CVE-2026-65640 WordPress CVE debrief

Who should care

Administrators of WordPress installations, security teams, and users with the `upload_files` capability in WordPress should be aware of this vulnerability and take necessary actions to mitigate it. This includes assessing the use of Imagick and Ghostscript, verifying user capabilities, and updating WordPress to the latest version. The high CVSS score of 8.8 emphasizes the importance of prompt action to protect against potential exploitation. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and monitor relevant logs for exposed assets that need extra review. Asset inventory management should also be considered to ensure that all affected systems are accounted for and prioritized for remediation based on their operational impact and exposure level. Rolling back change windows and tracking exceptions can further enhance the remediation process, ensuring that all necessary steps are taken to mitigate the vulnerability effectively. Source tracking should be implemented to verify the effectiveness of the remediation efforts and to detect any potential future exploitation attempts. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their WordPress installations from potential attacks. It is also essential to review the official CVE Program record and NIST NVD detail page for further information and guidance on mitigating this vulnerability. Furthermore, defenders should verify the presence of Imagick and Ghostscript, assess user capabilities, and implement monitoring and detection measures to identify potential exploitation attempts. By prioritizing these actions, organizations can effectively manage the risk posed by this vulnerability and maintain the security of their WordPress installations. The CVE record was published on 2026-08-17T21:16:46.470Z and has not been modified since then, emphasizing the need for immediate attention to this vulnerability. The official CVE Program record and NIST NVD detail page provide additional context and guidance for mitigating this vulnerability. To ensure comprehensive protection, it is crucial to

Technical summary

The vulnerability in WordPress allows for remote code execution through the upload of malicious Postscript files by users with the `upload_files` capability, which includes Author level users and higher. This exploit requires the presence of Imagick and Ghostscript on the server. The vulnerability impacts all versions of WordPress, and a patch has been implemented in version 7.0.4, with backports to versions as old as 4.7. To defend against this vulnerability, it is crucial to assess if Imagick and Ghostscript are in use, verify user capabilities, update WordPress, and consider additional security measures such as monitoring for suspicious file uploads.

Defensive priority

Administrators of WordPress installations should prioritize assessment and remediation due to the high CVSS score of 8.8 and the potential for remote code execution.

Recommended defensive actions

• Assess if Imagick and Ghostscript are in use on the server
• Verify that users with the `upload_files` capability are Author level or higher
• Update WordPress to version 7.0.4 or later
• Consider implementing compensating controls such as monitoring for suspicious file uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE is based on a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher in WordPress. The vulnerability requires Imagick and Ghostscript to be in use on the server and a malicious user with the `upload_files` capability. The issue affects all versions of WordPress, and a fix has been released in version 7.0.4, backported to all branches back to 4.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.