WordPress site administrators are facing potential risks during updates due to a vulnerability identified in versions 4.7 through 7.1.3. According to Umut Bayram from Picus Security, this flaw could allow attackers to exploit the system while the fix is being installed. The vulnerability, tagged as CVE-2026-119977, is primarily concerning during the update process when WordPress unpacks new version files.
Understanding the Vulnerability
The core of the issue lies within the WordPress update mechanism. When a core update is executed using a complete package, WordPress places the new version in a temporary directory within wp-content/upgrade. This process exposes the system to potential attacks if an intruder can access the contents before they are deleted. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently flagged this vulnerability as one actively exploited.
WordPress addressed the flaw with version 7.1.4 and corresponding updates for earlier versions. The solution involves assigning a random name to the temporary folder to prevent predictable access points. However, the initial update still uses the old system code, which could be exploited by attackers during the transition period.
Mitigation Strategies
Experts recommend several strategies to mitigate risks during updates. First, blocking web access to the wp-content/upgrade folder is crucial. This can be achieved through server configuration settings. For Nginx, adding location ^~ /wp-content/upgrade/ { deny all; } is suggested, while Apache users should include Require all denied within the virtual host configuration. These steps prevent unauthorized access during updates.
Another approach involves manual updates outside the web root directory. By backing up site files and databases and updating in a non-web-accessible directory, administrators can avoid creating a reachable installer. This method ensures that no temporary files are exposed to potential attackers.
Recommendations for Site Administrators
Site administrators are advised to stay vigilant and implement recommended security measures. Monitoring for unusual activity, such as unexpected PHP file requests or unrecognized administrator accounts, can help identify potential breaches. Additionally, updating to the latest secure version promptly and following best practices for server configuration will enhance site protection.
WordPress versions 4.6 and older do not receive security updates, leaving them vulnerable to this issue. Users of these versions should consider upgrading to supported versions to ensure security. The ongoing monitoring by security firms like Wordfence highlights the importance of proactive measures to protect against exploitation.
Conclusion
While WordPress has taken steps to mitigate the risk of exploitation during updates, site administrators must remain proactive. By following recommended security practices and keeping their systems updated, they can minimize the risk of attacks during this vulnerable period. Ensuring robust web server configurations and conducting manual updates when necessary will help safeguard against potential threats.
