A malicious image can turn ordinary publishing access into a deeper server compromise.
Security firm Fortbridge demonstrated an attack that uses a crafted HEIC file uploaded through WordPress to trigger remote code execution on certain servers. Successful exploitation lets an attacker run commands under the web server account.
The attack targets server-side image processing during the upload. Updating WordPress alone does not fix the vulnerable library; administrators need the operating system or hosting provider’s security update.
The malicious file reaches image software on the server
After an HEIC file is uploaded, the server may hand it to libheif, a library used to read the image format. A specially prepared image can trigger a memory error that lets data be written where it should not.
Investigators paired that flaw with a second bug that exposed details about the server through image copies created during processing. They used those details to prepare another HEIC file for the same setup and run a harmless command, confirming that the attack could reach code execution.
Testing covered Ubuntu 26.04 and Debian 13. The attack worked in 6 of 8 Ubuntu tests and 22 of 24 Debian tests. Unlike some recent WordPress RCE attack chains, the vulnerable code here is not in WordPress core. It belongs to software used after the image is uploaded.
Exposure depends on account permissions and server setup
Demonstrated attacks require a valid account with permission to upload media. Standard installations usually give that ability to Authors and higher roles, although admins can change those permissions. This demonstrated route requires an upload-capable account, although plugins or custom applications that accept guest uploads could expose the same vulnerable processing path.
Server configuration creates the second condition. Wordfence testing found exposed configurations in the official WordPress Docker image and certain Debian, Ubuntu, and Fedora setups, while other tested builds were not affected through the same route.
Exposure requires Imagick, ImageMagick with HEIF support, and an unpatched affected libheif build with its uncompressed codec enabled. Check Tools → Site Health → Info → Media Handling for HEIC support, then ask your hosting provider to confirm the library’s build settings and patch status.
Admins should patch and tighten upload access
According to GitHub’s security advisory, libheif 1.18.0 through 1.23.2 is affected when its uncompressed codec is enabled; version 1.23.3 fixes the flaw. Operating system vendors may backport the fix into packages with lower version numbersPatching comes first, but the attack also gives admins a reason to review who can feed files into the vulnerable processing path.
- Install the patched library and restart affected services. Apply the security update supplied by the operating system or hosting provider, then restart PHP and relevant web services so they load the fixed version. Container deployments need an updated base image and redeployment. Teams responsible for many sites should include the library in existing patch management and vulnerability management work.
- Review who can upload media. If you manage a multi-author site, check which accounts still need upload rights and remove them from dormant users or outside contributors who no longer need access. Protect upload-capable accounts with MFA. Separate WordPress admin backdoor flaws have also demonstrated how damaging unnecessary account privileges can become once access is obtained.
- Block HEIC and HEIF files when they are not needed. Sites that do not use the formats can prevent them from reaching the affected image processor in the first place.
- Investigate crashes that follow HEIC uploads. Repeated PHP-FPM crashes or 503 errors after these files are submitted can warrant a closer security review.
No active exploitation campaign was reported in the disclosure. Affected systems already have a fix available, so administrators do not need to wait for attacks to appear before closing the path.
More cybersecurity news: Attackers used Microsoft’s legitimate X presence to boost a Clippy-themed crypto scheme before the company regained contro