How do I check whether I am affected by CVE-2026-65640?

Check the WordPress version (Dashboard > Updates, or wp core version) against the affected ranges. Then check exposure: php -m | grep -i imagick and gs --version (or which gs). Also check who has Author or higher roles (wp user list --role=author). Sites without both Imagick and Ghostscript, or with no untrusted Author+ users, are not exploitable via this path.

What is the fix for CVE-2026-65640?

Update to WordPress 7.0.4 (or the patched release for your branch: 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, 5.0.27, 4.9.31, 4.8.30, 4.7.35). Auto-updates apply it on sites that have them enabled.

Who is not affected by CVE-2026-65640?

Not affected if: auth-required, managed-hosting, no-ghostscript, no-imagick.

Live › vulnerability › CVE-2026-65640

Go to dashboard

high8.8Other

WordPress: malicious PostScript upload by an Author gives remote code execution

WordPress core (4.7 through 7.0.3) lets a user with Author role or higher upload a crafted PostScript file disguised by extension. On servers with Imagick and Ghostscript, Ghostscript runs it and the attacker gets code execution on the host. Fixed in 7.0.4 and backports to every branch back to 4.7.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Aug 17, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 17:33 UTC, 1h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs system commands on the WordPress host server.
CVSS said: 8.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-65640

Go to dashboard

high8.8Other

WordPress: malicious PostScript upload by an Author gives remote code execution

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Aug 17, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 17:33 UTC, 1h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs system commands on the WordPress host server.
CVSS said: 8.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...3590a4ad	N/A	Wordpress - Remote Code Execution - CVE:CVE-2026-65640	Block	N/A	Rule metadata description refined. Detection unchanged.
Cloudflare Free Ruleset	...cfe1a93c	N/A	Wordpress - Remote Code Execution - CVE:CVE-2026-65640	Block	N/A	Rule metadata description refined. Detection unchanged.

WordPress: malicious PostScript upload by an Author gives remote code execution

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

WordPress: malicious PostScript upload by an Author gives remote code execution

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Changelog

WAF Release - 2026-08-17

Sources