Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Ghostscript PDF upload hardening guidance for WordPress administrators

Defensive Guidance
First reported
Last updated
Happening score
H score 26
1 unique sources, 1 articles

Summary

Hide ▲

Administrators handling Ghostscript-backed PDF workflows should harden upload and rendering paths because CVE-2026-39919 can enable unauthenticated remote code execution from specially crafted PDFs. The highest-risk exposure is in WordPress thumbnail and preview flows that route files through PHP Imagick and ImageMagick. Operators should move to Ghostscript 10.08.0 or later, or block the PDF-processing path until patching is complete.

Related Happenings

Ghostscript heap buffer overflow RCE (CVE-2026-39919)

Vulnerability
H score29 First: 14.10.2026 00:33 Last: 14.10.2026 00:33 Sources 1

How related: A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.

About this happening: A critical heap buffer overflow in Ghostscript (CVE-2026-39919) can enable remote code execution through specially crafted PDF files. The flaw affects Ghosts...

Open Happening

Artifex security patch release for CVE-2026-39919

Security Patch Release
H score29 First: 14.10.2026 00:33 Last: 14.10.2026 00:33 Sources 1

How related: Artifex, the maintainer of Ghostscript, rolled out a fix on September 8, in version 10.08.0 of the interpreter.

About this happening: Artifex shipped Ghostscript 10.08.0 on September 8, 2026, fixing CVE-2026-39919 and reducing remote-code-execution risk in affected PDF-processing deployments. The rel...

Open Happening

WooCommerce Wholesale Lead Capture actively exploited arbitrary file-upload vulnerability (CVE-2026-27540)

Vulnerability
H score16 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

About this happening: CVE-2026-27540 in the WooCommerce Wholesale Lead Capture WordPress plugin is being actively exploited, putting version 2.0.3.1 and older at risk of PHP webshell...

Open Happening

Elementor Pro 4.2.2 security update for CVE-2026-32475

Security Patch Release
H score27 First: 20.08.2026 09:04 Last: 20.08.2026 09:04 Sources 1

About this happening: Elementor Pro released version 4.2.2 on August 19, 2026 to fix CVE-2026-32475, a critical unauthenticated file-upload RCE in the plugin’s Forms module File U...

Open Happening

Forminator Forms arbitrary file upload flaw (CVE-2026-15748)

Vulnerability
H score18 First: 17.08.2026 21:22 Last: 17.08.2026 21:22 Sources 1

About this happening: CVE-2026-15748 affects Forminator Forms for WordPress, exposing more than 600,000 active installations to unauthenticated arbitrary file upload and potential rem...

Open Happening

Timeline

  1. 14.10.2026 00:33 1 articles · 2h ago

    Wordfence researchers identify CVE-2026-39919 in Ghostscript

    Technical Analysis Update

    Researchers at Wordfence using Argus identified CVE-2026-39919 on August 23 and showed that a specially crafted PDF file could trigger a critical heap buffer overflow in the Ghostscript interpreter and rendering engine, forcing writes beyond a 256-byte buffer and enabling unauthenticated remote code execution.

    Show sources
    Open in new tab
  2. 14.10.2026 00:33 2 articles · 2h ago

    Artifex releases Ghostscript 10.08.0 to fix CVE-2026-39919

    Mitigation Patch Update

    Artifex released Ghostscript 10.08.0 on September 8 to fix CVE-2026-39919, giving affected deployments a patched interpreter and rendering engine version to replace the vulnerable Ghostscript 9.21 through 10.07.1 releases.

    Show sources
    Open in new tab
  3. 14.10.2026 00:33 1 articles · 2h ago

    Wordfence details Ghostscript PDF RCE risk in WordPress workflows

    Initial Disclosure

    Wordfence described how WordPress thumbnail generation can use the PHP Imagimagick extension to call ImageMagick, which launches Ghostscript, warned that the flaw affects online systems running Ghostscript 9.21 through 10.07.1 when payloads are adjusted to the environment, and said it had not seen in-the-wild exploitation of CVE-2026-39919 yet.

    Show sources
    Open in new tab