WordPress 7.0.3 – Critical RCE Vulnerability (CVE-2026-65640) Fixed in 7.0.4

WordPress 7.0.4 is a release where the number of fixes doesn't matter — the severity does. It patches exactly one vulnerability in version 7.0.3 (and earlier releases), but it's from the highest threat category: remote code execution (RCE). For comparison, the previous update (7.0.3) fixed nine medium- and high-risk flaws — here, one is enough to hand over full control of the server.

What exactly does WordPress 7.0.4 fix?

According to the WPScan database and the official WordPress.org security advisory, the release fixes:

• Author+ Remote Code Execution via malicious file upload (Imagick + Ghostscript) (CVE-2026-65640, GHSA-8vr3-7mxf-gx8w) — a logged-in user with the Author role or higher can upload a specially crafted file that, when processed by the Imagick library and Ghostscript, leads to remote code execution on the server. It only affects sites where that combination (Imagick + Ghostscript) is active — typically used for generating image thumbnails, PDF previews in the media library, or PDF invoices.

The vulnerability was reported by the pwn.ai team through responsible disclosure. The fix didn't just land in WordPress 7.0.4 — it was also backported to the older 4.7 branch and to the 7.1 RC3 release, even though WordPress officially only actively supports the latest version. That's a good sign of how seriously the WordPress security team treated this flaw. You'll find the full, up-to-date entry in our WordPress vulnerability (CVE) database and directly in the WPScan entry.

Why one vulnerability is still a critical problem

This flaw requires being logged in as an Author (or higher), so at first glance it looks less dangerous than an unauthenticated flaw. In practice that's a false sense of security. The Author role is commonly handed out to freelancers, content marketing agencies, guest writers, or marketing staff — people outside the small circle of site administrators. If one of those accounts is compromised through a leaked password, phishing, or plain credential reuse, the attacker doesn't just get panel access — they get full remote code execution on the server, which in practice is worse than most of the XSS or SSRF flaws that made up the previous update.

Another risk factor: the CVE and GHSA entry are already public with a technical description of the attack mechanism. This class of bug — Ghostscript being abused during file processing by ImageMagick/Imagick — has a long history in the industry (informally known as "ImageTragick") and tends to get working exploit code within days of the patch being published.

How to check if your site is affected

Check your WordPress version in Dashboard → Updates. WPScan doesn't specify exactly which version introduced the bug (the fix was also backported to the very old 4.7 branch), so it's safer to assume it affects every release up through 7.0.3. The second condition is active use of Imagick together with Ghostscript — a common combination for generating image thumbnails, PDF previews in the media library, or PDF invoices on WooCommerce stores. If you're not sure whether your site uses this combination, treat it as affected until you update. You can also look up any WordPress core version in our public CVE database, no account required.

If you monitor your site with MonitorWWW.com, your WordPress core version is checked automatically against the same vulnerability database — you get an alert whenever the installed version has a known, unpatched flaw, even when — like here — it's a single, less obvious vulnerability rather than a long list. We covered how this works in more detail in Critical WordPress Vulnerabilities (CVE) — New in Monitoring.

How to update safely

• Take a full backup of your files and database before updating.
• If you have a staging environment, update there first and confirm file uploads, thumbnails, and PDF previews still work correctly.
• Update WordPress to version 7.0.4 (Dashboard → Updates → Update Now, or automatically if you have background updates enabled).
• If you can't update right away for some reason, temporarily restrict file uploads for Author-level accounts, or disable PDF/PostScript processing in your server's ImageMagick policy (policy.xml) — a standard, general hardening step independent of this specific patch.
• After updating, check key site functions — login, file uploads and previews, and for stores: PDF invoice generation.

Summary

One vulnerability in WordPress 7.0.3 is far fewer than the nine in the previous update — but the threat category (RCE instead of XSS/SSRF) makes this patch more urgent, not less important. The number of flaws in a security advisory is a poor proxy for real risk; what matters is what the flaw actually lets an attacker do. That's why automatically checking your installed version against the CVE database still makes sense even when an update looks "minor" — like this one did.