WordPress Update Process Exposes Sites to Exploitation During Patching
Installing the latest security fix can inadvertently leave servers vulnerable to remote code execution.
1Critical Vulnerability During Updates
WordPress sites remain vulnerable to remote code execution even while applying the official security patch for CVE-2026-119977. Researcher Umut Bayram discovered that the update process uses legacy, unpatched code to unpack files. This creates a temporary, predictable directory that attackers can exploit to run unauthorized code on the server.
2Mechanism of the Exploit
During a core update, WordPress unpacks a complete package into the wp-content/upgrade folder. Because the updater uses old code, it creates a folder name that can be predicted by attackers. If an attacker accesses the installer within this temporary directory before deletion, they can execute PHP code with server permissions.
3Scope of Affected Versions
The vulnerability impacts WordPress versions 4.7 through 7.1.3. While version 7.1.4 includes a fix that randomizes folder names, the update process itself still relies on the vulnerable legacy code for the initial unpacking. Consequently, sites transitioning to the patched version remain exposed during the very moment they are installing the update.
4Active Exploitation Evidence
The U.S. Cybersecurity and Infrastructure Security Agency added this flaw to its known exploited vulnerabilities catalog. Security firm Wordfence observed attack attempts starting just nine minutes after their firewall rule deployment. Attackers are actively monitoring for the specific timing of site updates to catch the narrow window of vulnerability during installation.
5Partial Versus Complete Packages
Exposure depends on the update package type. Complete packages always include the vulnerable installer files, while partial packages only expose sites if they happen to contain those specific files. WordPress defaults to complete packages if core files do not match official checksums, increasing the likelihood of exposure for modified or corrupted installations.
6Recommended Mitigation Strategies
Bayram advises blocking web access to the wp-content/upgrade folder, which prevents external exploitation without breaking the update functionality. Alternatively, administrators can perform manual updates outside the web root directory. This method avoids creating temporary installer files in a location accessible to the web server, effectively neutralizing the risk of unauthorized execution.
7Limitations of Automated Tools
Common tools like WP-CLI's core update command do not provide protection, as they utilize the same vulnerable updater logic and temporary folder structure. Sites configured for automatic background updates are also susceptible to this risk, as they follow the standard, flawed update sequence without any additional security measures or manual intervention.
8Legacy System Risks
Versions 4.6 and earlier no longer receive security updates, leaving them permanently vulnerable to this flaw, which dates back to 2008. The CVSS score for this vulnerability is 8.1 out of 10. Organizations must prioritize migrating to supported versions to ensure they can effectively apply patches and secure their server environments.