Installing the Fix for an Exploited Word Press Flaw Can Expose Some Sites One Last Time
Summary: Picus Security researcher Umut Bayram found that installing the fix for CVE-2026-119977, which affects WordPress 4.7 through 7.1.3, can still expose some sites because the updater unpacks files using the site's old, unpatched code, and on sites running 5.9 or later that code names the temporary folder after the downloaded file, making it predictable one last time. CISA added the flaw to its known exploited vulnerabilities catalog earlier this week, WordPress released the fix in version 7.1.4 and matching updates back to 4.7 last week, and Wordfence saw attack attempts begin nine minutes after it deployed a firewall rule on the day of release.
What's compelling: Wordfence observed two of the busiest attack sources checking small groups of sites for about 14.5 hours, which it says aligns with attempts to catch the moment a site updates - and the researcher's deciding factor is not partial versus complete packages but whether the updater already installed on the site has been fixed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-119977
- Related
- CISA Adds One Known Exploited Vulnerability to Catalog Cyber Risks · Nov 03, 2026CVE-2026-119977: Word Press Word Press Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 03, 2026