Critical WordPress Imagick RCE (CVE-2022-XXXX) Lets Authors Execute Code

Key Takeaways

• A critical remote code execution (RCE) vulnerability (CVE-2026-65640) has been discovered in WordPress.
• The flaw impacts WordPress sites using the Imagick extension and Ghostscript for image processing.
• Authenticated users with Author-level privileges or higher can exploit this vulnerability through malicious file uploads.
• WordPress has released version 7.0.4 to address the issue, and immediate updates are strongly recommended.

WordPress Addresses Critical Imagick RCE Vulnerability

WordPress has rolled out a crucial security update, version 7.0.4, to mitigate a significant remote code execution (RCE) vulnerability. This flaw specifically targets WordPress installations that leverage the Imagick extension in conjunction with Ghostscript for handling image files.

The WordPress security team is strongly advising all site administrators to update their installations without delay. Updates can be applied through the Dashboard’s ‘Updates’ section or by directly downloading the new release from WordPress.org. Sites configured for automatic background updates should already be receiving the necessary patch.

Designated as CVE-2026-65640 and further detailed in GHSA-8vr3-7mxf-gx8w, this vulnerability was responsibly brought to light by researchers at pwn.ai. It enables an authenticated user with Author-level permissions or higher to execute arbitrary code remotely by uploading a specially crafted file.

The root cause of the problem lies in WordPress’s reliance on ImageMagick for resizing and processing images within the Media Library. ImageMagick’s capabilities extend beyond common formats like JPEGs and PNGs; it also supports PostScript, EPS, and PDF files. To render these more complex formats, ImageMagick delegates the task to Ghostscript, a utility with a documented history of being exploited to execute unintended commands.

The Imagick RCE Explained

Cybersecurity experts will recognize this vulnerability as belonging to the same class of bugs that led to the infamous “ImageTragick” exploits several years ago.

The fundamental issue stemmed from a discrepancy in how file types were identified. While ImageMagick correctly determines a file’s nature by examining its actual content, WordPress’s WP_Image_Editor_Imagick::load() method predominantly relied on the file’s extension.

This critical mismatch meant that a file ostensibly named something benign, such as holiday.png, could in fact contain malicious PostScript code. Such a file could bypass standard upload checks and still be passed to Imagick. ImageMagick would then correctly identify the embedded PostScript and invoke Ghostscript for execution, leading to the RCE.

Ordinarily, WordPress’s wp_check_filetype_and_ext() function is designed to detect these types of discrepancies during typical file uploads. However, not all upload pathways incorporate this crucial content verification step.

Specifically, the wp.uploadFile method within XML-RPC and the routine for extracting cover art from uploaded MP3 files both write file bytes directly using wp_upload_bits(). This particular function bypasses content inspection entirely, providing attackers with an alternative vector to deploy a malicious payload.

The Patch and Mitigation

The fix, implemented in commit 7daaa50, reengineers the load() function. It now mandates that a file’s actual content be thoroughly inspected before any Imagick object is constructed.

The updated function now scans the initial segment of every uploaded file. It actively blocks any files containing PostScript or EPS signatures, as well as fraudulent PDFs that claim the extension but lack the genuine %PDF- header, and compressed archives like gzip or bzip2 that ImageMagick might otherwise silently decompress.

Furthermore, the patch addresses a more subtle exploit technique where attackers could prepend a format specifier, such as EPS:innocent.png, to a filename to force ImageMagick to use a dangerous decoder. The new code now strips and validates these prefixes, meticulously avoiding false positives on Windows drive letters, and applies the same rigorous scrutiny to filenames originating from remote URLs or streams.

Exploitation of this vulnerability requires at least Author-level access, meaning it is not an unauthenticated or “drive-by” attack. However, the practical risk varies significantly depending on the user base of a given site.

Platforms such as multi-author publications, membership sites, and client portals with open or loosely managed contributor access face considerable exposure. Any authenticated Author on such a site could potentially upload a booby-trapped file disguised as an image. Conversely, sites managed by a small, highly trusted editorial team present a comparatively lower risk.

As a courtesy, the fixes are being backported to the 4.7 branch and integrated into the forthcoming 7.1 RC3 release. Nevertheless, only the latest WordPress version receives comprehensive ongoing support. Site administrators are strongly advised to confirm their current WordPress version and update promptly, especially on sites where upload permissions extend beyond a core, trusted group.

This incident underscores a broader security principle for any platform that handles user-uploaded content: the true danger often lies not in the apparent file type, but in the full range of capabilities and file formats that underlying processing libraries are designed to handle.

What You Should Do

• Update Immediately: Upgrade your WordPress installation to version 7.0.4 without delay. If you cannot update to 7.0.4, ensure you apply the backported fixes in the 4.7 branch or 7.1 RC3.
• Verify Automatic Updates: Even if automatic background updates are enabled, confirm that your site has indeed received and applied the 7.0.4 patch.
• Review User Permissions: Audit users with Author-level access or higher on your site. Restrict upload privileges to only trusted individuals.
• Monitor for Suspicious Activity: Keep an eye on your server logs for any unusual file uploads or unexpected process executions, particularly from user accounts with media upload capabilities.
• Educate Contributors: If you operate a multi-author site, educate your contributors about the risks of uploading untrusted files and the importance of using legitimate image formats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.