WordPress released 7.0.4 on 12 August 2026, a security release fixing a single vulnerability: a remote code execution flaw in image handling. It is the third core security release since mid-July.
The Vulnerability
CVE-2026-65640 allows a logged-in user with Author-level access or above to execute code on the server by uploading a malicious PostScript file. WordPress rates it High severity, with a CVSS score of 8.8 out of 10. It only affects sites that use Imagick with Ghostscript for image processing — a common setup on many hosts, since Imagick is WordPress’s preferred image library where available.
The issue was reported responsibly by the pwn.ai research team. Backports were released for older branches all the way to 4.7, and the fix is included in the upcoming 7.1 release candidate.
Author accounts are the entry point here, so sites with open author registration, multi-author blogs, and membership sites carry more exposure than a typical business site with two or three trusted users.
Three Releases in 26 Days
- 7.0.2 — 17 July. Two vulnerabilities, including an unauthenticated remote code execution chain in the REST API. Serious enough that WordPress.org forced auto-updates onto affected sites. We covered it at the time.
- 7.0.3 — 6 August. Twelve fixes in one release. The headline issue was a reflected XSS on the login screen (CVSS 8.9), reported by the same pwn.ai team, which could lead to PHP code execution if an administrator clicked a crafted link. The other eleven covered stored XSS, a multisite privilege escalation, and several information disclosure issues.
- 7.0.4 — 12 August. The file upload RCE above — High severity, CVSS 8.8.
The pattern reflects where security researchers are currently looking. pwn.ai reported the headline issue in both 7.0.3 and 7.0.4, and the 7.0.3 credits list includes teams from Aikido Security, Assetnote, and Anthropic.
What Our Clients Need to Do
Nothing. Minor releases like 7.0.4 install through WordPress’s automatic background updates, and we verify that every site we manage has landed on the new version rather than assuming the update fired — auto-updates can be silently disabled by a config constant or a leftover version-control folder.
Self-Managed Sites
Check Dashboard → Updates and confirm you are on 7.0.4 (or the patched release for your branch, if you are on an older version). If you are on anything between 4.7 and 7.0.3, an update is available.
While you are there, confirm core auto-updates are enabled — with three security releases since 17 July, sites applying these by hand have been exposed for days at a time.
For a once-over on whether your site is patched and set up to stay that way, get in touch or see our managed WordPress care plans.
