HighCVE
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
The Hacker News·Source published ·1 min read
What happened?
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server.
Key details
- CISA added the flaw to its known exploited vulnerabilities catalog based on evidence of active exploitation.
- WordPress 7.1.4 and branch fixes use random folder names and prevent wp-config.php overwrite after installation.
- Wordfence observed attack attempts beginning nine minutes after deploying a firewall rule on release day.
Affected
- WordPress versions 4.7 through 7.1.3 are affected by CVE-2026-119977.
- Sites on WordPress 5.9 or later using complete packages have predictable folder names during the fix update.
- WordPress 4.6 and earlier no longer receive security updates and have no fix available.
Fixes and mitigations
- Perform manual update outside the web root by unpacking new release in non-web-accessible folder and copying core files.
What to look for
- Unexpected requests to PHP files under wp-content/upgrade folder.
- Unrecognized administrator accounts appearing on the site.
- Plugins installed that no one on the team added.
- PHP files present in wp-content/upgrade that were not placed there intentionally.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.