cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

WordPress Fix Can Leave a Brief Exploitation Window During Installation

· Original article ↗

Summary

CVE-2026-119977 can leave some WordPress sites exposed while the fix installs, because the updater initially uses old code. Researchers recommend blocking web access to wp-content/upgrade; successful exploitation is not established.

Key points

  • CVE-2026-119977 affects WordPress 4.7 through 7.1.3; fixes are available in 7.1.4 and corresponding updates for older branches.
  • During installation, the old updater may unpack a complete package into a web-accessible temporary folder with a reachable installer.
  • An unauthenticated attacker who identifies the folder during the brief update window could run PHP code with the web server's permissions, according to researcher Umut Bayram.
  • Exposure depends on the updater already installed and whether the package contains installer files; partial packages are not necessarily safe, and updates can fall back to complete packages.
  • CISA added the flaw to its known exploited vulnerabilities catalog based on evidence of active exploitation. Wordfence reported attack attempts, but the article does not establish successful exploitation.
  • Block web access to wp-content/upgrade or perform a manual update outside the web root. WP-CLI uses the same updater and is not a workaround.
  • WordPress 4.6 and earlier no longer receive security updates. Public code described as an exploit has appeared, but its effectiveness has not been established.

Article Details

Vulnerability Types
  • Temporary installer exposure during a core update can allow server-side code execution
Severity
Wordfence scored the flaw 8.1/10 on the CVSS scale; WordPress rated it low.
Affected Versions
  • WordPress 4.7–7.1.3
  • WordPress 2.7–4.6 (unsupported; no fix available)
Exploitation Status
active
Exploit Availability
claimed_or_private
Patch Status
partial
Workarounds
  • Block web access to wp-content/upgrade before updating.
  • Manually update outside the web root, copying core files without touching wp-config.php or wp-content, then run the database update.
  • Move WordPress 4.6 and earlier to a supported version.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe described attack can run PHP code with the web server's permissions.T1190 · Exploit Public-Facing ApplicationThe described attack exploits a vulnerable WordPress installer reachable through the web during a core update.

CVE

CVE-2026-119977WordPress Foundation · WordPressThe flaw, tracked as CVE-2026-119977, affects WordPress 4.7 through 7.1.3. During a core update that uses a complete package, WordPress unpacks a copy of the new version into a temporary folder inside

People

Umut BayramPicus Security researcher credited with finding the flaw and explaining its exploitation conditions and mitigations.

Vendors

WordfenceWordfence, the WordPress security company that assigned the CVE identifier, saw attack attempts begin nine minutes after it deployed a firewall rule for the flaw on the day of the release. Two of the busiest sources

Products

WordPressSome WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.

Related Articles