Homepage

CVE-2026-65640 Affecting wordpress-7-oci-entrypoint package, versions <7.0.4-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
1.94% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-WORDPRESS7OCIENTRYPOINT-19204243
  • published23 Aug 2026
  • disclosed17 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 17 Aug 2026

CVE-2026-65640  (opens in a new tab)

How to fix?

Upgrade Minimos:latest wordpress-7-oci-entrypoint to version 7.0.4-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream wordpress-7-oci-entrypoint package and not the wordpress-7-oci-entrypoint package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

Prerequisites:

  • Imagick and Ghostscript in use on the server
  • A malicious user with the upload_files capability

This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.