Menu
A A A
A A A

WordPress Remote Code Execution Vulnerability (CVE-2026-65640)

A high-severity vulnerability, identified as CVE-2026-65640, has been identified in WordPress Core. The vulnerability allows an authenticated attacker with Author-level privileges or higher, or an account possessing the upload_files capability, to execute arbitrary code on an affected WordPress server by uploading a malicious PostScript file. Successful exploitation could result in full compromise of the affected website, including unauthorized access to sensitive information, modification of website content, malware installation, and service disruption.

WordPress has released security updates to address the vulnerability. System owners are strongly recommended to verify their installed WordPress version and update to the latest version immediately.

 

Vulnerability

  • WordPress Remote Code Execution Vulnerability (CVE-2026-65640)
    • Affects installations using Imagick and Ghostscript.

Severity Level

  • High

 

Affected Versions

WordPress Core Branch Affected Versions Remediation Required
7.0 7.0.0 – 7.0.3 Update to 7.0.4
6.9 6.9.0 – 6.9.6 Update to 6.9.7
6.8 6.8.0 – 6.8.7 Update to 6.8.8
6.7 6.7.0 – 6.7.6 Update to 6.7.7
6.6 6.6.0 – 6.6.6 Update to 6.6.7
6.5 6.5.0 – 6.5.9 Update to 6.5.10
6.4 6.4.0 – 6.4.9 Update to 6.4.10
6.3 6.3.0 – 6.3.9 Update to 6.3.10
6.2 6.2.0 – 6.2.10 Update to 6.2.11
6.1 6.1.0 – 6.1.11 Update to 6.1.12
6.0 6.0.0 – 6.0.13 Update to 6.0.14
5.9 5.9.0 – 5.9.15 Update to 5.9.16
5.8 5.8.0 – 5.8.14 Update to 5.8.15
5.7 5.7.0 – 5.7.16 Update to 5.7.17
5.6 5.6.0 – 5.6.18 Update to 5.6.19
5.5 5.5.0 – 5.5.19 Update to 5.5.20
5.4 5.4.0 – 5.4.20 Update to 5.4.21
5.3 5.3.0 – 5.3.22 Update to 5.3.23
5.2 5.2.0 – 5.2.25 Update to 5.2.26
5.1 5.1.0 – 5.1.23 Update to 5.1.24
5.0 5.0.0 – 5.0.26 Update to 5.0.27
4.9 4.9.0 – 4.9.30 Update to 4.9.31
4.8 4.8.0 – 4.8.29 Update to 4.8.30
4.7 4.7.0 – 4.7.34 Update to 4.7.35

Remediation

  • Update WordPress Core immediately:
    • Upgrade affected installations to the corresponding patched version listed above. Whenever feasible, upgrade to the latest WordPress release, version 7.0.4 or later.
  • Verify automatic updates:
    • System owners should verify the currently installed version instead of assuming that the update has been completed successfully.
  • Review Imagick and Ghostscript usage:
    • Confirm whether Imagick and Ghostscript are installed and used by the WordPress server.
    • If these components are not operationally required, consider disabling or restricting them until the WordPress update has been applied.
  • Perform a post-update security review:
    • Review web server access logs, WordPress administrator accounts, recently installed plugins and themes, modified files, scheduled tasks, and unexpected database changes for signs of compromise.
  • Back up the website before updating:
    • Create a verified backup of the WordPress files and database, then confirm that the website and its plugins continue to operate normally after the update.

 

Reference

 

 

 

Published on: 13 August 2026

 

 

Facebook Instagram Telegram CUHK Green Office Programme
The Racial Diversity and Inclusion Charter for Employers 2024-2025 Web Accessibility Recognition Scheme - Gold Award
© 2026 All Rights Reserved. The Chinese University of Hong Kong.