WordPress can execute arbitrary code when an authorized user uploads a malicious Postscript (.ps) file, because the Imagick library processes the file via Ghostscript. The flaw permits remote code execution, compromising the hosted server’s confidentiality, integrity and availability. Only a user with the upload_files capability, which is granted to Authors or higher, is required to exploit the vulnerability.

Every WordPress installation, from the earliest 4.7 release through the current 7.0.4, is affected. The latest 7.0.4 release includes a fix and the patch has been backported to branches as far back as 4.7, so older versions remain vulnerable until updated.

The vulnerability scores 8.8 on CVSS, indicating a high severity, and the EPSS score is not available. The exploit requires server support for Imagick and Ghostscript, and an attacker must have a role with upload_files capability. All WordPress sites that have not applied the 7.0.4 update or the backported patch remain at risk, but the exploit is straightforward to engineer and there is currently no evidence of exploitation in the wild or listing in the CISA KEV catalog.