AIKIDO-2026-48933

roots/wordpress is vulnerable to Remote Code Execution (RCE)

Remote Code Execution (RCE)CVE-2026-65640 Published 4 days ago

High Risk

This Affects:

roots/wordpress

4.7 - 5.2.25

Fixed in 5.2.26

5.3 - 5.3.22

Fixed in 5.3.23

5.4 - 5.4.20

Fixed in 5.4.21

5.5 - 5.5.19

Fixed in 5.5.20

5.6 - 5.6.18

Fixed in 5.6.19

5.7 - 5.7.16

Fixed in 5.7.17

5.8 - 5.8.14

Fixed in 5.8.15

5.9 - 5.9.15

Fixed in 5.9.16

6.0 - 6.0.13

Fixed in 6.0.14

6.1 - 6.1.11

Fixed in 6.1.12

6.2 - 6.2.10

Fixed in 6.2.11

6.3 - 6.3.9

Fixed in 6.3.10

6.4 - 6.4.9

Fixed in 6.4.10

6.5 - 6.5.9

Fixed in 6.5.10

6.6 - 6.6.6

Fixed in 6.6.7

6.7 - 6.7.6

Fixed in 6.7.7

6.8 - 6.8.7

Fixed in 6.8.8

6.9 - 6.9.6

Fixed in 6.9.7

7.0 - 7.0.3

Fixed in 7.0.4

Are you affected? Scan for Free

TL;DR

Media image handling can load an uploaded PostScript file into Imagick, which shells out to Ghostscript. On hosts where Imagick and Ghostscript are available, a user with the upload_files capability can upload a crafted PostScript file that triggers remote code execution through Ghostscript's handling of embedded content. The fix refuses to load images into Imagick when the content may be PostScript.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range, Imagick and Ghostscript are available on the server, and a user with the upload_files capability (Author or higher) can upload media.

Background info

roots/wordpress is vulnerable to Remote Code Execution (RCE) in versions 7.0 - 7.0.3, 6.9 - 6.9.6, 6.8 - 6.8.7, 6.7 - 6.7.6, 6.6 - 6.6.6, 6.5 - 6.5.9, 6.4 - 6.4.9, 6.3 - 6.3.9, 6.2 - 6.2.10, 6.1 - 6.1.11, 6.0 - 6.0.13, 5.9 - 5.9.15, 5.8 - 5.8.14, 5.7 - 5.7.16, 5.6 - 5.6.18, 5.5 - 5.5.19, 5.4 - 5.4.20, 5.3 - 5.3.22 and 4.7 - 5.2.25.