WordPress Security Update Can Leave Sites Exposed One Last Time While It Installs

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram of Picus Security. The flaw, tracked as CVE-2026-119977, affects WordPress 4.7 through 7.1.3. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of known exploited vulnerabilities earlier this week. WordPress released the fix last week in version 7.1.4, with matching updates for older branches back to 4.7.

The problem lies in how core updates work. During an update using a complete package, WordPress unpacks a copy of the new version into a temporary folder inside wp-content/upgrade, and that copy includes the installer, which the web server can usually reach. The fix gives that folder a random name. However, the update that installs the fix still unpacks its files using the site's old code. On sites running 5.9 or later, that code names the folder after the downloaded file, so the name can be predicted one last time. An attacker with no account who strikes during that window could run code on the server and then read or write files on the live site.

Not every update is affected. Complete packages always include the installer files, while smaller partial packages expose a site only if they happen to contain them. Bayram advises blocking web access to the wp-content/upgrade folder before updating.