Ghostscript Vulnerability and PDF Uploads: Check Today

If your website lets people upload a resume, a quote request or a photo of their project, a headline about a PDF taking over a server is hard to ignore. A Ghostscript vulnerability can reach a WordPress PDF upload, but only when several things are true at once, and you can check them in an evening.

Start with three moves. List every form on your site that accepts a file. Ask your host one question about the server's Ghostscript package. Then update WordPress, because a separate flaw in WordPress itself was fixed back in August.

You do not need to shut down your careers page tonight. You do need to know which of your forms hand a file to the server, and whether anyone has confirmed the fix.

Check your upload forms tonight so you know where you stand

The first job takes about ten minutes and needs no technical tools. Open your site in a private browser window and click through every page that could take a file. Write down what you find, because the answers decide how urgent the rest is.

For each upload, note who can submit it, which file types it accepts, and where the file goes afterward. Also note whether anyone on your team sees a preview or thumbnail of it. A thumbnail means software opened the file, and that is the step that matters here.

Common places to look:

• A careers or job application page that takes resumes
• A quote or estimate form that takes plans, photos or documents
• A contact form with an attach-a-file field
• Warranty, repair or service-request forms
• A customer portal, membership page or vendor application
• Any embedded form from another service
• WordPress user accounts at Author level or higher, which can upload to the Media Library

Put the list somewhere you can find it again. Every later step in this post refers back to it, and the next time a headline like this appears, you will start from a finished inventory instead of a blank page.

Two separate flaws are in the news, and each has its own fix

Headlines have blended two records into one story, so it helps to separate them. They share a setup: both involve a server that uses Imagick and Ghostscript to handle files. They differ in who must get a file in, and in who applies the fix.

The Ghostscript record, CVE-2026-39919 on NVD, describes a crafted PDF that carries a JPEG 2000 image with mismatched subsampling factors. NVD lists a 9.8 Critical score from VulnCheck. Artifex lists the fix in its Ghostscript vulnerability table and shows 10.08.0 as the current release.

The WordPress record, CVE-2026-65640 on NVD, says it affects all versions below 7.0.4 and that the fix was backported to branches as far back as 4.7. The WordPress 7.0.4 announcement calls it a security release and recommends updating immediately.

Exposure takes two things at once, so a stored file is not the same as a risk

WordPress has made PDF previews since version 4.7, as long as the server supports them. The WordPress core team explained the chain: WordPress asks Imagick, Imagick works through ImageMagick, and ImageMagick hands the PDF to Ghostscript. A flaw in the last link only matters if a file actually reaches it.

That gives you two questions. First, can someone get a file onto your server and into that chain? For the WordPress flaw, the answer depends on who holds an Author-level account or higher. For the Ghostscript flaw, it depends on which forms, plugins or integrations pass a visitor's file along for a preview or conversion.

Second, is the Ghostscript on your server fixed? That one is your host's call, not yours, and it is the reason the next section exists.

Security researchers at Wordfence wrote up the Ghostscript problem in October and showed code execution on a purpose-built WordPress site. That demonstration shows the risk is real for a server that is set up that way. It does not say every site with a form is exposed. A form that stores a PDF and never opens it does not start this path.

One question to your host gets you a clear answer

Ghostscript usually comes with the operating system or the hosting plan, not with WordPress, so updating WordPress or a form plugin will not fix the Ghostscript flaw. On managed or shared hosting, the host decides when the package changes. Send them a short message and ask for a written reply.

Paste these three questions into your message:

• Does the Ghostscript package on my server include the fix for CVE-2026-39919?
• Which package revision is installed, and has the service been restarted or the server redeployed since the update?
• Does my site's PDF preview or image processing call Ghostscript?

Do not judge the answer by a version number alone. A server can show a number below 10.08.0 and still be fixed, because Linux distributions often copy a security fix into an older release. A host that cannot say which package revision it runs has not answered the question yet. If you run your own server or container, update the package or rebuild from an updated base image.

Our post on checking your WordPress host for image library flaws has more questions that work for this and the next time a headline like this appears.

Pause or narrow uploads until the fix is confirmed

If the host cannot confirm the fix quickly, reduce what reaches the server. The smallest safe move is to stop accepting PDFs from visitors until you hear back. Form settings usually let you change the allowed file types in a setting, which takes a minute and can be undone.

