WordPress Patches Author-Level RCE via Malicious Media Uploads
WordPress has fixed a critical vulnerability allowing logged-in authors to execute arbitrary code by uploading specially crafted files disguised as images, exploiting flaws in the Imagick extension's handling of file types.
WordPress has released version 7.0.4, addressing a critical security vulnerability that could allow users with author-level privileges to execute arbitrary code on a server. The flaw, tracked as CVE-2026-32741, affects WordPress core versions from 4.7 up to 7.0.4. It arises from how the platform's Imagick extension processes uploaded media files, particularly when they are disguised as common image formats like PNGs but contain malicious code.
The vulnerability stems from the Imagick extension's reliance on ImageMagick, a powerful image processing library that also supports formats like PostScript, EPS, and PDF. When processing these complex formats, ImageMagick often delegates to Ghostscript, a utility with a history of security issues. The core problem in WordPress was that the WP_Image_Editor_Imagick::load() method primarily trusted the file extension rather than inspecting the file's actual content. This allowed an attacker to upload a file named malicious.png that, in reality, contained PostScript code. ImageMagick would then pass this content to Ghostscript, potentially leading to server-side code execution.
This exploit path was particularly dangerous because certain WordPress upload routines, such as those used by XML-RPC's wp.uploadFile function and the cover-art extraction for MP3s, utilize wp_upload_bits(). This function writes file data without performing thorough content validation, allowing the malicious payload to land on the server and reach the vulnerable Imagick processing code. The vulnerability is reminiscent of the older "ImageTragick" vulnerabilities, which also exploited ImageMagick's handling of specially crafted image files.
The fix, implemented via commit 7daaa50, modifies the load() function to rigorously inspect the file's content before constructing an Imagick object. This ensures that any file content that could be interpreted as PostScript, EPS, or a fake PDF (i.e., a file with a .pdf extension but not starting with the %PDF- marker) is rejected. The patch also addresses disguised compressed files and prevents attackers from using filename prefixes like EPS: to force ImageMagick towards dangerous handlers like Ghostscript, while carefully avoiding conflicts with Windows drive letters.
While an attacker needs at least author-level privileges to upload media, this requirement significantly lowers the bar for exploitation on many types of WordPress sites. Multi-author publications, membership sites, client portals, and any site with open or loosely managed user registration could be at risk. An author uploading a malicious file, even if disguised as an image, presents a realistic threat scenario for these platforms.
The patch also includes checks for files that ImageMagick might silently decompress, such as gzip or bzip2 archives, which could have been used to smuggle malicious content past initial checks. Furthermore, the updated code parses filenames from remote URLs or streams to validate them before processing, closing additional potential attack vectors.
Users are strongly advised to update their WordPress installations to version 7.0.4 or later. For sites with automatic background updates enabled, the fix may already be applied, but manual verification is recommended. This vulnerability serves as a potent reminder that media handling libraries, while convenient, can introduce significant security risks if not properly secured and validated against malicious content.