CVE-2026-65640 File upload in WordPress
An attacker with upload privileges can achieve remote code execution by uploading a malicious Postscript file if Imagick and Ghostscript are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65640?
CVE-2026-65640 is a high-severity vulnerability in WordPress, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability
This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Weakness: CWE-434
Which versions are affected by CVE-2026-65640?
2 open source packages ship an affected version, including wordpress and wordpress-multisite.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | All versions | 7.0.4 |
wordpress-multisite Bitnami | All versions | 7.0.4 |
How do I fix CVE-2026-65640?
Upgrade wordpress to 7.0.4 or later.
Is CVE-2026-65640 being exploited?
There is no known exploitation of CVE-2026-65640 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BIT-wordpress-2026-65640, BIT-wordpress-multisite-2026-65640, DEBIAN-CVE-2026-65640, MINI-vc9w-9j3w-97hh, UBUNTU-CVE-2026-65640.