{"id":"CVE-2026-65640","kind":"vulnerability","aliases":["CVE-2026-65640"],"related":[],"title":"WordPress: malicious PostScript upload by an Author gives remote code execution","description":"WAF Release - 2026-08-17 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 17, 2026\n\n## WAF Release - 2026-08-17\n\nThis release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.\n\nKey Findings\n\n- CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.\n\nImpact\n\nThe WordPress changes update rule metadata only; detection behavior and actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |","summary":"WordPress core (4.7 through 7.0.3) lets a user with Author role or higher upload a crafted PostScript file disguised by extension. On servers with Imagick and Ghostscript, Ghostscript runs it and the attacker gets code execution on the host. Fixed in 7.0.4 and backports to every branch back to 4.7.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wordpress","fixed":["7.0.4","6.9.7","6.8.8","6.7.7","6.6.7","6.5.10","6.4.10","6.3.10","6.2.11","6.1.12","6.0.14","5.9.16","5.8.15","5.7.17","5.6.19","5.5.20","5.4.21","5.3.23","5.2.26","5.1.24","5.0.27","4.9.31","4.8.30","4.7.35"],"affected":">= 4.7.0, <= 7.0.3 (per branch, see advisory)","ecosystem":"other"}],"ecosystems":[],"tags":["authenticated","cloudflare","ghostscript","imagick","lab-disclosure","other","rce","self-hosted","wordpress"],"not_affected_if":["auth-required","managed-hosting","no-ghostscript","no-imagick"],"how_to_check":"Check the WordPress version (Dashboard > Updates, or wp core version) against the affected ranges. Then check exposure: php -m | grep -i imagick and gs --version (or which gs). Also check who has Author or higher roles (wp user list --role=author). Sites without both Imagick and Ghostscript, or with no untrusted Author+ users, are not exploitable via this path.","fix":"Update to WordPress 7.0.4 (or the patched release for your branch: 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, 5.0.27, 4.9.31, 4.8.30, 4.7.35). Auto-updates apply it on sites that have them enabled.","status":"open","published_at":"2026-08-17T17:32:54+00:00","first_seen_at":"2026-10-24T17:33:06+00:00","triaged_at":"2026-10-25T05:29:27+00:00","updated_at":"2026-10-25T05:30:57+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T05:29:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress: malicious PostScript upload by an Author gives remote code execution","impact":"high","summary":"A WordPress flaw lets a user with Author access upload a malicious PostScript file that can run system commands on the server, according to the Cloudflare changelog and NVD entry. An attacker could gain unauthorized access or install a backdoor on the host.","category":"other","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker runs system commands on the WordPress host server","analyst_note":"Sources give only a Cloudflare WAF rule note and NVD summary; find the affected WordPress core/plugin versions and patched release at https://nvd.nist.gov/vuln/detail/CVE-2026-65640.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000564,"input_tokens":3779,"output_tokens":373,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only a Cloudflare WAF rule note and NVD summary; find the affected WordPress core/plugin versions and patched release at https://nvd.nist.gov/vuln/detail/CVE-2026-65640.","search":"'-08':85C,101C '-17':86C,102C '-2026':13A,16A,124C,129C,197C,218C '-65640':14A,17A,125C,130C,198C,219C '17':96C '2026':84C,97C,100C '3590a4ad':189C '4.7':34B,81B '7.0.3':36B '7.0.4':73B 'access':153C 'action':171C,182C,184C 'affect':136C 'arbitrari':147C 'attack':64B,144C 'august':95C 'authent':19B 'author':7A,41B 'back':79B 'backdoor':156C 'backport':75B 'behavior':169C 'block':199C,220C 'branch':78B 'cfe1a93c':210C 'chang':163C 'changelog':87C,88C 'cloudflar':20B,94C,114C,118C,186C,207C 'code':10A,66B,108C,133C,193C,214C 'command':149C 'comment':185C 'compon':141C 'core':33B,138C 'craft':47B 'cve':12A,15A,123C,128C,195C,196C,216C,217C 'descript':180C,203C,224C 'detect':168C,205C,226C 'disclosur':25B 'disguis':50B 'establish':155C 'everi':77B 'execut':11A,67B,109C,134C,146C,194C,215C 