As cited
Copy frozen at (site build).
vulnerabilities
When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
WordPress 7.0.4 patches a remote code execution vulnerability in the Imagick image processing handler that allowed authenticated authors to upload files with malicious PostScript or EPS content disguised as image files. The flaw existed because WordPress relied on file extensions rather than file content inspection, and some upload paths bypassed normal validation checks. The fix now inspects file magic bytes before passing uploads to Imagick to reject dangerous file formats.
Why it matters: Site operators with multi-author or contributor access are at risk: any author-level account holder can upload a weaponized file to trigger code execution. Apply this patch immediately on sites with loosely managed registration or open contributor policies.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
WordPress 7.0.4 patches a remote code execution vulnerability in the Imagick image processing handler that allowed authenticated authors to upload files with malicious PostScript or EPS content disguised as image files. The flaw existed because WordPress relied on file extensions rather than file content inspection, and some upload paths bypassed normal validation checks. The fix now inspects file magic bytes before passing uploads to Imagick to reject dangerous file formats.
Why it matters: Site operators with multi-author or contributor access are at risk: any author-level account holder can upload a weaponized file to trigger code execution. Apply this patch immediately on sites with loosely managed registration or open contributor policies.
- Source published
- First seen by Cybersecurity Tracker