CVE-2026-65640: WordPress RCE Vulnerability via Postscript

CVE-2026-65640 Overview

CVE-2026-65640 is a remote code execution (RCE) vulnerability in WordPress that allows authenticated users with upload_files capability (Author role or higher) to execute arbitrary code on the server. The flaw requires the server to have both Imagick and Ghostscript installed. An attacker uploads a malicious PostScript file, which Ghostscript processes during image handling, leading to code execution in the WordPress runtime context. The vulnerability affects all versions of WordPress. Version 7.0.4 contains the fix, and the patch has been backported to all release branches down to 4.7. The issue is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated Author-level users can achieve remote code execution on WordPress servers running Imagick with Ghostscript, resulting in full compromise of the site and underlying host.

Affected Products

WordPress core, all versions prior to 7.0.4
WordPress installations with Imagick PHP extension enabled
WordPress installations with Ghostscript available on the host

Discovery Timeline

2026-08-17 - CVE-2026-65640 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65640

Vulnerability Analysis

The vulnerability sits at the intersection of WordPress media handling, the Imagick PHP extension, and Ghostscript. When a user uploads an image, WordPress delegates processing to Imagick if the extension is available. Imagick, in turn, invokes Ghostscript to render PostScript (.ps) and Encapsulated PostScript (.eps) documents. PostScript is a Turing-complete language, and Ghostscript exposes operators that can interact with the underlying operating system when its -dSAFER protections are bypassed or misconfigured.

An Author-level user can upload a crafted PostScript file through the WordPress media library. Once WordPress hands the file to Imagick for thumbnail generation or format conversion, Ghostscript parses the attacker-controlled content and executes embedded operators. The resulting code runs with the privileges of the PHP process, typically www-data or the web server user.

Root Cause

The root cause is insufficient validation of uploaded file content combined with unsafe invocation of Ghostscript through Imagick. WordPress accepts files that pass MIME and extension checks but does not inspect PostScript payloads for dangerous operators before handing them to downstream image libraries. This is a classic [CWE-434] unrestricted file upload issue that becomes an RCE due to the trust boundary between WordPress and Ghostscript.

Attack Vector

Exploitation requires authenticated access with the upload_files capability. The attacker crafts a PostScript file containing operators that trigger command execution when parsed by Ghostscript. The file is uploaded through the standard media upload endpoint (/wp-admin/media-new.php or the REST API /wp/v2/media). WordPress accepts the upload, Imagick attempts to generate previews, Ghostscript processes the PostScript content, and the embedded payload executes on the host.

No verified public exploit code has been published at the time of writing. See the WordPress 7.0.4 Release Announcement for the vendor's technical description.

Detection Methods for CVE-2026-65640

Indicators of Compromise

Uploads of files with .ps, .eps, or PostScript MIME types (application/postscript) to the WordPress wp-content/uploads/ directory
Ghostscript (gs) child processes spawned from the PHP-FPM or web server process during media uploads
Outbound network connections initiated by PHP or Ghostscript processes shortly after a media upload event
New or modified PHP files in wp-content/ directories following an upload by an Author-level account

Detection Strategies

Monitor WordPress access logs for POST requests to /wp-admin/async-upload.php and /wp-json/wp/v2/media from Author-level accounts, correlated with unusual file extensions.
Audit process lineage on the web host for gs or ghostscript invocations spawned by PHP, especially with unexpected command-line arguments.
Alert on shell utilities (sh, bash, curl, wget, python) launched as children of Ghostscript or the web server process.
Review WordPress user activity logs for privilege changes or new Author-level account creation prior to media uploads.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/, wp-content/plugins/, and wp-content/themes/ to detect unauthorized PHP file creation.
Forward web server, PHP, and process telemetry to a centralized data lake for correlation across upload events and subsequent process activity.
Track Ghostscript invocations and their arguments for use of -dNOSAFER, -sOutputFile=%pipe%, or references to %stdout and %stderr device redirection.
Baseline normal media upload behavior per user role and alert on deviations, such as PostScript uploads from accounts that historically upload only images.

How to Mitigate CVE-2026-65640

Immediate Actions Required

Update WordPress to version 7.0.4 or apply the backported patch appropriate for your current branch (patches exist back to 4.7).
Audit all Author-level and higher accounts, remove unused accounts, and enforce multi-factor authentication for privileged roles.
Review recent uploads for PostScript or EPS files and inspect the server for signs of compromise, including webshells and modified core files.
Restrict upload_files capability to trusted users only, and consider disabling the Author role's upload rights temporarily if patching is delayed.

Patch Information

WordPress 7.0.4 contains the fix and is available through the standard update channels. The vendor backported the patch to every supported branch down to 4.7. See the WordPress 7.0.4 Release Announcement for release notes and download details. Managed WordPress hosts should confirm their provider has applied the backported patch.

Workarounds

Disable the Imagick PHP extension where possible and rely on GD for image processing, which does not invoke Ghostscript.
Configure ImageMagick's policy.xml to deny the PS, EPS, PDF, and XPS coders until patching is complete.
Remove or restrict Ghostscript on the server if it is not required by other applications.
Add a web application firewall rule to block uploads containing PostScript MIME types or .ps/.eps extensions to WordPress media endpoints.

bash

# ImageMagick policy.xml mitigation - deny PostScript-related coders
# File location: /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml
<policymap>
  <policy domain="coder" rights="none" pattern="PS" />
  <policy domain="coder" rights="none" pattern="PS2" />
  <policy domain="coder" rights="none" pattern="PS3" />
  <policy domain="coder" rights="none" pattern="EPS" />
  <policy domain="coder" rights="none" pattern="PDF" />
  <policy domain="coder" rights="none" pattern="XPS" />
</policymap>