WordPress 7.0.4 Fixes an 8.8-Severity Remote Code Execution Flaw
There is a new WordPress security update worth paying attention to, particularly if your site has multiple people who can upload files.
WordPress 7.0.4 fixes CVE-2026-65640, a remote code execution vulnerability rated 8.8 out of 10. The scary version of the headline is that an attacker can execute code on a WordPress server. The useful version includes the prerequisites, because this is not a case where any anonymous visitor can simply take over every WordPress site on the internet.
According to the WordPress security advisory, a vulnerable server must be using both Imagick and Ghostscript, and the attacker must already have the upload_files capability—typically an Author-level WordPress account or something with equivalent permissions. The attack works by uploading a specially crafted file that WordPress treats as an image while ImageMagick recognizes embedded PostScript and hands it to Ghostscript for processing. That PostScript can then be executed on the server.
That distinction matters. A small brochure site with one trusted administrator has a very different risk profile from a publication with a dozen authors, a membership site, a community site, or a client system where outside users are allowed to upload media. But “requires a logged-in user” should not be confused with “not serious.” Compromised contributor credentials are hardly exotic, and an account with limited publishing privileges is not supposed to become a path to running arbitrary commands on the server.
The advisory lists WordPress 7.0.0 through 7.0.3 as affected, along with vulnerable releases on every supported older branch back to WordPress 4.7. The fix is in 7.0.4, and WordPress has backported the security change to patched releases on those older branches.
For site owners, the practical answer is pleasantly boring: update WordPress core to the current patched version for your branch. If you maintain a multi-author or membership site, move this higher on the list. It is also worth reviewing which accounts actually need file-upload privileges. Permissions have a habit of accumulating over the years, especially on older business websites.
This is exactly why vulnerability headlines need context. “Remote code execution in WordPress” sounds like the entire web is on fire. It isn’t. But the sites that meet the prerequisites have a legitimate problem, and there is already a fix. At that point, delaying the update is mostly volunteering for additional risk.