WordPress 7.0.4 was released on August 12, 2026, and it's a security release — meaning you should update immediately rather than waiting for your next scheduled maintenance window. Here's what the vulnerability is, who it affects, and how to get patched.
What's in WordPress 7.0.4
This release contains a single, targeted fix: an authenticated Author+ remote code execution vulnerability via malicious file upload, affecting sites that use Imagick with Ghostscript for image processing. It was responsibly disclosed by the team at pwn.ai through WordPress's HackerOne program.
Book a free, no-obligation strategy call and we'll map out your next move.
In practice, that means a user with Author-level access or higher — not necessarily an Administrator — could upload a crafted file that gets processed by Imagick/Ghostscript in a way that executes arbitrary code on the server. If your site allows multiple authors, guest contributors, or has ever had a compromised Author account, this is not a theoretical risk.
The only file touched in this release is /wp-includes/class-wp-image-editor-imagick.php, and no packages were revised. It's a narrow, surgical patch, not a broader core update.
CVE and Advisory Reference
The vulnerability is tracked as CVE-2026-65640 (GHSA-8vr3-7mxf-gx8w). Worth noting for your records if you run vulnerability scanning or need to document patching for a client or compliance report.
Which Versions Are Affected
This isn't a WordPress 7.0-only issue. The vulnerability affects every branch back to 4.7, and the WordPress security team has already shipped fixed point releases across the board:
7.0.4 (current), 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, and 5.0.27.
If you're on 4.6 or earlier, there is no fix coming — those branches no longer receive security updates at all, which is itself a strong argument for upgrading rather than staying pinned to an ancient version. WordPress 7.1 RC3, due the same day as this release, also ships with the backport included.
How to Update
Most self-hosted sites with automatic background updates enabled will already be on 7.0.4 or one of the corresponding point releases without you doing anything. To check or update manually:
- Go to Dashboard → Updates in your WordPress admin and click Update Now if a new version is listed.
- If you're not on the latest 7.x branch, download the correct point release for your major version from WordPress.org rather than jumping straight to 7.0.4 unless you're already on 7.0.x.
- Confirm the update by checking Dashboard → Updates or your site's version footer after the update completes.
If you're not confident poking around Dashboard → Updates, or you're managing this for a client, our guide to securing a WordPress website covers the broader hardening steps worth pairing with this patch.
Should You Be Worried?
Realistically, your exposure depends on two things: whether your site uses Imagick with Ghostscript for image processing, and whether you have Author-level (or higher) accounts you don't fully trust or control. Single-admin brochure sites with no third-party authors are lower risk. Multi-author publications, membership sites, and agencies managing client logins where Author roles are handed out liberally should treat this as urgent.
Either way, remote code execution is about as serious as WordPress vulnerabilities get — it's not a defacement or a spam-injection bug, it's full server compromise. Don't wait on this one.
Keeping Track of Releases Like This
Security releases like 7.0.4 tend to land with little warning, which is exactly why they're worth tracking systematically rather than catching by chance. We maintain a running with every patch release and what it fixes, if you want the full history.