Wordfence’s Argus research team disclosed a critical CVSS 9.8 vulnerability in Ghostscript — the document engine servers use to convert uploaded PDFs into thumbnails — discovered during a WordPress 7.1 security assessment. The team demonstrated unauthenticated remote code execution, and the official WordPress Docker image snapshot they tested was among the vulnerable builds. The fix ships in Ghostscript 10.08.0 — but this is a system package, not a WordPress plugin, so there is nothing to update from wp-admin. Stock WordPress doesn’t let anonymous visitors upload PDFs, which limits direct attack paths, but any application handing untrusted PDFs to a vulnerable build is exposed.
For site owners, the takeaway is simple: confirm with your host that Ghostscript is patched to 10.08.0 or later, and if you run Docker, rebuild containers from an updated base image following your host’s restart guidance. This is exactly the kind of server-level issue that silent auto-updates never touch.
Our website care plans include server-level security coordination with your host, so vulnerabilities like this don’t slip through the cracks. Learn more at https://qamardigitalventuresllc.com/
Source: Wordfence (October 2026).
