CVE-2026-65640

highpriority · track · 11EPSS 0.019 · 80 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.94% (80th) EPSS

CVSS 8.8 · high

Is it mine?

5 products

Check your exposure

Who says so?

3 sources

enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-23

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · support@hackerone.comexploitability 2.8 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-434US

exploits (1)

Public proof-of-concept and weaponised exploit code.

jobusa755-a11y/CVE-2026-65640-WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File UploadPoC · poc_in_github

affected products (5)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Open Source WordPress< 7.0.4cert_bundDE
WordPress WordPress0 → 7.0.4enisa_euvdEU
Bitnami wordpress< 7.0.4osvUSpkg:bitnami/wordpress
Bitnami wordpress-multisite< 7.0.4osvUSpkg:bitnami/wordpress-multisite

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2822WordPress: Schwachstelle ermöglicht CodeausführungDeutsch2026-08-12csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in WordPress ausnutzen, um beliebigen Programmcode auszuführen.
BIT-wordpress-2026-656402026-08-21vendor · osvUS
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
BIT-wordpress-multisite-2026-656402026-08-21vendor · osvUS
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

also known as (3)

Other names and identifiers for this entity.

EUVD-2026-60462 enisa_euvd
BIT-wordpress-2026-65640osv
BIT-wordpress-multisite-2026-65640osv

sources

Which sources assert this record, and when.

enisa_euvd osv cert_bund NVD CVE.org MITRE

published 2026-08-17modified 2026-09-03

references (2)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan