Every CVE Search/ Get API key

CVE-2026-65640

8.8 HighPublic exploitFix available

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.94%Up 1.1 points since Aug 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
CVE-2026-65640
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
EUVDEUVD-2026-60462 8.8

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
EUVD-2026-60462
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 8.8

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
CVE-2026-65640
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
OSVDEBIAN-CVE-2026-65640 8.8

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the upload_files capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
DEBIAN-CVE-2026-65640
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-65640 8.8

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the upload_files capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
UBUNTU-CVE-2026-65640
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-wordpress-2026-65640 No score

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
BIT-wordpress-2026-65640
Updated
2026-11-02
OSVBIT-wordpress-multisite-2026-65640 No score

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

Record
BIT-wordpress-multisite-2026-65640
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wordpress
Bitnami
 before 7.0.4
7.0.4
wordpress-multisite
Bitnami
 before 7.0.4
7.0.4
wordpress
Debian:12
 All versions, plus listed versions
6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1
Show 25 moreShow less
6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-1
 None known
wordpress
Debian:13
 before 6.8.10+dfsg1-0+deb13u1, plus listed versions
6.8.1+dfsg1-16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u16.8.7+dfsg1-0+deb13u1
6.8.10+dfsg1-0+deb13u1
wordpress
Debian:14
 before 7.1+dfsg1-1, plus listed versions
6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-1
7.1+dfsg1-1
wordpress
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1
 None known
wordpress
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1
 None known
wordpress
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1
 None known
wordpress
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1
 None known
wordpress
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.2+dfsg1-1ubuntu16.4.3+dfsg1-1ubuntu1
 None known
wordpress
Ubuntu:26.10
 All versions, plus listed versions
6.7.2+dfsg1-1.1ubuntu2
 None known
wordpress
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.7.2+dfsg1-1.1ubuntu16.7.2+dfsg1-1.1ubuntu2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubjobusa755-a11y/CVE-2026-65640-2026-08-13

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-65640 is a high vulnerability (CVSS 8.8) in Wordpress, published August 17, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.94%, the 80th percentile. Fixed in wordpress 7.0.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open