Barely a week after the last update, WordPress has released another security patch.
On August 6, 2026, WordPress 7.0.3 came out, patching 12 security vulnerabilities at once. Then on August 12, 2026, just days later, WordPress 7.0.4 arrived.
What makes this one different? WordPress 7.0.4 doesn’t patch a long list of issues. But there’s one fix in it worth understanding properly, not just clicking “update” and moving on.
This fix has to do with how WordPress hands off images you upload to ImageMagick.
The update applies to every WordPress version, from 4.7 all the way to 7.0. So chances are, your site is affected too. You can read the official announcement on wordpress.org.
First, Let’s Get Familiar With GD Library and ImageMagick
Before we get into the problem, it helps to understand the two “engines” WordPress uses to process images.
By default, WordPress uses GD Library to process images. Every time you upload a photo to a post and WordPress crops or resizes it, that’s GD Library doing the work.
But if your hosting server has ImageMagick available, WordPress will automatically prefer it instead. GD Library only kicks in when ImageMagick isn’t around.
Why does WordPress favor ImageMagick? Because the results are simply better. Here’s why:
Image sharpness
ImageMagick uses a more advanced resampling algorithm called Lanczos. When an image is shrunk down, it still comes out sharp and crisp.
GD Library, on the other hand, tends to produce slightly blurry results when resizing, because its algorithm is simpler.
Handling large images
ImageMagick handles high-resolution photos much better, think shots straight off a DSLR or mirrorless camera that are tens of megabytes in size. It does this without putting too much strain on your server’s memory.
GD Library is more prone to errors with large images. You’ve probably seen the message “Allowed memory size exhausted” before. That happens because GD’s way of allocating memory isn’t very efficient.
ImageMagick isn’t required for a regular website. But if your site shows off a lot of high-quality images, think photo galleries, event documentation, or photo-heavy news content, ImageMagick is well worth turning on.
Here’s Where the Problem Comes In
When a WordPress admin enables ImageMagick to process images through the Media Library, there’s one detail that easily gets overlooked.
ImageMagick is smart. It can read far more than just JPEG and PNG files. It can also open PostScript, EPS, and PDF files.
Here’s the catch: to open those file types, ImageMagick calls on another program called Ghostscript. And Ghostscript has a bit of a checkered history, it’s been used more than once to run commands it shouldn’t have. This isn’t a new problem either. A similar issue happened before, known as the old “ImageTragick” bug.
This is exactly where the security hole opens up.
ImageMagick determines a file’s type by reading its actual content, not its name. WordPress, meanwhile, mostly trusts the file’s extension.
So picture this. There’s a file called holiday.png. Going by the name, it looks like an ordinary photo. But its actual content is disguised PostScript code.
This file sails right through WordPress’s upload check because its extension says PNG. It then gets passed along to ImageMagick, which reads the actual content, recognizes it as PostScript, and calls Ghostscript to run it.
That mismatch, between what a file claims to be and what it actually is, is the root of the problem.
The Technical Side of the Vulnerability
For those curious about the technical details, here’s the short version.
There’s a core WordPress function called WP_Image_Editor_Imagick::load(). This function decides how an uploaded file gets passed to ImageMagick. Unfortunately, it only checked the file extension, never the actual file content.
As a result, if a file’s content starts with certain byte sequences (essentially the “signatures” of PostScript, EPS, or WordPerfect files), ImageMagick would route it straight to Ghostscript. And Ghostscript would then execute that file as a program, not just render it as an image.
WordPress actually does have a safeguard for this called wp_check_filetype_and_ext(), which normally catches suspicious files like this. The problem is, not every upload path goes through that check.
Two paths that slip past it: uploads via XML-RPC (wp.uploadFile), and the cover-art extraction routine for uploaded MP3 files. Both use a function called wp_upload_bits(), which never checks file content at all. That meant a malicious payload could make it all the way to disk and reach the vulnerable code.
The fix landed in commit 7daaa50. Now, the load() function checks a file’s actual content before creating the Imagick object. Nothing gets passed to the PostScript-family decoder without that check happening first.
How Dangerous Is This for Your Site, Really?
Before you panic, it’s worth understanding who could actually exploit this.
To take advantage of this vulnerability, someone needs upload access, meaning at least an Author-level account or higher. So this isn’t something a random stranger can pull off from the outside.
But think for a moment about who actually holds Author accounts on your site.
If you run your site solo, or with a small team of editors you already know and trust, your risk here is fairly low.
But if you’re running a multi-author publication, a membership site, a client site with outside contributors, or anything with open or loosely managed registration, the standard is a lot lower than it sounds. On sites like these, the possibility of an author uploading a booby-trapped “image” is a real, practical threat, not just a theoretical one.
So What Does This Update Actually Fix?
The core of the WordPress 7.0.4 fix boils down to this: WordPress now checks a file’s actual content before handing it off to ImageMagick.
If a file’s content looks suspicious, it gets rejected outright. Here’s what now gets blocked:
- PostScript and EPS files, identified by their signature (a telltale marker at the start of the file, a binary EPS header, or WordPerfect graphics), by their extension, or by ImageMagick’s own format-specifier prefixes.
- Fake PDFs, meaning files that claim to have a PDF extension but don’t actually start with the
%PDF-marker a real PDF should have. - Compressed files like gzip or bzip2, which ImageMagick could otherwise quietly extract, a sneaky way to smuggle in malicious content.
There’s one more subtle detail worth mentioning. It turns out ImageMagick has a feature that lets you force a specific file handler just by adding a special prefix to the filename. For example, a filename like EPS:innocent.png.
WordPress now detects and checks for prefixes like this. But it’s careful not to mistake something like a Windows drive letter, C:, for one of these prefixes.
This fix also applies to files pulled in from remote URLs, not just files you upload directly from your computer.
Bottom Line
WordPress 7.0.4 might look minor on the surface. But underneath, it’s an important fix for how WordPress handles the image files you upload.
If your site uses ImageMagick, and has more than one person who can upload images, go ahead and update now. Don’t put it off.
No Comments Yet