likely. The low complexity of the exploit, once an attacker has author-level credentials, increases the risk.

Impact Assessment

Successful exploitation of CVE-2026-65640 grants an attacker full remote code execution on the web server. This allows the attacker to:

• Install a web shell for persistent access (T1505.003 - Server Software Component: Web Shell).
• Steal sensitive data from the website's database, including user information and hashed passwords.
• Deface the website.
• Use the compromised server as a pivot point to attack other systems on the internal network.
• Host and distribute malware to site visitors.

Given that WordPress powers over 40% of the web, the potential impact is massive, even though it requires prior authentication.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Vulnerability Scanning: Use a WordPress vulnerability scanner to check if your site is running a vulnerable version and if the patch has been applied.
• File Integrity Monitoring (FIM): Monitor the WordPress core files for any unauthorized changes, which could indicate a web shell has been dropped post-exploitation.
• Log Analysis: Review web server and application logs for suspicious file uploads from low-privilege users. Correlate these uploads with any subsequent unexpected process executions by the web server process, particularly gs (Ghostscript). D3FEND's File Analysis (D3-FA) can be applied to uploaded files.

Remediation Steps

1. Update WordPress: The primary remediation is to update to a patched version of WordPress immediately. WordPress 7.0.4 contains the fix. If you are on an older version, ensure you install the latest security update for your branch (e.g., 6.5.x, 6.4.x, etc.). This is an application of D3FEND's Software Update (D3-SU).
2. Verify Update: After updating, confirm that the new version is active in your WordPress dashboard.
3. Temporary Mitigation: If you cannot update immediately, disabling the Imagick PHP extension in your server's php.ini file will prevent the vulnerability from being triggered. This is a form of D3FEND's Application Configuration Hardening (D3-ACH). However, this may break functionality on your site that relies on server-side image processing.
4. Review User Permissions: Audit user accounts and enforce the principle of least privilege. Do not grant users the upload_files capability unless it is absolutely necessary for their role.