This CVE reveals that WordPress has been routing Postscript files through its Imagick image processing dependency without accounting for the Ghostscript interpreter that Imagick can invoke. The result is a remote code execution path available to any user with upload_files capability — a privilege level WordPress treats as low-risk but which, in this context, grants server-level control.
The vulnerability has been backported to WordPress 4.7, indicating the vulnerable processing chain has existed for at least eight years. This is not a regression in the conventional sense. It is an architectural gap: WordPress validates uploads at the MIME type and extension layer, then hands the file to an external processor operating under a fundamentally different trust model. The attack surface is invisible from code review alone — you must understand the full image processing stack composition to know whether Ghostscript is in the chain. Most WordPress deployments have no explicit policy rejecting Postscript at the Imagick level, leaving this path open by default.
The privilege escalation vector is the critical blast radius. The Author role, commonly granted to guest bloggers, contributors, and community members, is sufficient to achieve full server compromise through this vector. WordPress has historically treated upload_files as a trust boundary rather than a security boundary, an assumption this CVE invalidates. The capability model needs explicit reconsideration — upload capability should be treated as server-execution equivalent, not as a contained privilege.
For defenders: verify whether your Imagick installation has Ghostscript delegates enabled (convert -list configure will show DELEGATES). If Postscript is listed, you have the vulnerable chain. Restrict upload_files to Administrator-level roles only. Add explicit rejection of .ps and .eps extensions in your upload handler before Imagick processes them. Consider adding Imagick security policies that disable PS/EPS coders entirely. Audit your server configuration now — this is not a plugin issue, it's a core architecture issue that exists in the gap between how WordPress validates uploads and how downstream processors interpret them.
The sediment problem is real: sites that processed Postscript files before this patch may have compromised artifacts on disk, in backups, or in cached processing outputs. Patching the current codebase does not remediate what already exists in the system history. If you cannot confirm your processing chain was safe in prior years, treat any legacy content as potentially compromised and investigate accordingly.