Ghostscript flaw puts sites that accept PDF uploads at risk

Q: How can I tell whether my server hands PDFs to Ghostscript?

In Media > Library, look at the latest PDF. If you see its first page instead of a generic icon, your server is handing PDFs to Ghostscript. The Ghostscript version shows in Tools > Site Health > Info under Media Handling, but the number alone does not prove the fix is there.

Q: How do I switch off PDF previews in WordPress?

With the fallback_intermediate_image_sizes filter returning an empty list through __return_empty_array, saved as a file in wp-content/mu-plugins. WordPress then never opens PDFs with Imagick, so Ghostscript never starts. The filter applies to new uploads and does not stop a plugin that processes PDFs on its own, and deleting the file brings the previews back.

# TagsSecurityWordPressHosting

The WPhost team13 Oct 20267 min read

On 12 October 2026 Wordfence published details of a critical vulnerability (CVE-2026-39919) in Ghostscript, the program many servers use to turn PDF files into images. A PDF with a specially crafted JPEG 2000 image makes Ghostscript write data past the memory set aside for it, which can lead to code running on the server. Artifex, the company behind Ghostscript, fixed it in version 10.08.0 on 8 September, and earlier versions are affected. The CVE record rates the flaw 9.8 out of 10 on CVSS.

How the Ghostscript vulnerability reaches WordPress

Since version 4.7, WordPress can show an image of a PDF's first page in the Media Library. It makes the image through the Imagick PHP extension, which hands the file to ImageMagick, and ImageMagick starts Ghostscript. If any link in that chain is missing on the server, WordPress saves the file without a preview.

During a security review of WordPress 7.1, Wordfence ran code on a test site by uploading a PDF through a form plugin, without logging in. Its test files only work with the exact Ghostscript package they were built for, which Wordfence says makes an attack harder but not harmless, especially on hosting where many sites share one package. It has found no public evidence of attacks so far.

Is your site affected?

Wordfence says an attack needs all four of these at once:

a visitor or a user with limited permissions can upload a PDF;
something on the site then makes a preview or thumbnail of it;
the server has Imagick or another program that starts Ghostscript;
the installed Ghostscript does not have the fix.

By default, WordPress lets administrators, editors and authors upload files, and WooCommerce adds shop managers, but not customers. If a form only saves the attached file to disk, the file never reaches Ghostscript. If it adds the file to the Media Library, it can.

In Media > Library, look at the latest PDF. If you see its first page instead of a generic icon, your server is handing PDFs to Ghostscript. The Ghostscript version shows in Tools > Site Health > Info under Media Handling, but the number does not prove the fix is there. Distributions often add the fix to an older version without changing its number.

On shared hosting, ask your host whether the ghostscript package includes the fix for CVE-2026-39919. On your own server or a VPS, check the full package version with the command for your system.

Bash

# SSH or Terminal on the server, read-only
# Debian and Ubuntu
dpkg -s ghostscript | grep '^Version'
# RHEL, AlmaLinux and related systems
rpm -q ghostscript

The package should match the table or be newer.

System	Fixed in package
Debian 13	`10.05.1~dfsg-1+deb13u2`
Debian 12	None as of this article
Ubuntu 26.04	`10.06.0~dfsg-3ubuntu1.1`
Ubuntu 24.04	`10.02.1~dfsg1-0ubuntu7.9`
Ubuntu 22.04	`9.55.0~dfsg1-0ubuntu5.14`
RHEL and AlmaLinux 10	`10.02.1-16.el10_2.1`
RHEL and AlmaLinux 9	`9.54.0-19.el9_8.1`
RHEL and AlmaLinux 8	`9.27-18.el8_10`

What to do

Ask whoever runs the server to update Ghostscript. No WordPress or plugin update brings the fix, because Ghostscript is part of the operating system. On shared hosting only your host can update the package.
Until then, stop PDFs from visitors and accounts with limited permissions. Temporarily switch off PDF attachments in forms that add files to the Media Library, and review which accounts can upload files.
Debian 12 has no fix yet. There, the server's administrator can block PDF reading in ImageMagick's security policy.
If you do not need PDF previews, switch them off with the WordPress filter fallback_intermediate_image_sizes.

When the filter returns an empty list, WordPress never opens the PDF with Imagick, so Ghostscript never starts. WordPress loads files in wp-content/mu-plugins automatically, so save the code as a file there, for example with cPanel's File Manager, and create the folder first if it is missing.

PHP

<?php
// wp-content/mu-plugins/no-pdf-previews.php
// Stops previews for new PDF uploads.
add_filter(
    'fallback_intermediate_image_sizes',
    '__return_empty_array'
);

The filter applies to new uploads and does not stop a plugin that processes PDFs on its own. To bring the previews back, delete the file. More protective steps are in the guide to securing WordPress.

What we do

On a VPS or your own server, our WordPress maintenance includes system, PHP and database updates, so the fixed Ghostscript arrives once the distribution releases it. Server-only maintenance with security updates is on the pricing page. If you are not sure whether PDFs on your site reach Ghostscript, our audit checks the security and the server and tells you what to fix, in order of importance.

Frequently asked questions

What is CVE-2026-39919 in Ghostscript?

A critical vulnerability in Ghostscript, the program many servers use to turn PDF files into images. A PDF with a specially crafted JPEG 2000 image makes Ghostscript write data past the memory set aside for it, which can lead to code running on the server. The CVE record rates it 9.8 out of 10 on CVSS, and Wordfence published the details on 12 October 2026.

Which Ghostscript version fixes the vulnerability?

Artifex, the company behind Ghostscript, fixed it in version 10.08.0 on 8 September 2026, and earlier versions are affected. Linux distributions often add the fix to an older version without changing its number, so look at the full package version for your system.

How does the Ghostscript flaw reach WordPress?

Since version 4.7, WordPress shows an image of a PDF's first page in the Media Library. To make it, WordPress passes the file through the Imagick PHP extension to ImageMagick, and ImageMagick starts Ghostscript. If any link in that chain is missing on the server, WordPress saves the file without a preview.

How can I tell whether my server hands PDFs to Ghostscript?

Is my site affected if only administrators upload files?

According to Wordfence, an attack needs four conditions at once, and the first is that a visitor or a user with limited permissions can upload a PDF. By default WordPress lets administrators, editors and authors upload, and WooCommerce adds shop managers but not customers. A form that only saves the attachment to disk keeps it away from Ghostscript, while one that adds it to the Media Library does not.

Does checking the file type protect against the Ghostscript flaw?

No. The dangerous PDF is a valid file, and the problem is hidden in the image inside it. So a file type check does not stop the attack.

Can I update Ghostscript myself on shared hosting?

No. Ghostscript is part of the operating system, so no WordPress or plugin update brings the fix. On shared hosting only your host can update the package, so ask whether the ghostscript package includes the fix for CVE-2026-39919. On your own server or a VPS, dpkg -s ghostscript on Debian and Ubuntu or rpm -q ghostscript on RHEL and AlmaLinux shows the full version.

How do I switch off PDF previews in WordPress?

With the fallback_intermediate_image_sizes filter returning an empty list through __return_empty_array, saved as a file in wp-content/mu-plugins. WordPress then never opens PDFs with Imagick, so Ghostscript never starts. The filter applies to new uploads and does not stop a plugin that processes PDFs on its own, and deleting the file brings the previews back.

Sources