CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Permanent story citation

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 5821

As cited

Copy frozen at (site build).

vulnerabilities

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches a remote code execution vulnerability in the Imagick image processing handler that allowed authenticated authors to upload files with malicious PostScript or EPS content disguised as image files. The flaw existed because WordPress relied on file extensions rather than file content inspection, and some upload paths bypassed normal validation checks. The fix now inspects file magic bytes before passing uploads to Imagick to reject dangerous file formats.

Why it matters: Site operators with multi-author or contributor access are at risk: any author-level account holder can upload a weaponized file to trigger code execution. Apply this patch immediately on sites with loosely managed registration or open contributor policies.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches a remote code execution vulnerability in the Imagick image processing handler that allowed authenticated authors to upload files with malicious PostScript or EPS content disguised as image files. The flaw existed because WordPress relied on file extensions rather than file content inspection, and some upload paths bypassed normal validation checks. The fix now inspects file magic bytes before passing uploads to Imagick to reject dangerous file formats.

Why it matters: Site operators with multi-author or contributor access are at risk: any author-level account holder can upload a weaponized file to trigger code execution. Apply this patch immediately on sites with loosely managed registration or open contributor policies.

VendorsMicrosoftWordPress
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary