Just a week after the important security release of version 7.0.3, WordPress has launched another critical update, version 7.0.4 on August 12, 2026. Like the previous one, this is a dedicated security release. The WordPress team strongly recommends that you update your sites immediately.
The Vulnerability: CVE-2026-65640
The fix in WordPress 7.0.4 is for a single, but very serious, security vulnerability. The security team at pwn.ai discovered and responsibly reported this issue, allowing the WordPress team to fix it before it could cause widespread harm. The issue is officially tracked as CVE-2026-65640 and is rated as “High” severity with a CVSS score of 8.8 out of 10.
Authenticated Remote Code Execution (RCE)
This vulnerability is a type of attack known as Authenticated Remote Code Execution (RCE). In simple terms, this means an attacker with an Author-level account or higher on your website could upload a malicious file that looks harmless, like a PNG image, but is actually something else, like a PostScript file. This is possible on websites that use two specific server tools to process images: Imagick and Ghostscript.
How the Attack Worked
Here is how the problem worked. Image processing tools like ImageMagick decide what a file is by reading what is inside it, not by its file name. However, a part of WordPress called the WP_Image_Editor_Imagick class was only checking the file’s extension (like .png) to decide how to process it. This created a dangerous gap.
The PNG That Wasn’t a PNG
An attacker could upload a file named holiday.png that is actually a PostScript program.WordPress would see the .png extension and pass it to Imagick. Imagick would then read the file’s contents, recognize it’s PostScript, and use Ghostscript to process it.
Because Ghostscript has a history of security issues, this could allow the attacker to run their own malicious code on your server. This is not just a small problem; it could let an attacker take control of your website, access your database, or steal sensitive information.
The Fix: Content Validation Over File Extensions
The good news is that the WordPress team has fixed this problem. The fix updates the image processing code so that it now checks the file’s actual content before passing it to Imagick. This prevents any malicious PostScript files from being processed in the first place.
Update Your WordPress Site Immediately
Updating to WordPress 7.0.4 is simple. You can download it directly from WordPress.org, or you can log in to your website’s admin dashboard and go to Dashboard → Updates and click the “Update Now” button. If your site has automatic background updates enabled, it will begin updating itself shortly.
Protection for Older Versions
The WordPress team has also backported this security fix to all older versions of WordPress that still receive security updates, going all the way back to version 4.7. However, it is always best to run the most recent version of WordPress for the most complete protection.
Stay Secured
Because this is a high-severity issue, it is wise to update your site as soon as you can. Taking a few minutes to update today is a simple and effective way to keep your website and your visitors safe. For more detailed information, you can visit the official WordPress 7.0.4 HelpHub site.
Leave a Reply