Nexcess Status

Investigating: A security vulnerability, CVE-2026-65640, has been identified in WordPress that could allow an authenticated Author-level or higher user to achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript.

The vulnerability has been addressed through updates across supported WordPress branches.

Patched Versions:

Customers should update to the following patched version for their respective WordPress branch: 7.0.4 6.9.7 6.8.8 6.7.7 6.6.7 6.5.10 6.4.10 6.3.10 6.2.11 6.1.12 6.0.14 5.9.16 5.8.15 5.7.17 5.6.19 5.5.20 5.4.21 5.3.23 5.2.26 5.1.24 5.0.27 4.9.31 4.8.30 4.7.35

Recommended Action:

Customers are strongly encouraged to update WordPress core to the latest available patched version and ensure automatic updates are enabled where appropriate.

Customers with automatic updates enabled should receive the applicable update automatically. However, we recommend verifying the currently running WordPress version to ensure the security update has been successfully applied.

We will continue to monitor the situation and provide further updates if required.

If you need assistance or have any concerns, please reach us via live chat or via a case.

Additional information: https://wordpress.org/news/2026/08/wordpress-7-0-4-release/ https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w

Resolved: We have completed our review of this issue and are closing this incident.

The root cause was identified as a compatibility issue within the WP Rocket plugin following the WordPress 7.1 update. WP Rocket has released a fix, and customers can resolve the issue by updating the plugin to version 3.23.2.2 or later.

As this involves a third-party plugin, we are not performing automated plugin updates across customer environments. However, we conducted a fleet-wide review to identify customers using affected WP Rocket versions and proactively communicated the issue, available fix, and recommended actions to those customers.

Customers who continue to experience issues can contact our Support team for assistance with disabling the plugin or for guidance on updating WP Rocket to a fixed version.

No further actions are pending from our side, and this incident is now considered closed.

Investigating: We are aware of an issue affecting some WordPress websites using the WP Rocket plugin following the WordPress 7.1 update. This may result in website interruptions or fatal errors.

Resolution: WP Rocket has released a fix in version 3.23.2.2.

If your website is affected, please update the WP Rocket plugin to version 3.23.2.2 or later. If you are unable to update the plugin, WP Rocket has also provided temporary workarounds in their documentation:

https://docs.wp-rocket.me/article/1927-fatal-error-on-wordpress-7-1

We will provide additional updates as more information becomes available.

If you have any questions or concerns, please don't hesitate to contact us via live chat or by opening a support case.