WordPress 7.0.4 Security Release: A High-Severity RCE Fix You Should Not Sit On
WordPress 7.0.4 is out, and unlike routine maintenance drops, this one carries a security fix the project wants applied immediately. The patch addresses CVE-2026-65640, a high-severity vulnerability scored 8.8 on the CVSS scale, which allows remote code execution through a malicious Postscript file uploaded by a user with Author-level privileges or higher. In plain terms: an attacker holding even a modest publishing account could potentially execute code on your web server — the worst-case category of bug for anyone running production workloads. The update is live now via Dashboard → Updates or direct download from WordPress.org. Below we break down what the flaw means for your infrastructure, how to patch without breaking anything, and what to harden while you’re already in the admin.
What CVE-2026-65640 Means for Your Server
A CVSS score of 8.8 puts this firmly in “drop everything” territory. The attack chain described in the disclosure hinges on file uploads: an authenticated user at Author level or above can upload a crafted Postscript file that leads to remote code execution. Postscript is one of those formats that looks innocuous in a media library but is capable of embedding executable instructions, which is precisely why upload validation and MIME-type handling matter so much on shared infrastructure.
Operationally, RCE on a WordPress box rarely stays contained. Once arbitrary code runs under your web server user, an attacker can read wp-config.php and harvest database credentials, plant spam or phishing pages, inject malware into theme files, or — on lightly isolated shared hosting — probe neighboring accounts. For agencies and multisite operators, one compromised install can quickly become dozens.
Related ServerSpan guide: Best WordPress Hosting Tips for You: Optimizing Performance, Security, and User Experience.
Two caveats worth stating honestly. First, the official announcement does not detail whether the flaw has been exploited in the wild, so treat patching as urgent precaution rather than confirmed incident response. Second, the release notes do not enumerate every affected version branch; the safe operating assumption is that any site not yet running 7.0.4 should be treated as exposed until it is.
Updating to 7.0.4 Without Breaking Your Site
There are four realistic update paths, and the right one depends on how much control you hold over the stack:
- Dashboard update: Log in, go to Dashboard → Updates, click Update Now. Fastest route for most single-site owners.
- Manual install: Download 7.0.4 from WordPress.org and replace core files over SFTP — useful when dashboard updates fail on locked-down or permission-restricted servers.
- WP-CLI: Run
wp core update, thenwp core verify-checksumsto confirm file integrity afterward. The cleanest option for fleets of sites and agency maintenance contracts. - Automatic background updates: Consistent with how WordPress handles minor releases, sites that support automatic background updates will typically receive this patch without manual intervention. Check your current version via the admin dashboard or
wp core versionrather than assuming.
Whichever path you choose, back up first — full files plus database, not just a database export. If you’re on a VPS or cloud instance, take a snapshot; if your managed host offers one-click staging, clone the site and run the update there first, especially if you’re carrying older plugins with known compatibility quirks. A broken update costs far less when recovery is a restore button instead of a rebuild. And once you’ve patched, spot-check permalinks, forms, and checkout flows before declaring victory.
Author Accounts Are the Real Perimeter Here
The uncomfortable part of this CVE is its prerequisite: the attacker needs an existing account with Author capabilities or higher. That shifts the question from “is my software patched?” to “who can publish on my site?” Every dormant freelancer login, every ex-contractor, every contributor who reused a breached password elsewhere is now part of your threat model.
Start with a role audit. Remove inactive users outright, downgrade anyone who doesn’t genuinely need publishing rights, and disable open registration under Settings → General if you’re not actively using it. Review what the Author role can upload on your configuration, and consider plugins or filters that restrict allowed file types for lower-tier roles.
Authentication hardening deserves equal attention — but patch your 2FA stack before trusting it. Researchers recently disclosed CVE-2026-14204 in the widely used Google Authenticator WordPress plugin: a cross-site request forgery bug, scored 6.5, that lets an attacker overwrite a logged-in user’s two-factor secret without ever stealing their password. Every release before version 0.56 is affected. If two-factor authentication is part of your baseline — and it should be — verify the installed version today, force affected users to re-enroll after updating, and extend the same scrutiny to any other security plugin you rely on.
Core Fixes Are Only Half the Job: Plugins Remain the Bigger Risk
It’s tempting to treat a core security release as the whole story, but the surrounding landscape argues otherwise. In the same window, The Hacker News reported on an Elementor Pro flaw that could allow unauthenticated attackers to upload PHP files and execute code — no account required at all. Compare that to CVE-2026-65640, which at least demands an Author login, and the pattern is clear: third-party components routinely widen the attack surface faster than core closes it.
For hosting buyers, this reframes what “good hosting” means in 2026. Uptime SLAs and latency numbers matter, but so do the less glamorous features: automatic core and plugin update policies, staging environments included in the plan, daily backups with tested restores, per-site isolation on shared platforms, integrated malware scanning, and a WAF you can actually configure. When comparing providers, ask specifically how they handle emergency security releases — a host that pushes core patches within hours and documents the process is worth more than marginally cheaper renewals.
For a more detailed walkthrough of this part of the topic, read How to Fix Persistent Malware Issues in WordPress on Shared Hosting.
Going forward, watch the WordPress News feed for follow-up point releases, keep plugin changelogs on your reading list, and schedule a monthly pass over users, plugins, and backup integrity. Security here isn’t a single patch; it’s a cadence.
Key Takeaways:
- Update to WordPress 7.0.4 immediately — via Dashboard → Updates, WordPress.org, or WP-CLI.
- Back up files and database (or snapshot your VPS) before applying the update.
- Confirm whether automatic background updates already patched your sites; verify the version number.
- Audit all Author-level and higher accounts; remove stale users and disable open registration if unused.
- Check your 2FA plugin versions — Google Authenticator must be at 0.56+ (CVE-2026-14204).
- Update plugins like Elementor Pro promptly; unauthenticated flaws exist outside core.
- Evaluate your host on patch speed, staging, backups, and isolation — not just price.
The bottom line: WordPress 7.0.4 closes a genuinely serious hole, but only on the sites that actually install it. Patch today, audit the humans and plugins around your core, and treat this as a reminder that your real security posture lives in the layers — hosting platform, authentication, and update discipline — not in any single version number.