Critical Security Maintenance Release Overview
WordPress 7.0.4 is available as a targeted security update designed to address a remote code execution vulnerability. Because this update mitigates a security risk, administrators are advised to update their installations immediately. The release addresses a specific attack vector targeting image processing pipelines on configured web servers.
Vulnerability Analysis: Authenticated Author+ Remote Code Execution
The primary security patch in WordPress 7.0.4 resolves an authenticated Author-level remote code execution (RCE) vulnerability. The issue manifests during file upload operations on sites where the underlying server relies on both Imagick and Ghostscript for media rendering and image manipulation. Attackers possessing Author privileges or higher could exploit this vector by uploading specially crafted malicious files to execute arbitrary code on the server environment.
The vulnerability was responsibly identified and disclosed to the WordPress core team by security researchers at pwn.ai.
Security Advisory References and Tracking
The security issue addressed in this maintenance release is formally tracked under the following industry identifiers:
- CVE Identifier: CVE-2026-65640
- GitHub Security Advisory: GHSA-8vr3-7mxf-gx8w
Further technical details regarding the advisory vector can be accessed through these official vulnerability reference entries.
System Prerequisites and Affected Configurations
The threat vector specifically impacts WordPress environments meeting distinct server-level criteria:
- User Permissions: The exploit requires an authenticated session with at least Author-level capabilities.
- Server Extensions: The underlying host environment must utilize the Imagick PHP extension alongside Ghostscript for handling media uploads.
Sites operating without this specific media-processing toolchain remain unaffected by this direct RCE execution path, though updating remains standard protocol across all deployments.
Branch Backporting and Core Support Scope
As a courtesy to legacy infrastructure, the security fixes included in WordPress 7.0.4 are being backported across legacy release lines, extending through the 4.7 branch as well as the upcoming 7.1 RC3 release. Core maintainers emphasize that official active support applies exclusively to the most recent production version of WordPress, and legacy backports ship as development completes.
Deployment Methods and Upgrade Paths
Administrators can apply the WordPress 7.0.4 patch through multiple standard updating mechanisms:
- Automatic Background Updates: Installations with automatic background updates enabled will automatically fetch and apply the release package.
- WordPress Dashboard: Navigate to
Dashboard → Updatesinside the administration area and click Update Now. - Manual Installation: Download the distribution archive directly from WordPress.org and apply the update files manually.
Detailed documentation and upgrade guidance are available on the official WordPress 7.0.4 HelpHub site.
Release Leadership and Core Contributors
The WordPress 7.0.4 release effort was led by John Blackbourn, featuring core technical direction from Dennis Snell and Jeremy Felt. Additional technical contributions and backporting efforts were provided by Aaron D. Campbell, Aaron Jorbin, Adam Silverstein, Aki Hamano, Alex Concha, Barry, Dennis Snell, Ehtisham Siddiqui, Jeremy Felt, John Blackbourn, Jonathan Desrosiers, Lance Willett, Marin Atanasov, Mohammad Jangda, Sergey Biryukov, vortfu, Weston Ruter, and representatives from WP Engine.
Frequently asked questions
What security issue is fixed in WordPress 7.0.4?
WordPress 7.0.4 patches an authenticated Author-level remote code execution (RCE) vulnerability triggered via malicious file uploads on servers running Imagick and Ghostscript.
What are the official advisory tracking IDs for this patch?
The vulnerability is tracked under CVE-2026-65640 and GHSA-8vr3-7mxf-gx8w.
Who discovered the security vulnerability?
The issue was responsibly reported to the WordPress security team by pwn.ai.
Are older versions of WordPress receiving this fix?
Yes, security backports are being issued down through the WordPress 4.7 branch and included in the 7.1 RC3 release as a courtesy.
How do I update my site to WordPress 7.0.4?
You can update automatically via background updates, perform a one-click update in Dashboard -> Updates, or manually download the update from WordPress.org.
Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.
