WordPress 7.0.4 Fixes Authenticated Remote Code Execution Through File Uploads

Sites running affected WordPress releases can be exposed to authenticated remote code execution when malicious PostScript uploads are processed on servers using Imagick and Ghostscript. WordPress 7.0.4, released on 12 August 2026, fixes CVE-2026-65640, which carries a High severity rating and a CVSS score of 8.8. The security advisory says exploitation requires a malicious user with the upload_files capability and identifies Ghostscript's handling of certain embedded files as the underlying weakness.

The advisory lists affected WordPress branches from 7.0 back through 4.7 and patched releases for each of those branches, including 7.0.4 and 4.7.35. WordPress recommended that sites update immediately and said the fix was being backported to older branches as a courtesy, while noting that only the most recent WordPress version is actively supported. The vulnerability was discovered and responsibly disclosed by the pwn.ai team.

The advisory does not identify Drupal as affected, but the conditions have broader relevance for Drupal teams whose media or document workflows rely on external processing software. The case illustrates how file-upload permissions can interact with vulnerabilities in server-side utilities beyond the CMS itself. For Drupal operators using comparable processing stacks, those external components remain part of the system that must be considered during security review and patch management.