Authenticated code execution via Ghostscript upload

Remote code execution in WordPress before 7.0.4 allows remote authenticated users to execute code via a malicious PostScript upload. In WP_Image_Editor_Imagick::load(), WordPress chose readImage() or readImageBlob() from the filename extension and let Imagick identify the real format from attacker-controlled bytes, so PostScript disguised as an image was handed to Ghostscript; Patchstack reports XML-RPC wp.uploadFile and MP3 cover-art ingestion could store such files without wp_check_filetype_and_ext() content inspection. Exposure is limited to sites that use Imagick with Ghostscript and grant the upload_files capability, typically Author or higher, and execution occurs in the web server context.