'extens':52B 'file':49B 'find':127C 'fix':71B 'free':119C,208C 'gain':151C 'get':65B 'ghostscript':21B,58B,59B 'give':8A 'higher':44B 'host':30B,70B,158C 'id':176C,179C 'identifi':122C 'imagick':22B,56B 'impact':160C 'improv':92C 'key':126C 'lab':24B 'lab-disclosur':23B 'legaci':177C 'let':37B 'malici':2A 'manag':115C,187C 'metadata':111C,166C,202C,223C 'n/a':190C,200C,211C,221C 'new':89C,183C 'plugin':140C 'postscript':3A,48B 'previous':181C 'rce':27B 'refin':204C,225C 'releas':83C,99C,104C 'remain':172C 'remot':9A,107C,132C,142C,192C,213C 'role':42B 'rule':110C,165C,175C,178C,201C,222C 'ruleset':116C,120C,174C,188C,209C 'run':60B 'self':29B 'self-host':28B 'server':54B,159C 'system':148C 'unauthent':143C 'unauthor':152C 'unchang':173C,206C,227C 'updat':90C,105C,164C 'upload':4A,45B 'user':39B 'vulner':135C 'waf':82C,98C 'wordpress':1A,18A,31B,32B,106C,137C,162C,191C,212C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-25T05:30:57Z","by":"analyst","run_id":820},"how_to_check":{"at":"2026-10-25T05:30:57Z","by":"analyst","run_id":820}},"analyst_revisit_at":null,"first_public_at":"2026-08-17T17:32:54+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/#CVE-2026-65640","url":"https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/","severity":null,"published_at":"2026-08-17T17:32:54+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:33:06+00:00","fetched_at":"2026-10-24T17:33:06+00:00","note":"Cloudflare: WAF Release - 2026-08-17 · Changelog"},{"source":"nvd","external_id":"CVE-2026-65640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65640","severity":null,"published_at":"2026-08-17T21:16:46+00:00","modified_at":"2026-09-03T17:02:54+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65640:820","url":null,"severity":null,"published_at":"2026-10-25T05:30:57+00:00","modified_at":"2026-10-25T05:30:57+00:00","first_seen_at":"2026-10-25T05:30:57+00:00","fetched_at":"2026-10-25T05:30:57+00:00","note":"Primary: WordPress GHSA-8vr3-7mxf-gx8w and 7.0.4 release post (Aug 12 2026). Needs Author+ (upload_files) AND Imagick+Ghostscript; Cloudflare's 'unauthenticated' wording is wrong. Cloudflare rule change was metadata only, so I recorded no WAF coverage claim. No exploitation or PoC found (CERT Santé says not exploited, no PoC)."}],"documents":[{"id":2855,"url":"https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/","title":"Cloudflare: WAF Release - 2026-08-17 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-17 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 17, 2026\n\n## WAF Release - 2026-08-17\n\nThis release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.\n\nKey Findings\n\n- CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.\n\nImpact\n\nThe WordPress changes update rule metadata only; detection behavior and actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |","published_at":"2026-08-17T17:32:54+00:00","relation":"advisory","confidence":null,"note":null},{"id":3422,"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w","title":"GHSA-8vr3-7mxf-gx8w: RCE via malicious file upload by Author+ (WordPress)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3423,"url":"https://wordpress.org/news/2026/08/wordpress-7-0-4-release/","title":"WordPress 7.0.4 Release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3424,"url":"https://cyberveille.esante.gouv.fr/alertes/wordpress-cve-2026-65640-2026-08-18","title":"CERT Santé: WordPress CVE-2026-65640","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2855,"url":"https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/","title":"Cloudflare: WAF Release - 2026-08-17 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-17 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 17, 2026\n\n## WAF Release - 2026-08-17\n\nThis release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.\n\nKey Findings\n\n- CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.\n\nImpact\n\nThe WordPress changes update rule metadata only; detection behavior and actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. |","published_at":"2026-08-17T17:32:54+00:00","relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}