When a PNG Isn't a PNG: WordPress Patches an Author-Level Imagick RCE
Patchstack technical analysis of CVE-2026-65640 details how WordPress core versions 4.7 through 7.0.3 trusted file extensions over content inspection when passing uploads to ImageMagick. The WP_Image_Editor_Imagick::load() method routed files to ImageMagick based solely on extension, allowing a file with a safe extension containing PostScript to bypass upload checks and reach Ghostscript for code execution. XML-RPC wp.uploadFile and MP3 cover-art extraction paths bypassed wp_check_filetype_and_ext() via wp_upload_bits(), landing payloads on disk. The fix in WordPress 7.0.4 adds content sniffing before Imagick handoff, rejecting PostScript/EPS signatures, fake PDFs, and compressed wrappers, and strips ImageMagick format-specifier prefixes from filenames. Requires Author-level account or higher on sites using Imagick and Ghostscript.
Research notes
- Root causeWordPress trusted file extensions over content inspection when routing uploads to ImageMagick, allowing PostScript content disguised with safe extensions to reach Ghostscript for code execution.
- Technical detailXML-RPC wp.uploadFile and MP3 cover-art extraction paths use wp_upload_bits() which bypasses wp_check_filetype_and_ext(), allowing payloads to land on disk without content inspection.
- MitigationWordPress 7.0.4 fix adds content sniffing in WP_Image_Editor_Imagick::load() before Imagick handoff, rejecting PostScript/EPS signatures, fake PDFs, and compressed wrappers; also strips ImageMagick format-specifier prefixes from filenames.