WordPress patched a high-severity vulnerability this week that let an attacker with nothing more than Author-level access upload what looks like an ordinary image and use it to run code on the server. That’s a genuinely low bar for exploitation, which is exactly what makes this one worth paying attention to.
The flaw, tracked as CVE-2026-65640 and rated 8.8 on the CVSS scale, comes down to a mismatch in how two different systems handle the same uploaded file. WordPress checks a file’s extension to decide what it’s dealing with. ImageMagick, through the Imagick extension, actually looks at the file’s contents instead. That gap is where the problem lives.
Here’s how it plays out in practice, according to security firm Patchstack. An attacker uploads a PNG that isn’t really a PNG at all. It’s PostScript code disguised with an image extension. WordPress sees the .png and treats it accordingly, but ImageMagick inspects the actual content, spots PostScript hiding inside, and hands it off to Ghostscript to render. Ghostscript then executes it as a program rather than displaying it as an image. WordPress does run a content-checking function meant to catch exactly this kind of thing, but Patchstack notes that not every upload path actually triggers that check, which is what leaves the door open.
The fix, shipped in WordPress 7.0.4, changes how the load() function handles files, making sure it inspects content before passing anything to Imagick. That closes off the PostScript execution path and also stops attackers from using filename tricks to fool Imagick into invoking Ghostscript in the first place. WordPress backported the patch all the way to version 4.7, covering a genuinely wide range of older installations still in active use.
Patchstack’s warning deserves attention if your site fits a certain profile. Multi-author blogs, membership sites, client sites with outside contributors, anywhere administrators run registration loose or hand out contributor access without much scrutiny, this is not a theoretical risk. An Author account uploading a booby-trapped image is a realistic attack path, not a hypothetical one, and it only requires exactly the kind of access level a lot of sites hand out routinely.
