WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability
This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wordpress | — | Upgrade Wordpress to version 4.8.30Upgrade Wordpress to version 4.7.35Upgrade Wordpress to version 6.2.11Upgrade Wordpress to version 5.9.16Upgrade Wordpress to version 6.0.14Upgrade Wordpress to version 6.1.12Upgrade Wordpress to version 6.7.7Upgrade Wordpress to version 6.5.10Upgrade Wordpress to version 6.4.10Upgrade Wordpress to version 5.5.20Upgrade Wordpress to version 6.3.10Upgrade Wordpress to version 5.8.15Upgrade Wordpress to version 5.3.23Upgrade Wordpress to version 6.8.8Upgrade Wordpress to version 7.0.4Upgrade Wordpress to version 5.6.19Upgrade Wordpress to version 6.9.7Upgrade Wordpress to version 5.7.17Upgrade Wordpress to version 5.0.27Upgrade Wordpress to version 5.4.21Upgrade Wordpress to version 5.1.24Upgrade Wordpress to version 5.2.26Upgrade Wordpress to version 4.9.31Upgrade Wordpress to version 6.6.7 | Sep 3, 2026 | Aug 17, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub