On August 12, 2026, WordPress developers released version 7.0.4, which includes an important security patch. Website administrators are advised to install the new version as soon as possible, as the patched vulnerability could under certain conditions allow an attacker to execute code on the server.
WordPress 7.0.4 comes just about a week after the previous security release, WordPress 7.0.3. The release on August 6 was also heavily focused on security, fixing a series of vulnerabilities related to XSS, information disclosure, SSRF, and privilege escalation. Read more: WordPress 7.0.3 Released With Multiple Important Security Fixes
While this update is smaller in scope, the fixed security flaw carries potentially severe consequences.
Malicious file upload could lead to code execution
WordPress 7.0.4 addresses a vulnerability through which an authenticated user with at least Author-level permissions could achieve Remote Code Execution (RCE) on the server by uploading a specially crafted file.
The security flaw impacts WordPress websites running Imagick and Ghostscript for image processing on their server.
This means it is not an unauthenticated attack—an attacker must possess a WordPress user account with at least Author-level privileges to exploit the flaw. However, the ability to execute code on the server makes the potential impact of the flaw extremely critical.
The vulnerability was responsibly reported to the WordPress security team by the pwn.ai team.
The flaw is registered under CVE-2026-65640, with a corresponding GitHub Security Advisory GHSA-8vr3-7mxf-gx8w.
Security patch also backported to older WordPress versions
Similar to the WordPress 7.0.3 security patches released a week earlier, this fix is also being backported to older WordPress release branches down to version 4.7.
However, WordPress developers emphasize that only the latest version of the CMS is actively supported. Patched releases for older versions are being published progressively as they become ready.
The security fix is also included in WordPress 7.1 RC3, scheduled for release on the same day.
Immediate installation of WordPress 7.0.4 recommended
WordPress 7.0.4 can be installed directly from the admin dashboard by navigating to Dashboard → Updates → Update Now.
Websites with automatic background updates enabled should begin updating to version 7.0.4 automatically.
Although WordPress 7.0.4 focuses on resolving a single security issue, the potential impact of the vulnerability makes prompt updating strongly recommended. The update is especially critical for sites with multiple user accounts where users hold at least Author-level privileges.
As standard practice before updating manually, ensure you have a fresh backup of both your website files and database.
