WordPress 7.0.4 is now available, and this one should not sit in the usual we will do updates on Friday pile. WordPress describes it as a security release and recommends updating immediately.
The release fixes CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w: an authenticated Author+ remote code execution issue via malicious file upload on sites that use Imagick and Ghostscript. In plain owner language: if the right server setup is present, a user with content access could become a much bigger problem than a badly formatted blog post.
Key Takeaways
- Update WordPress core to 7.0.4 immediately, or confirm your automatic background update already finished.
- Pay special attention to sites with Author-level users, media uploads, Imagick, and Ghostscript.
- Older branches are getting backports, but do not assume protection until your site has actually received the fix.
- After updating, test admin login, media uploads, forms, and WooCommerce checkout if the site sells anything.
Who should care first
Every WordPress site owner should verify the update, because this is a core security release. The sharper edge is for sites with multiple editorial accounts, guest authors, client logins, agency handovers, or any workflow where non-admin users can upload media.
WooCommerce stores should also treat this as urgent. Not because the source names WooCommerce specifically, but because stores usually have more business-critical paths to break or protect: checkout, account pages, forms, payment flows, and media-heavy product management. Security updates are where you want speed, but not blind panic-clicking.
What to do today
Go to Dashboard – Updates and confirm WordPress 7.0.4 is installed. If it is not, update from there or download the release from WordPress.org. WordPress says sites that support automatic background updates will begin updating shortly, but will begin is not the same thing as your production site is patched.
- Take or confirm a recent backup before touching production.
- Run the WordPress core update promptly.
- Check whether the server uses Imagick and Ghostscript, especially on media-heavy sites.
- Review Author-level and higher accounts, particularly old freelancer, contributor, or client accounts.
- After updating, test login, media upload, key forms, and checkout if present.
Older branches and backports need verification
WordPress says the fixes are being backported through the 4.7 branch and to the WordPress 7.1 RC3 release due later the same day. It also reminds users that only the most recent version of WordPress is actively supported.
That matters operationally. If a site is pinned to an older branch because of a fragile theme, abandoned plugin, or ancient hosting setup, do not just read the word backport and relax. Confirm the actual patched version is installed on that specific site. Security by assumption is a popular hobby and a terrible maintenance strategy.
Why this is not a routine maintenance release
The important combination here is core, RCE, authenticated Author+, malicious upload, Imagick, and Ghostscript. Not every WordPress site will match every condition, but the potential impact is serious enough that waiting for a convenient maintenance window is the wrong default.
The sensible path is quick and boring: backup, update, verify, test the critical paths. If automatic updates already handled it, great – still check. If they did not, update manually. And if your site has lots of editorial users, now is a good moment to remove accounts that should have been removed two projects ago.
WordPress published the release details at WordPress.org News.
Frequently Asked Questions
What vulnerability does WordPress 7.0.4 fix?
WordPress 7.0.4 fixes CVE-2026-65640 / GHSA-8vr3-7mxf-gx8w, an authenticated Author+ remote code execution issue involving malicious file uploads on sites that use Imagick and Ghostscript.
Do I need to update if automatic background updates are enabled?
Yes, you should still verify it. WordPress says sites that support automatic background updates will begin updating shortly, but site owners should confirm that WordPress 7.0.4 is actually installed.
Which sites should be checked first?
Prioritize sites with Author-level or higher users, guest authors, client or freelancer accounts, media upload workflows, Imagick, and Ghostscript. WooCommerce stores should also move quickly because checkout, account pages, forms, and product media are business-critical paths.
How do I install WordPress 7.0.4?
Go to Dashboard – Updates and click Update Now, or download the release from WordPress.org. Before updating production, confirm you have a recent backup, then test login, media uploads, forms, and checkout if the site uses WooCommerce.
Are older WordPress versions protected by the backport?
WordPress says the fix is being backported through the 4.7 branch and to WordPress 7.1 RC3. Still, do not assume an older site is protected until you confirm that the specific patched version for that branch is installed.