If you need to keep taking documents, these steps lower the exposure while you wait:

• Limit each form to the file types you truly need
• Set a small file count and size per submission
• Add a rate limit or spam control to the form
• Remove Author-level and higher WordPress accounts that nobody uses
• Ask the host or developer about ImageMagick's security policy, which lets an administrator turn off specific formats such as PDF

That last step stops PDF previews entirely, so test your forms afterward. A check that a file ends in .pdf only tells you the file says it is a PDF, so it is not a substitute for the server fix.

Update WordPress and your form plugins, then test an upload

Open your WordPress Dashboard, go to Updates, and install the current WordPress release. The 7.0.4 announcement notes that only the most recent version of WordPress is actively supported, so staying current is how you pick up fixes like this one without hunting for a backport. Back up first, so you can return to the working version if something clashes.

Then update the plugins that handle your uploads. A form add-on that accepts files can have its own flaws, separate from Ghostscript. If you use Ninja Forms with the File Uploads add-on, our post on the Ninja Forms vulnerability shows how to check each version.

Finally, send a test. Submit a harmless PDF through each form from a phone and from a computer, then confirm the notification email arrives and the file opens for your team. If a preview used to appear and now does not, you will know whether a setting changed. The short update on this flaw inside our guide to a WordPress plugin vulnerability warning is the quick version; this page is the longer checklist.

Know when a security review is worth paying for

You can handle a lot of this yourself, and the host's reply may settle it. A review earns its cost when the answers stay unclear after you have asked. Signs that point that way:

• Several vendors touch the site, and nobody knows who patches what
• The site runs on a server or container you manage, not a host that handles updates
• You collect sensitive documents, such as financial, medical or legal files
• Files are forwarded to a CRM, a help desk or a converter
• Your host cannot say which Ghostscript package it runs

Also watch for signs of a problem that has already happened: administrator accounts you do not recognize, files in the uploads folder that nobody added, or pages that changed on their own. If you see any, follow the steps in what to do in the first 24 hours after a hack before anything else.

If you would rather have someone else keep up with server and plugin updates, website maintenance covers that routine, so a headline like this one becomes a short check and not a scramble.

A site with no plugins to patch gives you a shorter list

Some owners read a security headline like this and decide they would rather carry fewer parts. Web Leveling builds sites without third-party plugins, with code and accounts in the owner's name. A form on that kind of site can be built to accept only the file types you name, in the size you set.

That gives you fewer components to track, and fewer plugin updates to chase. It does not remove the need to patch the server, and a site that takes uploads still needs a host that keeps its software current. If your current site works and your host answers the question above, you do not need to rebuild because of one CVE. Choose on how much maintenance you want to carry.

Frequently Asked Questions About ghostscript vulnerability wordpress pdf upload

Can a PDF hack my website?

A crafted PDF can exploit an unfixed copy of Ghostscript if the file reaches it. That takes an upload path and software on the server that opens the file. A PDF that sits in storage unopened does not start it.

Does updating WordPress fix the Ghostscript flaw?

No. Ghostscript is server software, so the fix for CVE-2026-39919 comes through your host or server administrator. Updating WordPress does fix the separate core flaw, CVE-2026-65640, in version 7.0.4 and later.

Which version of Ghostscript is fixed?

Artifex lists the fix in Ghostscript 10.08.0, released September 8, 2026. Some hosts carry the fix in an older-numbered package, so ask for the package revision and not only the version.

Does my resume or quote form put me at risk?

It does if the file is later previewed, thumbnailed or converted by software that calls Ghostscript on a server without the fix. List your forms and ask your host. A form that only stores the file does not start that path.

Who can upload files that reach the WordPress flaw?

The NVD record says a user with the upload_files capability, Author level or higher. Review who has those accounts and remove any you do not need.

Is it safe to turn off PDF previews?

It is safe, and it removes one route to Ghostscript. You lose the preview image, so test your forms afterward and check that your team can still open the files.

Wrapping Up

Two separate flaws sit behind this headline. One is in Ghostscript and is fixed in version 10.08.0 or a host's equivalent package. The other was in WordPress core and was fixed in 7.0.4 on August 12, 2026. Your site is only in the path if a file can reach the server and get opened there.

Your checklist is short: list the forms that take files, ask your host one question, update WordPress and your form plugins, and pause visitor PDF uploads until someone confirms the Ghostscript fix. Done in that order, the risk drops quickly, and you will know exactly what to check the next time a headline like this appears.

If you want a second set of eyes on your forms and your server, Web Leveling can run a website security audit that traces each upload from the form to the server and tells you what needs changing. Contact us to talk it through in plain terms. We work with small and medium businesses across the country and overseas.

Terms