A newly discovered vulnerability in WordPress, tracked as CVE-2026-119977, poses a significant risk during the update process, according to Umut Bayram, a researcher at Picus Security. The flaw allows attackers to exploit the system while the fix is being installed, potentially enabling them to execute code on the server.
The vulnerability affects WordPress versions 4.7 through 7.1.3. When a site updates, it unpacks the new version using the existing, unpatched code, which can be exploited if an attacker accesses the temporary installation files before they are deleted. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added this flaw to its catalog of known exploited vulnerabilities, highlighting its urgency.
Mechanics of the Vulnerability
During a core update, WordPress creates a temporary folder within the wp-content/upgrade directory to unpack the new version. This folder includes the WordPress installer, which can be accessed by an attacker if they know its name. If an attacker can access this installer before it is removed, they can run arbitrary code on the server, potentially compromising the entire site.
WordPress released a fix in version 7.1.4, which randomizes the name of the temporary folder to mitigate this risk. However, the update process itself still utilizes the old code, which can expose the folder name during the installation of the fix, allowing for a brief window of vulnerability.
Recommendations for Mitigation
Bayram advises site administrators to take immediate action to protect their sites. The first recommendation is to block web access to the wp-content/upgrade folder before performing any updates. This can be achieved by modifying the web server configuration. For Nginx, administrators can add the following directive:
- location ^~ /wp-content/upgrade/ { deny all; }
For Apache servers, the following should be added inside the relevant directory block:
- Require all denied
Additionally, if editing the .htaccess file is the only option, administrators can include:
- RedirectMatch 403 ^/wp-content/upgrade/
After implementing these changes, administrators should confirm that access to the upgrade folder returns a 403 error before proceeding with the update to version 7.1.4 or its respective branch fix.
Active Exploitation and Next Steps
Evidence of active exploitation has already been observed, with attempts to exploit the vulnerability beginning shortly after the release of the fix. Wordfence, a WordPress security company, reported that attack attempts surged just nine minutes after deploying a firewall rule for the flaw. The vulnerability has a CVSS score of 8.1 out of 10, indicating a high severity level.
For those who have not yet updated, Wordfence recommends checking for unusual activity, such as unexpected requests to PHP files in the wp-content/upgrade directory, unfamiliar administrator accounts, or unauthorized plugins. Sites running versions prior to 4.6 are particularly vulnerable, as they no longer receive security updates.
As the situation evolves, site administrators are urged to remain vigilant and implement the recommended security measures to safeguard their WordPress installations. For further details, refer to the technical write-up by Bayram on the Picus Security blog.
For more information on the vulnerability and its implications, visit The Hacker News.
