Ghostscript CVE-2025-27830: Is Your WordPress Server Safe?

Ghostscript is a system-level program installed on a large number of web servers. Most business owners have never heard of it, which is exactly why it presents a problem. When you or a customer uploads a PDF to a WordPress site, something has to generate the thumbnail preview that appears in the media library. On most Linux-based hosting environments, that something is Ghostscript. It runs beneath WordPress, at the operating system level, processing the file before WordPress has any say in the matter.

A critical vulnerability in Ghostscript means that a specially crafted PDF, one that looks entirely ordinary, can instruct Ghostscript to execute arbitrary code on the server the moment it processes the file. The attacker does not need access to your WordPress admin panel, your credentials, or anything beyond a file upload field and a server running an unpatched version of Ghostscript.

The CVE disclosure for this vulnerability rates it at the highest severity level. The assessed outcome is full server compromise: an attacker who successfully exploits it can run commands on the underlying machine, read files outside your WordPress installation, access environment variables containing database credentials and API keys, and potentially pivot to other sites hosted on the same server.

Where PDF Uploads Enter Your Site

The entry points are wider than most business owners assume. The WordPress media library is the obvious one, but any form that accepts file attachments is also a vector. Contact forms built with plugins such as Contact Form 7 or Gravity Forms frequently allow PDF uploads by default, and WooCommerce product submission flows, vendor upload forms on marketplace sites, support ticket systems, and document portals all represent the same risk. If a field on your site accepts a PDF, Ghostscript may process it.

The file does not need to reach a human reviewer for the damage to occur. The exploit fires at the moment the server processes the upload, which typically happens before any notification reaches you or your team.

There is no WordPress plugin update that fixes this. The vulnerability exists in Ghostscript itself, at the operating system level, so the patch has to be applied there. For most WordPress sites, that means the fix depends entirely on your hosting provider updating the server packages, or on a rebuilt container image if your site runs in a containerised environment. Your site remains exposed regardless of how current your WordPress core, themes, and plugins are, until your host confirms the patch has been applied.

What a Patched Server Requires and Why You Cannot Assume It Is Done

The patched version of Ghostscript is 10.05.0. Your hosting provider needs to have updated the system package to at least that version. On a shared hosting plan, you have no way to verify or apply this yourself. On a VPS or dedicated server where you have root access, you can check the installed version by running gs --version via the command line, though most business owners are not managing their own servers at that level and should not need to be.

Contact your hosting provider directly and ask two questions: which version of Ghostscript is currently installed on the server running your site, and when was it last updated. A host that cannot answer both questions clearly has not yet addressed this.

In the meantime, consider disabling PDF uploads across your site until you have written confirmation from your host that the patched version is in place. The risk of leaving upload fields open on an unpatched server outweighs the inconvenience of asking customers to send documents by email for a short period. Treat it as a temporary measure while you wait for confirmation.

Auditing your site for upload points is the immediate practical task. Check every form plugin you have installed and review which file types each form permits. In Contact Form 7, file type restrictions are set within the form editor under the file upload field options. In Gravity Forms, the allowed extensions are configured in the field settings panel. WooCommerce stores using product upload fields or vendor plugins should check the file type allowlists within those specific plugin settings. Blocking the PDF MIME type at the form level reduces exposure, though it does not eliminate it if Ghostscript is invoked by other processes on the same server.

Shared hosting environments deserve particular attention here. If a third party uses a file upload field on your site to compromise your server, and that server hosts other clients’ data or other businesses’ websites, the damage extends well beyond your own installation: a single exploited site can give an attacker a foothold that reaches neighbouring accounts on the same machine. The liability position that creates may affect businesses other than your own.

---

If you want me to audit your site’s upload points and confirm whether your hosting environment is running a vulnerable version of Ghostscript, get in touch via this page. I will check every form and file field on your site, identify where PDFs can enter, and work directly with your host to verify or obtain the patch. Given that exploitation requires nothing more than a publicly accessible upload field and an unpatched server, this is not a task to schedule for next month. Contact me at The WordPress Guy and I will turn this around as a priority.