WP
WordPress Core 7.0.4
Get release alerts
7.0.3โ7.0.4SecurityEmergency
โฆ Editor's summary
WordPress 7.0.4 is an urgent security release addressing an authenticated remote code execution vulnerability. The issue could allow users with Author-level privileges or higher to achieve remote code execution through a malicious file upload on WordPress sites using Imagick and Ghostscript. WordPress recommends that all affected sites update immediately.
โ Security impact
- Fixed an authenticated remote code execution (RCE) vulnerability affecting sites that use Imagick and Ghostscript.
- The vulnerability could be exploited by an authenticated user with Author-level privileges or higher through a malicious file upload.
- The vulnerability also affects multiple older WordPress branches, for which corresponding security updates have been released.
- Immediate deployment is recommended due to the remote code execution impact.
What's new
WordPress 7.0.4 is an urgent security release addressing a remote code execution vulnerability in WordPress Core.
Security fixes- Fixed an authenticated remote code execution (RCE) vulnerability affecting WordPress sites that use Imagick and Ghostscript.
- The vulnerability could be exploited by an authenticated user with Author-level privileges or higher through a malicious file upload.
- The security fix modifies the WordPress Imagick image editor component to prevent exploitation of the vulnerability.
- Equivalent security fixes have also been released for affected older WordPress branches.
WordPress administrators should update to version 7.0.4 immediately. The WordPress Security Team specifically recommends immediate installation because this release addresses a security vulnerability with remote code execution impact.
More from WordPress Core
๐ฌ Comments (0)
Share any installation issues, compatibility changes, or fixes you noticed.