WordPress CVE-2026-65640

Two server-side conditions must both be true for exploitation to be possible: Imagick (the PHP extension) must be installed and enabled, and Ghostscript must be installed on the server and accessible to Imagick's delegate configuration. These are not WordPress defaults but are common in self-hosted environments running media-heavy sites. The attacker must also hold a WordPress account with the upload_files capability, which is granted by default to Author, Editor, and Administrator roles (PR:L per CVSS). Exploitation is categorically blocked on managed hosting platforms that sandbox or exclude Ghostscript, on WordPress installations with Imagick disabled (e.g., using GD instead), and against accounts below Author level. No network privilege or special positioning beyond authenticated HTTP access to the WordPress media upload endpoint is required. Unauthenticated exploitation is not possible given the PR:L CVSS designation.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely severe vulnerability: network-reachable, low complexity, requiring only a low-privilege account, with no user interaction needed and full confidentiality, integrity, and availability impact. However, two non-default server-side dependencies - Imagick and Ghostscript - must both be installed and active for exploitation to succeed, which moderates the effective attack surface relative to what CVSS alone suggests; managed WordPress hosting platforms that sandbox or omit Ghostscript are not vulnerable regardless of software version. No EPSS data was included in the source intelligence, no CISA KEV listing exists, and no POC has been identified at time of analysis - meaning widespread opportunistic exploitation has not yet been confirmed, though file-upload RCE classes historically attract rapid weaponization once public. Even a mid-sized municipal IT team in opole relying on self-hosted WordPress for content management and running Imagick for thumbnail generation should treat this as urgent, because the Author-level access bar is reachable via credential stuffing, phishing, or compromised contributor accounts without any elevated foothold. The SSVC technical impact is total (full RCE), and the automatable dimension is moderate - prerequisite account access limits mass scanning but targeted exploitation is straightforward.

An attacker who has acquired Author-level credentials - through phishing, credential stuffing against a site with weak password policies, or as a malicious insider contributor - crafts a PostScript file with embedded Ghostscript system commands (e.g., using the (%pipe%/bin/bash -c '...') idiom) and uploads it via the WordPress media library. WordPress passes the file to Imagick for thumbnail generation, which in turn invokes Ghostscript, executing the embedded commands as the web server user (typically www-data or apache) and granting the attacker arbitrary code execution on the server. No public exploit code has been identified at time of analysis, but the technique is well-documented from prior Ghostscript CVEs and requires no novel research to adapt.