Some WordPress websites may remain exposed to cyberattacks even while installing a security update designed to fix an actively exploited vulnerability, according to research by Umut Bayram, a security researcher at Picus Security. The issue, identified as CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 and involves a weakness in the platform’s website update process. Under certain conditions, an attacker without an authorised account could exploit the issue to run malicious code on a website’s server during a short period while an update is being installed. The risk arises because WordPress initially relies on its existing update system to prepare and unpack files from the new release before the security fix becomes fully active. During this process, the platform temporarily stores installation files in a folder on the website’s server. These files include components used to install WordPress and may be accessible through a web browser if the folder is not properly protected. Bayram explained that an attacker who identifies the temporary folder and accesses the installation files before they are removed could potentially launch a separate installation process and execute commands with the permissions available to the website’s server. This could provide access to files associated with the affected website. The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue on November 3, 2026, confirming that there is evidence of exploitation. However, the listing does not provide details of specific attacks or confirm that particular websites were compromised.
WordPress released version 7.1.4 on October 28, 2026, alongside security updates for older versions dating back to version 4.7. The releases address the weakness, and administrators have been advised to update their websites. However, Bayram’s research highlights a potential exposure that can occur while the security fix is being installed. The updated version improves the process by creating a temporary folder with a randomly generated name, making it harder for attackers to predict where installation files are stored. The complication is that the update initially relies on the older installation system already present on the website. On websites running WordPress 5.9 or later, this older system may use the name of the downloaded update package when creating the temporary folder, potentially making its location easier to predict during the final installation of the security fix. The level of exposure also depends on the type of update package being used. Some packages contain all the files required for installation, while others include only files changed between releases. Packages containing only changed files may not include the installation components that create the risk. However, WordPress may use a complete package when reinstalling the platform or when website files do not match official versions. Automatic background updates also rely on the same installation process and are therefore not automatically exempt from the issue. In a clarification published on November 6, Bayram explained that administrators should focus on whether the security fix has already updated the older installation system, rather than assuming that a particular type of update package is always safe. Once the relevant security update has been installed, subsequent updates use the improved process for managing temporary installation files.
To reduce the risk, Bayram recommends blocking public access to the temporary folder used during WordPress updates before installing the security release. The folder is intended for internal file operations on the server, so restricting access through a browser should not interfere with the normal update process. Administrators can apply the restriction through their web server settings or the main website access configuration file, where supported. They should also verify that attempts to open the folder through a browser are blocked before proceeding with the update. Bayram cautioned against placing the restriction file directly inside the temporary folder because the older installation system may remove its contents during the update, potentially deleting the protection before it is needed. Another option is to carry out the update manually from a location outside the website’s publicly accessible directory. This prevents temporary installation files from being reached through the website. The process involves backing up the website and its database, extracting the updated files in a protected location, and transferring the required WordPress files to the website without replacing its main configuration file or the folder containing themes, plugins and uploaded content. Administrators must then complete any required database updates. Bayram also noted that using WP-CLI, a command-line tool for managing WordPress websites, does not independently remove the risk because it relies on the same update process. Websites running WordPress 4.6 or earlier require additional attention because these versions no longer receive security updates. According to the researcher, the underlying weakness dates back to WordPress 2.7, released in 2008, making migration to a supported version important for administrators still using older installations.
Security teams have also been advised to review websites that were running affected versions or underwent updates while the vulnerability was still present. CISA’s addition of the flaw to its known exploited vulnerabilities catalogue confirms evidence of exploitation, but does not establish how individual attacks were carried out or identify specific affected websites. Wordfence separately reported observing attempts to exploit the vulnerability after deploying a security rule designed to block related activity. The company said some sources continued checking groups of websites for approximately 14.5 hours, a pattern it considered consistent with attempts to identify websites undergoing updates. Wordfence also assigned the vulnerability a severity score of 8.1 out of 10 and recommended that administrators check for unusual requests involving installation files, unfamiliar administrator accounts, unrecognised plugins and unexpected files in temporary update folders. Such findings can indicate suspicious activity, but should be investigated before being treated as proof of a successful compromise. Reports have also described publicly available material presented as an exploit for the vulnerability, although the effectiveness of that material has not been independently established. It is therefore important to distinguish between reported attack attempts and confirmed successful breaches. Website owners should prioritise installing the appropriate security release, restricting public access to temporary update files, reviewing administrator accounts and plugins, and examining server records for unusual activity. The findings highlight that installing a security update may require additional precautions when the update process initially depends on older software that has not yet received the fix.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
