CVE-2026-65640: Malicious File Upload
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability
This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpressto a version that resolves this vulnerability.Fixed in 7.0.4 - Upgrade
Upgrade
wordpressto a version that resolves this vulnerability.Fixed in 4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65640?
The severity of CVE-2026-65640 is rated as high with a score of 8.8.
How do I fix CVE-2026-65640?
To fix CVE-2026-65640, update WordPress to the latest version to mitigate the remote code execution vulnerability.
Who is affected by CVE-2026-65640?
CVE-2026-65640 affects all versions of WordPress and requires an author level user or higher to exploit.
What are the prerequisites for exploiting CVE-2026-65640?
Exploitation of CVE-2026-65640 requires the use of Imagick and Ghostscript on the server and a user with 'upload_files' capability.
What type of vulnerability is CVE-2026-65640?
CVE-2026-65640 is classified as a Malicious File Upload vulnerability that allows remote code execution.