CVE-2026-65640
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-65640
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-65640
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65640
请登录查看更多情报信息。
Vendor Pages for CVE-2026-65640 (1)
IV. Related Vulnerabilities
Same product: WordPress
- CVE-2026-64638
WordPress 跨站脚本漏洞 - CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL i - CVE-2026-60137
WordPress < 7.0.2 - Facilitated SQL Injection via author__no - CVE-2026-3906
WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticat - CVE-2025-58674
WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vu
Same vendor: WordPress
- CVE-2026-64638
WordPress 跨站脚本漏洞 - CVE-2026-45293
WordPress Coding Standards (WordPressCS) contains an arbitra - CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL i - CVE-2026-60137
WordPress < 7.0.2 - Facilitated SQL Injection via author__no - CVE-2020-37233
WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scri
Same weakness: CWE-434
- CVE-2026-73373
Joomla! Core - [20260810] - Unrestricted uploads of SHTML fi - CVE-2026-73996
WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File U - CVE-2026-66627
WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload - CVE-2026-32474
WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload - CVE-2026-32463
WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitr
V. Comments for CVE-2026-65640
No comments yet