WordPress 7.0.4 has been released, addressing a critical security patch that closes a remote code execution vulnerability impacting sites utilizing the Imagick extension and Ghostscript for image processing This article explores file disguised image. . The WordPress team strongly recommends site owners to update immediately via the Dashboard’s Updates section or by downloading the latest version directly from WordPress.org.
Since automatic background updates are enabled on many sites, users should have received this security fix already. This meant that a seemingly innocuous filename like holiday.png could actually contain PostScript code, bypassing upload checks and being handed to Imagick, which would recognize it as embedded PostScript and execute it through Ghostscript.
It now scans the first chunk of every uploaded file and blocks PostScript or EPS signatures, fake PDFs without genuine %PDF- headers, and compressed files like gzip or bzip2 that ImageMagick would unpack silently. The patch also closes another sneaky trick where attackers could prefix filenames with format specifiers like EPS:innocent.png to force the dangerous decoder; it strips and validates these prefixes while avoiding false positives on Windows drive letters and carefully scrutinizing remote URLs and streams for filename discrepancies. Multi-author publications, membership platforms, and client sites with open or loosely controlled contributor access are at genuine risk due to any author attempting to upload a malicious file disguised as an image.
