Let's build a website that works as hard as you do.
Get a fast, SEO-ready WordPress website built around your business, not a template.
Most WordPress security news ends the same way: update plugin X. This one doesn’t. On 12 October 2026, Wordfence published details of a critical flaw in Ghostscript, a program many web servers use to turn PDFs into images, and wrote: “There is no WordPress plugin to update.”[1] If the fix is needed, it has to happen on the server, which means it is your host’s job, or yours if you run your own server. We checked every site we look after within hours. Here is what the flaw is, who is exposed, and what we found.
What happened
Ghostscript is a document engine that sits quietly underneath a lot of software. Wordfence found that “A crafted PDF containing a JPEG 2000 image can make Ghostscript write attacker-influenced bytes past the end of a memory buffer”, and turned that into unauthenticated remote code execution on a test WordPress site. The flaw is tracked as CVE-2026-39919, scored 9.8 out of 10, and Artifex fixed it in Ghostscript 10.08.0.[1] The Ghostscript project lists 10.08.0, dated 8 September 2026, as its latest release.[4]
Wordfence also wrote that “we have found no public evidence that it is being exploited today.”[1] So this is a patch-it-now item, not a panic.
Why a WordPress site can be affected
WordPress has made preview images of PDFs since version 4.7. The WordPress core team’s note at the time says this “support is provided through WP_Image_Editor_Imagick and requires Imagick, ImageMagick, and Ghostscript support.”[3] So when a PDF is uploaded, WordPress can ask Imagick, which asks ImageMagick, which runs Ghostscript.
Wordfence lists the conditions plainly. A site can be attacked this way only if all of these are true at once:[1]
- “A visitor, or someone with a low-privileged account, can upload a PDF”
- “Something on your site then asks for a preview or thumbnail of that PDF”
- “Your server has Imagick, or another tool that calls Ghostscript to make that picture”
- “Your installed Ghostscript does not have the fix”
Stock WordPress doesn’t let anonymous visitors upload to the Media Library. The risk comes from upload forms, open registration, membership and job-application plugins, and anything else that lets strangers send you a PDF that then gets processed.
The version number can fool you
Linux distributions usually add security fixes to the version they already ship rather than jumping to the new release. Wordfence warns that “gs –version may not tell you on its own whether you are patched”, and gives Ubuntu 22.04 as the example: fixed in a package that “still reports Ghostscript 9.55.0.”[1] The full package revision is what counts. Ubuntu’s own security tracker lists, for Ubuntu 24.04 LTS, the fix in package 10.02.1~dfsg1-0ubuntu7.9.[2] The same trap came back with PHP on 22 October: a server can install the fixed PHP and keep running the old one until PHP restarts.
What we checked on 13 October
We ran a read-only check on all nine WordPress sites we look after, including our own. It changed nothing. It looked at whether the server can turn PDFs into images, which Ghostscript package is installed, whether visitors can register, and how many PDFs sit in each media library.
| What we checked | Result |
|---|---|
| Sites on servers we run (7 sites, 3 servers) | All on Ubuntu 24.04 with ghostscript 10.02.1~dfsg1-0ubuntu7.9, the package Ubuntu lists as fixed |
| Site on another company’s Ubuntu server (1 site) | Same fixed package, 10.02.1~dfsg1-0ubuntu7.9 |
| PDF previews possible (Imagick can read PDF) | Yes, on all 9 sites |
| Public registration | Off on all 9 sites |
| Site on another company’s non-Ubuntu server (1 site) | Its host blocks the command we use to read the package version, so we couldn’t confirm it from WordPress. No PDFs in its media library, none of the common upload-form plugins we looked for, registration off. Low risk, but only that host can confirm the patch |
Wordfence’s own test of package versions on 15 September lists the earlier Ubuntu 24.04 package, 10.02.1~dfsg1-0ubuntu7.8, as affected.[1] Our servers were already on the fixed revision when we checked. Nobody had to scramble, and no site owner had to know what Ghostscript is.
Our view: this is what “managed” actually means
A WordPress owner on a budget plan can update every plugin and still be exposed to this, because the fix lives below WordPress, on the server. On shared hosting it is the host’s job. On a self-managed VPS it is yours, and most small business owners don’t know Ghostscript exists. This is the gap we wrote about in our guide to managed vs unmanaged hosting: someone has to watch the parts of the server you never see. Two days later came the reverse case: a plugin update that was itself the attack.
What not to do
- Don’t go looking for a WordPress plugin update for this. There isn’t one.
- Don’t trust
gs --versionon its own. Check the full package revision against your distribution’s advisory. - Don’t install random “Ghostscript fix” plugins or download files from people offering to help in comments. Get the fix from your operating system or your host.
- Don’t leave registration open unless your site genuinely needs it.
Check it yourself
- Can strangers send you PDFs? List every form, membership area or plugin on your site that accepts file uploads.
- Is registration open? In WordPress, go to Settings → General and look at “Membership: Anyone can register”. Untick it unless you need it.
- Ask your host one question in writing: “Is the Ghostscript package on my server patched for CVE-2026-39919?” A good host answers with the package revision.
- If you run your own server, Wordfence’s advice is to check the full revision “using dpkg -s ghostscript on Debian and Ubuntu, or rpm -q ghostscript on Fedora and the Red Hat family”, install the fixed package, and follow your vendor’s restart guidance.[1]
Frequently asked questions
Is there a WordPress plugin update for the Ghostscript flaw?
No. Ghostscript is part of the server, not WordPress. The fix comes from your operating system or your hosting provider, as a patched Ghostscript package.
Is my WordPress site at risk from CVE-2026-39919?
Only if someone outside your team can upload a PDF, your site makes a preview of it, your server uses Ghostscript for that, and the installed Ghostscript is not patched. If you are not sure about any of those, ask your host to confirm the package is patched.
How do I know if my host has patched Ghostscript?
Ask for the installed Ghostscript package revision and compare it with your Linux distribution’s security advisory. The plain version number can look old even when the fix is in, because distributions add fixes to the version they already ship.
If you think your site is affected
We are a web design and SEO studio, not a cybersecurity firm, and we don’t offer security investigations or malware clean-up as a service. If you think your site is affected, contact your hosting provider and, for a plugin problem, the plugin’s maker first. If your site may have been hacked, use a specialist security service; the sources listed below explain what they will look for.
What we write here is what we check on the websites we build and host for our own clients. If you are planning a new website, or want a second opinion on your current site’s design and SEO, request a free written review.
References
- Wordfence, “Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server”, 12 October 2026. Accessed 13 October 2026.
- Ubuntu Security, “CVE-2026-39919”. Accessed 13 October 2026.
- Make WordPress Core, “Enhanced PDF Support in WordPress 4.7”. Accessed 13 October 2026.
- Artifex, “Ghostscript releases”. Accessed 13 October 2026.
- Total Web Solutions records: read-only Ghostscript, Imagick, registration and media-library check of the nine WordPress sites we look after, 13 October 2026.
