WordPress Patches Imagick Remote Code Execution Flaw

WordPress 7.0.4 includes a fix for a remote code execution vulnerability in the Imagick image processing library. Security researchers at Patchstack, led by Security Research Lead Dave Jong, described how a logged-in author could upload a file that looks like an image but is actually a PostScript program, leading to code execution on the web server. The flaw affected WordPress core versions 4.7 through 7.0, and the WordPress.org announcement confirms the maintenance release. For site owners, this is a priority update because it closes a path that could turn a routine media upload into a full server compromise.

WordPress uses ImageMagick, a powerful open-source image processing tool, through a PHP extension called Imagick to handle resizing and processing of images in the Media Library. The problem is that ImageMagick understands far more than common formats like JPEG and PNG. It can also open PostScript, EPS, and PDF files, and to render those it calls on Ghostscript, a program that interprets PostScript and PDF and has a long history of being tricked into running commands it should not. This is the same family of issues as the older ImageTragick bugs. The core of the problem is a mismatch: ImageMagick decides what a file is by reading its contents, not its extension, while WordPress was mostly trusting the file extension. So a file named holiday.png that actually contains PostScript code would clear upload checks, get handed to Imagick, which recognizes the PostScript inside and fires up Ghostscript to run the code.

The vulnerable code lives in WordPress's WP_Image_Editor_Imagick::load() method. That method decided how to pass an uploaded file to ImageMagick based only on the file's extension, never inspecting the file's contents. The code first checked if the extension is pdf, and if not it called readImage() or readImageBlob(), which sniff the file's magic bytes and ignore the file name. So content starting with the signatures %!, \x04%!, \xC5\xD0\xD3\xC6, or \xFFWPC selects ImageMagick's PostScript, EPS, or WPG decoder, which then calls Ghostscript to execute the file as a PostScript program. During a normal file upload flow, the WordPress function wp_check_filetype_and_ext() catches this mismatch and prevents the attack. But not every upload path goes through that check. XML-RPC's wp.uploadFile method and the cover-art extraction routine for uploaded MP3s both write their bytes with wp_upload_bits(), which never inspects the content, so the malicious payload lands on disk and reaches the vulnerable code.

Patchstack reports that the fix is in commit 7daaa50 in WordPress core. The updated load() function now checks the file's real contents before constructing the Imagick object, so nothing is ever passed to a PostScript-family decoder. Concretely, the patch sniffs the first chunk of every file and rejects PostScript and EPS files by their signatures, by extension, or by ImageMagick format specifier prefixes. It also rejects fake PDFs, meaning files that claim a PDF extension but do not begin with the real %PDF- marker. It blocks compressed files that ImageMagick would silently unpack, such as gzip and bzip2 archives, which were another way to smuggle content past the checks. There is a subtler piece as well: ImageMagick lets you force a particular handler by prefixing a filename, like EPS:innocent.png. The new code strips and inspects those prefixes, while being careful not to trip over Windows drive letters like C:, so an attacker cannot use the filename itself to steer Imagick toward Ghostscript. Because the same trick can arrive through a remote URL or a stream, the fix parses filenames out of those sources before validating them too.

To exploit this vulnerability, an attacker needs to be able to upload media, which means an Author-level account or higher in WordPress. This is not an anonymous, drive-by attack that just anyone can launch. But many websites hand out Author accounts more freely than they realize. If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, that access bar is much lower than it sounds. On those sites, an Author uploading a booby-trapped image is a genuinely realistic threat, not a theoretical one. If your site has only you and a tightly held set of trusted editors, your exposure is smaller, but the update is still important because a compromised editor account could be used the same way.

The immediate action is to update WordPress to version 7.0.4 or later. If you have automatic background updates enabled, you may already be covered, so it is worth a quick check of your current version. If you update manually, prioritize this one, especially on any site where accounts are handed out beyond your core team. This incident is also a useful reminder about media handling in general: the risky part usually is not the image itself, but everything else the image library is quietly willing to open. For website owners who want to reduce the window of exposure between a security release and its application, managed WordPress hosting such as AEU Hosting provides security-focused maintenance, including automated core and plugin updates as part of its end-to-end secured platform. That kind of managed updating helps ensure patches like this are installed promptly without requiring manual intervention.

Finally, review user roles on your site. Remove Author-level access from anyone who does not need it, and consider using a security plugin that inspects file contents during upload, not just extensions. The core lesson from this flaw is that filenames are not a reliable indicator of what a file actually contains, and security checks must look at the data itself.