Affected Systems
Ghostscript versions 9.21 through 10.07.1. Affects any application that processes attacker-supplied PDFs through Ghostscript, including WordPress sites using Imagick/ImageMagick for PDF rendering. Tested vulnerable on Debian, Ubuntu, Fedora, Alpine, AlmaLinux, and WordPress Docker images.
Exploitation Status
Proof-of-concept exploits developed and tested by Wordfence researchers. Remote code execution achieved in controlled test environments, though reliability varies by configuration. No in-the-wild exploitation observed as of publication (October 13, 2026).
Business Impact
Attackers with PDF upload capability (anonymous or low-privilege accounts) can potentially execute arbitrary code on servers processing PDFs through Ghostscript. Primary risk to WordPress sites with PDF upload/preview features, document management systems, and any web application rendering user-supplied PDFs. Exploitation requires specific environment conditions and is not reliably weaponized across all configurations, reducing immediate mass-exploitation risk.
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade Ghostscript to version 10.08.0 or later immediately; verify backported patches if running older major versions
- For WordPress: confirm with hosting provider that Ghostscript has been patched; rebuild Docker containers with updated base images if applicable
- If patching is not immediately feasible, disable PDF rendering in ImageMagick policy.xml or block PDF uploads at the application/WAF layer
- Audit applications that process user-uploaded PDFs and confirm they invoke Ghostscript; prioritize patching those with anonymous or low-privilege upload access
- Monitor web application logs for unusual PDF upload activity or failed processing attempts that may indicate exploitation attempts