--- id: "CVE-2026-65640" kind: "vulnerability" aliases: ["CVE-2026-65640"] title: "WordPress: malicious PostScript upload by an Author gives remote code execution" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "other" products: [{"name": "wordpress", "fixed": ["7.0.4", "6.9.7", "6.8.8", "6.7.7", "6.6.7", "6.5.10", "6.4.10", "6.3.10", "6.2.11", "6.1.12", "6.0.14", "5.9.16", "5.8.15", "5.7.17", "5.6.19", "5.5.20", "5.4.21", "5.3.23", "5.2.26", "5.1.24", "5.0.27", "4.9.31", "4.8.30", "4.7.35"], "affected": ">= 4.7.0, <= 7.0.3 (per branch, see advisory)", "ecosystem": "other"}] ecosystems: [] tags: ["authenticated", "cloudflare", "ghostscript", "imagick", "lab-disclosure", "other", "rce", "self-hosted", "wordpress"] not_affected_if: ["auth-required", "managed-hosting", "no-ghostscript", "no-imagick"] published_at: "2026-08-17T17:32:54+00:00" first_seen_at: "2026-10-24T17:33:06+00:00" updated_at: "2026-10-25T05:30:57+00:00" sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/", "first_seen_at": "2026-10-24T17:33:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65640", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T05:30:57+00:00"}] --- # WordPress: malicious PostScript upload by an Author gives remote code execution WordPress core (4.7 through 7.0.3) lets a user with Author role or higher upload a crafted PostScript file disguised by extension. On servers with Imagick and Ghostscript, Ghostscript runs it and the attacker gets code execution on the host. Fixed in 7.0.4 and backports to every branch back to 4.7. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - other:wordpress affected >= 4.7.0, <= 7.0.3 (per branch, see advisory) fixed 7.0.4, 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, 5.0.27, 4.9.31, 4.8.30, 4.7.35 ## How to check Check the WordPress version (Dashboard > Updates, or wp core version) against the affected ranges. Then check exposure: php -m | grep -i imagick and gs --version (or which gs). Also check who has Author or higher roles (wp user list --role=author). Sites without both Imagick and Ghostscript, or with no untrusted Author+ users, are not exploitable via this path. ## Fix Update to WordPress 7.0.4 (or the patched release for your branch: 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, 5.0.27, 4.9.31, 4.8.30, 4.7.35). Auto-updates apply it on sites that have them enabled. ## Timeline - 2026-10-24T17:33:06+00:00 lab https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/ — Cloudflare: WAF Release - 2026-08-17 · Changelog - 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65640 - 2026-10-25T05:30:57+00:00 analyst — Primary: WordPress GHSA-8vr3-7mxf-gx8w and 7.0.4 release post (Aug 12 2026). Needs Author+ (upload_files) AND Imagick+Ghostscript; Cloudflare's 'unauthenticated' wording is wrong. Cloudflare rule change was metadata only, so I recorded no WAF coverage claim. No exploitation or PoC found (CERT Santé says not exploited, no PoC). ## Documents - [advisory] Cloudflare: WAF Release - 2026-08-17 · Changelog https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/ - [advisory] GHSA-8vr3-7mxf-gx8w: RCE via malicious file upload by Author+ (WordPress) https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w - [fix] WordPress 7.0.4 Release https://wordpress.org/news/2026/08/wordpress-7-0-4-release/ - [mentions] CERT Santé: WordPress CVE-2026-65640 https://cyberveille.esante.gouv.fr/alertes/wordpress-cve-2026-65640-2026-08-18 - [mitigation] Cloudflare: WAF Release - 2026-08-17 · Changelog https://developers.cloudflare.com/changelog/post/2026-08-17-waf-release/ ## From the sources WAF Release - 2026-08-17 · Changelog # Changelog New updates and improvements at Cloudflare. August 17, 2026 ## WAF Release - 2026-08-17 This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640. Key Findings - CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers. Impact The WordPress changes update rule metadata only; detection behavior and actions remain unchanged. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...3590a4ad | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. | | Cloudflare Free Ruleset | ...cfe1a93c | N/A | Wordpress - Remote Code Execution - CVE:CVE-2026-65640 | Block | N/A | Rule metadata description refined. Detection unchanged. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_