WordPress 7.0.4 is now available, fixing a remote code execution vulnerability that could allow a user with an Author-level account or higher to execute code through a malicious file upload on sites using Imagick and Ghostscript. The vulnerability was responsibly reported by the team at pwn.ai, and the fix is being backported through the 4.7 branch and to WordPress 7.1 RC3.
The release follows WordPress 7.0.2 on July 17 and WordPress 7.0.3 on August 6, marking three security releases in less than a month. WordPress 7.0.3 addressed 12 security vulnerabilities, including a pre-auth reflected cross-site scripting vulnerability on the login screen with the potential to lead to PHP code execution, which was also reported by pwn.ai, while 7.0.2 fixed a critical pre-authentication RCE and a high-severity SQL injection vulnerability.
The vulnerability and the patch
Patchstack explained that the vulnerability involved how WordPress passed uploaded files to ImageMagick through the Imagick extension. They said the fix “closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your server.”
ImageMagick, which WordPress can use through Imagick to process media, supports formats beyond common image files, including PostScript, EPS, and PDF. Some of these formats are processed through Ghostscript.
The problem was that WordPress’s WP_Image_Editor_Imagick::load() method used a file’s extension when determining how to pass it to ImageMagick, while ImageMagick examined the file’s actual contents. A malicious file could therefore be given an image extension while containing PostScript content that ImageMagick would recognize when processing the file.
Patchstack said the normal upload flow uses wp_check_filetype_and_ext() to catch such files, but some other upload routes did not go through the same check. It identified XML-RPC’s wp.uploadFile and the cover-art extraction process for uploaded MP3 files as two such paths.
If the file reached the vulnerable code, ImageMagick could identify the PostScript content and pass it to a PostScript-family decoder, leading to Ghostscript processing the file.
The issue requires an authenticated user with permission to upload media. The fix changes WP_Image_Editor_Imagick::load() to inspect a file’s contents before passing it to Imagick. Patchstack said the updated code checks for PostScript and EPS signatures, fake PDFs, compressed files that ImageMagick could unpack, and filename prefixes that could be used to select a particular ImageMagick handler.
The Community Response
Separately, security researcher Ashar Javed said his source-code audit independently discovered the same RCE and credited pwn.ai for reporting the vulnerability before he did. Javed said his audit was conducted with the help of a “council of frontier AI models.” In a technical report, he described an Author-controlled original_image path in WordPress 7.1’s client-side media processing route that he said could lead to local file disclosure, PHP object injection, and, on systems using Imagick and Ghostscript, remote code execution.
The rapid succession of security releases also prompted discussion about the role of AI in vulnerability discovery. On X, Makoto Taniguchi questioned whether AI’s influence could be making security vulnerabilities easier to find. He also noted that automatic updates still require functionality checks and said frequent updates could create “psychological resistance to new implementations.”
Patchstack CEO Oliver Sild predicted that it is only a matter of time before a WordPress core zero-day is publicly disclosed before a fix is released. Sild said more security researchers are now able to report serious vulnerabilities with the help of AI, and that some researchers could publicly disclose vulnerabilities if their reports remain unresolved or are repeatedly classified as duplicates.
Takeaki Hosoyama also commented on the recent pace of WordPress vulnerability discoveries, saying the frequency has been “staggering.” He added that launching a WordPress site could be risky without planning for maintenance from the outset.
