Loading story…
WordPress released 7.0.4 as an emergency security update to fix an authenticated remote code execution flaw affecting sites that use Imagick with Ghostscript for media processing. The vulnerability, tracked as CVE-2026-65640 and GHSA-8vr3-7mxf-gx8w, allows users with Author-level or higher privileges to upload a crafted file and trigger code execution during image handling, prompting WordPress to urge site owners to update immediately.
Reports indicate the bug stemmed from a mismatch between WordPress file-type validation and how ImageMagick identifies content, allowing disguised PostScript, EPS, or malformed PDF/polyglot payloads to be processed as seemingly benign images such as PNG files. WordPress said the issue was responsibly reported by pwn.ai and patched by tightening inspection in WP_Image_Editor_Imagick::load(), blocking dangerous signatures and validating filenames and format prefixes; the fix is also being backported to the 4.7 branch and included in 7.1 RC3.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A new CVE record was received for CVE-2026-65640, formally describing the WordPress authenticated remote code execution flaw involving malicious PostScript uploads processed through Imagick and Ghostscript. The entry lists affected versions earlier than 7.0.4 and includes CVSS v3 scoring and CWE-434 classification.
CSIRT Panamá published an alert on CVE-2026-65640, warning that the authenticated WordPress Imagick/Ghostscript RCE flaw was being actively exploited in the wild. The advisory identified affected versions as WordPress 4.7.0 through 7.0.3 and urged immediate upgrades to 7.0.4 or later.
Alongside the 7.0.4 release, WordPress said the security fixes were being backported through the 4.7 branch and into the 7.1 RC3 release. This extended the remediation beyond the main current release line.
WordPress released version 7.0.4 as a security update to fix the authenticated Author+ remote code execution issue involving crafted uploads processed by Imagick and Ghostscript. WordPress advised administrators to update immediately, and the fix includes changes to file inspection logic in WP_Image_Editor_Imagick::load().
Researchers at pwn.ai responsibly reported an authenticated remote code execution vulnerability in WordPress affecting Author+ users via malicious file uploads on sites using Imagick and Ghostscript. The flaw is tracked as CVE-2026-65640 and GHSA-8vr3-7mxf-gx8w.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcesecurityweek.com
Open sourcethecybersecguru.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecert.pa
Open sourcewordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
WordPress has released **7.0.3** as a security update to fix multiple vulnerabilities, led by a high-severity pre-authentication reflected XSS flaw in the login screen tracked as **`CVE-2026-64638`** and **`GHSA-52p2-r8wf-jcrf`**. The issue affects all WordPress versions and is being backported through the supported **4.7** security branch, while **7.1 RC2** also includes the fixes. WordPress said site owners should update immediately; versions older than 4.7 remain affected and are outside the current backport range.
Aug 19, 2026