Blog WordPress 7.0.4 patches an Imagick RCE, plus a Forminator upload fix

WordPress 7.0.4 patches an Imagick RCE, plus a Forminator upload fix

WordPress 7.0.4 fixes an author-level remote code execution through Imagick's PostScript handling. Forminator 1.56.2 closes an unauthenticated arbitrary file upload on roughly 600,000 sites, and WPAdverts 2.3.3 patches an authorization bypass in its REST endpoint.

Segurium 3 min read
  • wordpress
  • plugin
  • cve

Forminator, installed on roughly 600,000 sites, shipped 1.56.2 to close an arbitrary file upload reachable through the form-submission path without a login. Anything that lets a stranger drop a file into wp-content/uploads is a straight route to a shell, which is why this patch belongs ahead of the WordPress 7.0.4 release that also landed.

7.0.4 itself is a courtesy fix for a remote code execution that only reaches sites running Imagick with Ghostscript, and only from an account with the upload_files capability — Author-level or higher. Servers still using Ghostscript-backed PostScript rendering — the same class of bug that has haunted ImageMagick for years — need it; the rest can take it at their normal pace. A quieter third item rounds things out: WPAdverts 2.3.3 closes an authorization bypass that was leaking site configuration to unauthenticated callers.

WordPress core 7.0.4

The vulnerable path is a crafted PostScript file processed by Imagick, which hands off to Ghostscript and executes attacker-controlled code as the web-server user. The prerequisites narrow the exposure considerably: Imagick has to be the image backend, Ghostscript has to be installed and callable, and the attacker needs an account with the upload_files capability, which starts at Author. Sites that accept contributions from partially-trusted users are the natural targets — a personal blog with a single admin account is not one of them, but a multi-author publication or a membership site with elevated roles is.

  • CVE: CVE-2026-65640 — 8.8
  • Affected: all prior versions of WordPress
  • Patched: 7.0.4
  • After updating, audit Author-and-above accounts for anything you did not create yourself, and check wp-content/uploads for unfamiliar .ps or .eps files that were used to stage the exploit.

forminator 1.56.2

Forminator’s upload handler accepts files without the checks that would keep an executable payload out of the uploads tree, and the path is reachable from a public form — no account required. That combination — high install count, no auth wall, a plugin whose whole job is to accept form input from strangers — is the shape opportunistic scanners find fastest, so a site that ran an older release with any public form should be treated as potentially touched rather than merely at-risk.

  • CVE: CVE-2026-15748
  • Vulnerability class: arbitrary file upload, unauthenticated
  • Affected: all versions up to and including 1.56.1
  • Patched: 1.56.2 (the current directory release is 1.57.0)
  • On a site that ran an older release, search wp-content/uploads for PHP files (there should be none), review recently-modified files across the tree, and check request logs for POSTs to the Forminator upload endpoints from unfamiliar sources.

This is the kind of compromise a malware scanner earns its keep on — the payload is not the flaw, it is whatever the attacker dropped afterwards, and it usually lives outside the plugin that let it in.

wpadverts 2.3.3

WPAdverts exposes a REST route under classifieds-types that does not verify the caller’s authorization. An unauthenticated request returns internal site configuration — registered post types, taxonomies and other structural details the plugin should be treating as internal. That is not shell access, but it is the reconnaissance a follow-on attacker uses to shape the next request, and a public classifieds site has no legitimate reason to answer strangers with that data.

  • CVE: CVE-2026-11801 — 7.5
  • Affected: up to and including 2.3.2
  • Patched: 2.3.3

For sites that want a WordPress malware scanner and cleanup tool aimed at exactly this class of plugin compromise — public upload endpoints, dropped shells, and the debris they leave behind in the uploads tree — Segurium is available on the official directory at wordpress.org/plugins/segurium/.

Share this post

Related

Tags: #wordpress , #plugin , #cve