Overview
WordPress 7.0.4 is a security-focused maintenance release for the WordPress 7.0 branch. There are no new editor tools, dashboard changes, or design features in this update. The goal is straightforward: close a serious vulnerability in WordPress core that could allow an authenticated user with Author‑level access (or higher) to upload a malicious file and execute code on a vulnerable server.
The WordPress 7.0 series is known as “Armstrong,” named after Louis Armstrong, the jazz icon most people recognize from “What a Wonderful World.” WordPress names major releases after influential jazz musicians as a nod to creativity and collaboration in the open‑source community.
Version 7.0.4 is a maintenance and security release, meaning it’s designed to strengthen the existing version of WordPress rather than introduce new features. In this case, the update is almost entirely about security, and website owners should treat it as a priority.
Release Date
WordPress 7.0.4 was released on August 12, 2026, arriving just days after 7.0.3. The quick turnaround is a reminder that WordPress maintenance isn’t a “set it and forget it” task. New vulnerabilities surface, and keeping a site secure requires a consistent process for updates, backups, user‑access reviews, and testing.
New Features
There are no new user-facing features in WordPress 7.0.4.
Nothing changes in the Block Editor, Site Editor, themes, media library, navigation tools, or front‑end experience. For most website owners, that’s ideal as the update is narrow in scope and designed to protect your site without disrupting your workflow.
Bugs Fixed
WordPress 7.0.4 fixes one critical vulnerability in WordPress core.
The issue involves authenticated remote code execution through a malicious file upload on sites that use both ImageMagick and Ghostscript. An Author‑level user (or higher) could upload a specially crafted file that triggers code execution on the server.
Remote code execution is one of the most serious types of vulnerabilities because it can potentially allow an attacker to:
- Modify or replace files
- Add malicious code
- Access sensitive data
- Create unauthorized accounts
- Disrupt website functionality
- Use the server for harmful activity
This vulnerability requires the attacker to have a WordPress login with Author permissions or above. That makes it especially relevant for websites with multiple users, such as:
- Membership sites
- Ecommerce stores with staff accounts
- Online course platforms
- Publishing and news sites
- Multisite networks
- Community websites
- Sites using guest authors or freelancers
- Organizations with former staff or vendors who may still have access
Single‑admin sites may have lower exposure, but they’re not immune. Accounts can be compromised through weak passwords, phishing, password reuse, or simply forgetting to remove old users.
Security Fixes and Patches
WordPress 7.0.4 includes one security patch, identified as CVE‑2026‑65640.
This vulnerability affects sites where WordPress is configured to use ImageMagick and Ghostscript for image or document processing. These tools are commonly used to resize images, generate thumbnails, or process PDFs — all normal parts of WordPress workflows.
Because file uploads are routine for many websites, a vulnerability in this area can quickly become a serious risk. Authors may upload images, PDFs, course materials, marketing assets, or downloadable resources. If the server environment is vulnerable, a malicious upload could turn a routine task into a security threat.
The fix has also been backported to older supported WordPress branches (down to WordPress 4.7) and prepared for the upcoming WordPress 7.1 release candidate. Even so, only the current WordPress version receives full support, so older sites should still plan to upgrade.
Why This Matters for Business Websites
A website compromise affects far more than the website itself. It can interrupt lead generation, expose customer information, damage search visibility, disrupt ecommerce operations, interfere with course delivery, and reduce visitor trust.
Potential consequences include:
- Malicious redirects
- Spam content that harms SEO
- Unauthorized admin accounts
- Malware warnings in search results or browsers
- Lost leads from broken forms or email issues
- Interrupted checkout or payment processing
- Inaccessible member or student resources
- Emergency cleanup costs and downtime
Security updates are one of the simplest ways to reduce these risks. The goal isn’t to update for the sake of updating — it’s to keep your website reliable, secure, and aligned with the technology it depends on.
Recommended Update Checklist
Before installing WordPress 7.0.4, take a few precautions:
- Confirm you have a recent, restorable backup of both files and the database
- Store the backup somewhere separate from your hosting account
- Review WordPress users and remove inactive accounts
- Ensure Author‑level access is only assigned to people who truly need it
- Check whether ImageMagick and Ghostscript are active in your hosting environment
- Update critical plugins and themes if compatible versions are available
- Test the update on a staging site before applying it to a mission‑critical live site
- Verify key website functions after updating (forms, login, search, checkout, payments, registration, member access, course enrollment, transactional email)
- Clear website, server, and CDN caches if needed
If your site accepts frequent uploads from authors, customers, students, or staff, it’s also smart to review file‑upload practices, enforce strong passwords, enable multi‑factor authentication, and remove accounts promptly when access is no longer needed.
Should You Upgrade?
Yes. If your site runs WordPress 7.0, updating to 7.0.4 should be a priority, especially if your hosting environment uses ImageMagick and Ghostscript.
This is a security release, not a feature release. While backups and testing still matter, delaying the update leaves a known vulnerability unpatched.
Pros of Updating
- Fixes a serious remote code execution vulnerability
- Reduces risk from malicious file uploads
- Helps protect customer data, user accounts, and business operations
- Strengthens your overall security posture
- Keeps your site aligned with supported WordPress core software
- Reduces the risk of malware, downtime, and emergency remediation
Cons of Updating
- Custom themes and plugins should still be tested
- Complex ecommerce, membership, or LMS sites may need more thorough review
- Sites without verified backups carry unnecessary risk
- Older or abandoned plugins may reveal compatibility issues
For mission‑critical websites, test WordPress 7.0.4 on a staging site before updating the live site. A staging environment helps you catch plugin conflicts, theme issues, caching problems, payment disruptions, login errors, or integration failures before they affect visitors.
Unlike major WordPress releases, this isn’t one you wait on. Because 7.0.4 addresses a significant security issue, the best approach is to test promptly and update as soon as your quality‑control process allows.
Summary
WordPress 7.0.4 is a focused security update that closes a serious vulnerability and strengthens the stability of the WordPress 7.0 branch. If your business relies on WordPress for leads, sales, membership, learning, or content delivery, staying current is one of the easiest ways to reduce risk and keep your site running smoothly.
If you’re unsure about timing or want help reviewing your setup, we can help with plugin and theme compatibility checks, staging‑site testing, and building a dependable maintenance plan. If you’d like guidance on when and how to upgrade, you’re welcome to schedule a complimentary consultation.
