Photo by Deng Xiang on Unsplash
It is often said that code doesn't age like wine; it ages like milk. But in the case of the latest security patch for WordPress, we are looking at something that sat in the back of the refrigerator for ten years before anyone noticed it had turned into a biohazard.
On August 12, the WordPress core team pushed out version 7.0.4. It is a single-issue release, which usually signals that something is significantly broken or particularly dangerous. The culprit is a vulnerability tracked as CVE-2026-65640, a flaw that allows a user with basic author permissions to upload what looks like a standard PNG file but is actually a vehicle for remote code execution. According to reports on the fix, this isn't just a new bug—it is a decade-old oversight that has finally been brought to light.
The technical specifics involve an image masquerading as data that the server eventually decides to execute. While it requires a logged-in user to pull off, the barrier for entry in the modern web—where guest posting and multi-author blogs are the norm—is low enough to cause real headaches for hosters managing millions of installs.
The Reality of Legacy Debt
From where I sit, having spent twenty years watching hosting providers scramble during these "forced update" cycles, this release highlights the fundamental tension in the WordPress ecosystem. We want backward compatibility and stability, but we are building on a foundation that contains artifacts from an era when web security was a much more casual affair. A ten-year-old flaw isn't an indictment of the current core team; it's a reminder of just how much legacy surface area we are all defending.
For hosting companies, these releases are a logistical test. Whether you are running managed services or massive shared environments, the speed at which you can roll out 7.0.4 determines your weekend plans. The risk isn't just a single site being defaced; it's the potential for lateral movement once a server is compromised via an otherwise innocent-looking media library.
I find it mildly poetic that in 2026, we are still being haunted by a file named holiday.png. It’s a bit like finding out your home security system has been unlocked this whole time because the back door was actually made of cardboard, and everyone just assumed it was steel because it was painted grey.
Bottom Line
If you haven't automated your core updates by now, you are essentially volunteering for a crisis. Patch your systems, check your media libraries, and perhaps stop trusting that a file extension tells you anything meaningful about what’s inside.