Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
WordPress is currently facing active attacks through a flaw that allows unauthorized access, elevating the situation beyond a standard disclosure.
WordPress is under active attack through a flaw that lets someone break into it directly, which moves this well past an ordinary disclosure.
This requires local or already-authenticated access to reach.
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.
Active exploitation changes the calculus entirely: this has moved from theoretical risk to a live attack technique.
The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server.
During a core update that uses a complete package, WordPress unpacks a copy of the new version into a temporary folder inside wp-content/upgrade.
Anyone running WordPress 7.1.4 is exposed, specifically wherever WordPress is actually deployed rather than just licensed or installed somewhere unused.
The researcher advises blocking web access to the site's wp-content/upgrade folder before updating.
That copy includes the WordPress installer, and the web server can usually reach it.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
An attacker with no account who can determine the folder's name and access the installer before WordPress deletes the copy can end up running code on the server.
On sites running 5.9 or later, that old code names the folder after the downloaded file, so the name can be predicted one last time.
This is tracked as CVE-2026-119977 and rated low severity, which is the identifier to use when checking vendor guidance.
The affected versions are 7.1.4, so that's the range to check against your own deployment.
The flaw, tracked as CVE-2026-119977 , affects WordPress 4.7 through 7.1.3.
WordPress released the fix last week in version 7.1.4 and in matching updates for older branches back to 4.7, all listed in its security advisory .
But the update that installs the fix unpacks its files using the old code already on the site, as WordPress's updater code shows.
Before the fix, an attacker could use the installer to write a new configuration file, wp-config.php, into the temporary copy.
Confirm whether WordPress 7.1.4 is present anywhere in your asset and software inventory.
Treat exposed matches as urgent -- exploitation has already been reported.
The update would then overwrite the site's real file with that file.
What happened
WordPress is currently facing active attacks through a flaw that allows unauthorized access, elevating the situation beyond a standard disclosure.
This vulnerability requires local or authenticated access to exploit.
According to Umut Bayram, the Picus Security researcher who discovered the issue, some WordPress sites remain vulnerable while they are in the process of installing the fix for this actively exploited flaw.
What changed
Active exploitation shifts the risk assessment significantly: this has transitioned from a theoretical concern to a live attack vector.
The update that implements the fix still unpacks its files using the site's outdated, unpatched code, enabling an attacker to execute code on the server if they strike at the right moment.
During a core update that utilizes a complete package, WordPress extracts a copy of the new version into a temporary folder within wp-content/upgrade.
Who is affected
Anyone operating WordPress 7.1.4 is at risk, particularly in environments where WordPress is actively deployed rather than merely licensed or installed but unused.
The researcher recommends blocking web access to the site's wp-content/upgrade folder prior to performing the update.
This copy contains the WordPress installer, which is typically accessible by the web server.
Why it matters
The advisory outlines the tangible security implications once the vulnerable path is exploited.
An attacker without an account who can identify the folder's name and access the installer before WordPress removes the copy could execute code on the server.
On sites running version 5.9 or later, the old code names the folder after the downloaded file, allowing for predictable naming one last time.
Technical details
This vulnerability is tracked as CVE-2026-119977 and is rated with low severity; this identifier should be referenced when consulting vendor guidance.
The affected version is 7.1.4, which should be checked against your own deployments.
The flaw, identified as CVE-2026-119977, impacts WordPress versions 4.7 through 7.1.3.
Response
WordPress released the fix last week in version 7.1.4, along with corresponding updates for older branches back to 4.7, all detailed in its security advisory.
However, the update that implements the fix unpacks its files using the outdated code already present on the site, as indicated by WordPress's updater code.
Before the fix was applied, an attacker could leverage the installer to create a new configuration file, wp-config.php, in the temporary copy.
What security teams should do
Verify whether WordPress 7.1.4 is present in your asset and software inventory.
Treat any exposed instances as urgent, as exploitation has already been reported.
The update would overwrite the site's actual file with the new one.