WordPress has fixed a flaw that let anyone able to upload a file to a site run code on the server underneath it. CVE-2026-65640 carries a CVSS score of 8.8, and the account it needs is only Author level, which on a site with more than one writer is not a high bar.
The trick is to put one file format inside another. WordPress passes uploaded images to ImageMagick, through the Imagick PHP extension, to resize and convert them, and ImageMagick does not take a file extension at its word. It reads the bytes to work out what it is actually holding. So a file uploaded as an ordinary .png whose contents are really PostScript, the page description language that sits behind PDF, gets recognised as PostScript and handed on to Ghostscript, which interprets it. Ghostscript interpreting instructions an attacker wrote is code execution on the host.
Who this actually reaches
Not every install. The flaw needs an account with upload rights at Author level or above, and a server where Imagick and Ghostscript are both in place. That puts the risk on sites that hand those accounts out freely: multi author publications, membership platforms, installations an agency runs on a client's behalf, and anything that lets people register and then upload. A single blog with one administrator is a far smaller target, because there is nobody to give the upload to. The flip side is that on a site with fifty contributors, one phished login is enough.
Update to 7.0.4, or take the backport
The WordPress security team fixed it in 7.0.4 and backported the change through the older branches as far down as 4.7, so there is a patched release for almost any install still receiving updates. The change is to the load() function, which now checks a file's contents before passing it to Imagick instead of trusting what arrives. Installations that take automatic minor updates should receive it without anyone doing anything; anything deliberately pinned to a version needs looking at by hand. WordPress's own release note carries the full version list and the technical detail.
We picked this up from Peru's National Digital Security Centre, which summarised the flaw in its integrated alert 150-2026, but the research and the fix are WordPress's own. It lands in a heavy stretch for the platform: Wordfence counted 249 WordPress flaws in a single week earlier this month, and core itself took an unauthenticated REST API code execution bug in July. Nearly all of that volume is plugins. This one is core, which means the fix reaches everyone at once, and so did the exposure.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.