All vulnerabilities

WordPress core

CVE-2026-65640

Remote code execution vulnerability via malicious file upload by an Author level user or higher

Severity: High 8.8
Published: 12 Aug 2026
Last changed: 12 Aug 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 6.5.10, 6.6.7, 6.7.7, 6.8.8, 6.9.7, 7.0.4
Also known as: GHSA-8vr3-7mxf-gx8w
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

From 7.0.0 before 7.0.4
From 6.9.0 before 6.9.7
From 6.8.0 before 6.8.8
From 6.7.0 before 6.7.7

All 24 release lines

From 4.7.0 before 4.7.35
From 4.8.0 before 4.8.30
From 4.9.0 before 4.9.31
From 5.0.0 before 5.0.27
From 5.1.0 before 5.1.24
From 5.2.0 before 5.2.26
From 5.3.0 before 5.3.23
From 5.4.0 before 5.4.21
From 5.5.0 before 5.5.20
From 5.6.0 before 5.6.19
From 5.7.0 before 5.7.17
From 5.8.0 before 5.8.15
From 5.9.0 before 5.9.16
From 6.0.0 before 6.0.14
From 6.1.0 before 6.1.12
From 6.2.0 before 6.2.11
From 6.3.0 before 6.3.10
From 6.4.0 before 6.4.10
From 6.5.0 before 6.5.10
From 6.6.0 before 6.6.7
From 6.7.0 before 6.7.7
From 6.8.0 before 6.8.8
From 6.9.0 before 6.9.7
From 7.0.0 before 7.0.4

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-65640
GitHub Advisory Database https://github.com/advisories/GHSA-8vr3-7mxf-gx8w
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w