WordPress 7.0.4 was released on August 12, 2026, and it's a security release — meaning you should update immediately rather than waiting for your next scheduled maintenance window. Here's what the vulnerability is, who it affects, and how to get patched.
What's in WordPress 7.0.4
This release contains a single, targeted fix: an authenticated Author+ remote code execution vulnerability via malicious file upload, affecting sites that use Imagick with Ghostscript for image processing. It was responsibly disclosed by the team at pwn.ai through WordPress's HackerOne program.
In practice, that means a user with Author-level access or higher — not necessarily an Administrator — could upload a crafted file that gets processed by Imagick/Ghostscript in a way that executes arbitrary code on the server. If your site allows multiple authors, guest contributors, or has ever had a compromised Author account, this is not a theoretical risk.
The only file touched in this release is /wp-includes/class-wp-image-editor-imagick.php, and no packages were revised. It's a narrow, surgical patch, not a broader core update.
CVE and Advisory Reference
The vulnerability is tracked as CVE-2026-65640 (GHSA-8vr3-7mxf-gx8w). Worth noting for your records if you run vulnerability scanning or need to document patching for a client or compliance report.
Which Versions Are Affected
This isn't a WordPress 7.0-only issue. The vulnerability affects every branch back to 4.7, and the WordPress security team has already shipped fixed point releases across the board:
7.0.4 (current), 6.9.7, 6.8.8, 6.7.7, 6.6.7, 6.5.10, 6.4.10, 6.3.10, 6.2.11, 6.1.12, 6.0.14, 5.9.16, 5.8.15, 5.7.17, 5.6.19, 5.5.20, 5.4.21, 5.3.23, 5.2.26, 5.1.24, and 5.0.27.
If you're on 4.6 or earlier, there is no fix coming — those branches no longer receive security updates at all, which is itself a strong argument for upgrading rather than staying pinned to an ancient version. WordPress 7.1 RC3, due the same day as this release, also ships with the backport included.
How to Update
Most self-hosted sites with automatic background updates enabled will already be on 7.0.4 or one of the corresponding point releases without you doing anything. To check or update manually:
- Go to Dashboard → Updates in your WordPress admin and click Update Now if a new version is listed.
- If you're not on the latest 7.x branch, download the correct point release for your major version from WordPress.org rather than jumping straight to 7.0.4 unless you're already on 7.0.x.
- Confirm the update by checking Dashboard → Updates or your site's version footer after the update completes.
If you're not confident poking around Dashboard → Updates, or you're managing this for a client, our guide to securing a WordPress website covers the broader hardening steps worth pairing with this patch.
Should You Be Worried?
Realistically, your exposure depends on two things: whether your site uses Imagick with Ghostscript for image processing, and whether you have Author-level (or higher) accounts you don't fully trust or control. Single-admin brochure sites with no third-party authors are lower risk. Multi-author publications, membership sites, and agencies managing client logins where Author roles are handed out liberally should treat this as urgent.
Either way, remote code execution is about as serious as WordPress vulnerabilities get — it's not a defacement or a spam-injection bug, it's full server compromise. Don't wait on this one.
Keeping Track of Releases Like This
Security releases like 7.0.4 tend to land with little warning, which is exactly why they're worth tracking systematically rather than catching by chance. We maintain a running WordPress security updates tracker with every patch release and what it fixes, if you want the full history.
For what's new in the 7.0 branch beyond this patch, see our breakdown of WordPress 7.0's feature set.
Our Approach
Sites on our WordPress maintenance plans don't need to act on releases like this one — security patches are tested and applied on our end as soon as they ship, typically within hours, not whenever someone happens to log in and notice an update flag.
Not sure if your site is patched? Get in touch and we'll check it for you.
Frequently Asked Questions
Is WordPress 7.0.4 a mandatory update?
It's not enforced by WordPress itself unless you have automatic background updates enabled, but the WordPress security team explicitly recommends updating immediately. Given this is a remote code execution vulnerability, treat it as mandatory.
Does this affect sites that don't use Imagick?
The specific exploit path requires Imagick paired with Ghostscript for image processing. If your server uses GD instead (the WordPress default on many hosts), this particular vector doesn't apply — but you should still update, since the patched file is loaded regardless of which image library is active.
I'm on an older WordPress version. Do I need to upgrade to 7.0.4?
No — WordPress backported this fix to every supported branch back to 4.7. Update to the corresponding point release for your current major version (for example 6.5.10 if you're on 6.5.x) rather than jumping straight to 7.0.4, which may include unrelated breaking changes for older setups.
What if I'm on WordPress 4.6 or earlier?
There is no fix for 4.6 and earlier — those branches no longer receive security updates. This is a strong signal that it's time to plan a full upgrade rather than continuing to run unsupported core.
