WordPress Patches Author-Level RCE via Malicious Image Uploads

WordPress has released version 7.0.4 (backported through all supported releases down to 4.7) to fix a critical security vulnerability tracked as CVE-2026-65640 (CVSS 8.8). The flaw allowed any authenticated user with file-upload privileges—such as the default Author role—to achieve remote code execution on vulnerable host environments.

The vulnerability stems from a validation mismatch between WordPress and underlying server image processors:

• The mismatch: WordPress core previously validated file types using file extensions, while the PHP Imagick extension inspected actual file content.
• The exploit chain: An attacker with an Author role could upload a file with a benign .png extension containing embedded PostScript code. Imagick detected the PostScript payload and delegated rendering to Ghostscript, which executed arbitrary server commands.
• Prerequisites: Exploitation required both the Imagick PHP extension and Ghostscript installed on the host, paired with an account holding the upload_files capability.
• The patch: WordPress 7.0.4 updates wp-includes/class-wp-image-editor-imagick.php to inspect the first 1,445 bytes for true magic-byte signatures, strip deceptive format prefixes, and reject polyglot PostScript payloads before processing.

The StackCompass framing: This vulnerability highlights two structural truths about complex dynamic CMS hosting. First, user role hygiene matters—guest writers and freelancers should default to Contributor status (which lacks upload rights) rather than Author. Second, every runtime dependency (like ImageMagick and Ghostscript) expands the host attack surface. On static builds or edge-hosted static frontends, that server-side execution pipeline simply does not exist.

Source: DEV Community