WordPress Sites Vulnerable to RCE Attacks During Update Process, Security Researchers Warn

Millions of WordPress websites undergoing routine updates remain dangerously exposed to remote code execution (RCE) attacks during the exact window when they apply security patches, security researchers have revealed. The critical oversight stems from how the world’s most popular content management system unpacks core software updates, creating a brief but critical vulnerability window that malicious actors are actively weaponizing in the wild.

The vulnerability, formally tracked and cataloged as CVE-2026-119977, impacts an extensive array of WordPress core versions ranging from version 4.7 all the way up to version 7.1.3. The flaw was initially discovered by Umut Bayram, a security researcher at Picus Security, who identified that the standard updating mechanism relies on legacy, unpatched code to handle incoming files. Consequently, attackers who precisely time their operations can exploit the update process to compromise the underlying web server.

The United States Cybersecurity and Infrastructure Security Agency (CISA) recognized the severity of the threat by adding CVE-2026-119977 to its catalog of known exploited vulnerabilities. Security firms have reported widespread automated scanning targeting sites at the moment of update deployment, underlining the urgent need for administrators to adopt alternative mitigation strategies.

Understanding the Mechanics of CVE-2026-119977

To understand how the vulnerability manifests, cybersecurity experts point to the way WordPress manages core updates. During a standard core update that utilizes a complete package, the platform downloads a compressed copy of the new version and unpacks it into a temporary directory situated inside the site’s wp-content/upgrade folder. This temporary directory routinely includes the full WordPress installer, and under normal operational conditions, the web server can reach it over the internet.

Prior to the issuance of a patch, a malicious actor without any authentication credentials could potentially deduce or predict the name of this temporary folder. By accessing the installer file directly before WordPress finished executing its routine cleanup and deletion scripts, an attacker could manipulate the installation environment. This allowed unauthorized individuals to write a custom, malicious configuration file—specifically wp-config.php—into the temporary copy. When the update process completed, the site’s legitimate configuration file would be overwritten by the malicious version, handing full server-level control over to the attacker.

To address this core architectural risk, WordPress developers released version 7.1.4 last week, alongside backported updates for older active branches dating back to version 4.7. The primary defense introduced in these patches involves assigning a completely randomized name to the temporary update directory, thereby preventing attackers from guessing its location. Furthermore, the update logic was modified so that configuration files residing inside the temporary folder are never inadvertently copied over real site files.

However, Umut Bayram’s technical analysis revealed a profound irony in the patching mechanism itself: the update routine that installs the fix still unpacks its files using the vulnerable, legacy code already present on the target site. On websites running version 5.9 or newer, that older updater code names the temporary folder after the downloaded file name, rendering the directory name predictable for one final update cycle.

During this narrow window of execution, an attacker who successfully times their request can set up the temporary copy of WordPress with a bespoke database, authenticate against it, and execute arbitrary PHP code with the exact permissions of the web server. Because the web server processes these requests before the temporary directory is scrubbed from the disk, the attacker gains the ability to read, modify, or delete sensitive files across the entire live WordPress environment.

Scope of Exposure and Active Exploitation in the Wild

Security analysts emphasize that not every single update routine exposes the underlying installer files to external manipulation. Complete packages universally bundle the installer scripts, meaning any update requiring a full package inherits the risk. Conversely, smaller partial packages—which contain exclusively the differential files modified between two specific sequential releases—only expose a site if those particular patch files happen to include the core installer components.

When evaluating automated background update routines, researchers found that WordPress often relies on partial packages for minor intra-branch updates, such as migrating from version 7.1.3 to 7.1.4. However, when a site jumps across major boundaries—such as upgrading from version 7.0.7 to 7.1.4—the system falls back to downloading and installing a complete package, immediately re-introducing the predictable temporary folder vulnerability unless the local environment has been specially secured.

The exploitation landscape surrounding CVE-2026-119977 escalated rapidly following public disclosure. Wordfence, the prominent WordPress security firm that originally assigned the CVE identifier, observed malicious scanning and attack attempts commencing a mere nine minutes after the publication of their initial firewall rule. Prominent threat actor infrastructure was observed probing targeted sites continuously for over fourteen hours, matching the operational profile expected of actors attempting to intercept and hijack live update windows.

Although WordPress’s own security advisory rated the impact of the flaw as low, the CVE record maintains a critical CVSS score of 8.1 out of 10. Laboratory reproductions demonstrated that while the vulnerable update window typically lasts only a matter of seconds, automated exploit scripts published on public code repositories have lowered the technical barrier required to target sites undergoing complete-package updates.

Recommended Defensive Measures and Mitigation Strategies

Because standard administrative practices involve running updates through the native dashboard or utilizing command-line tools like WP-CLI—which ultimately execute the same underlying vulnerable core upgrader functions—traditional update pathways leave sites exposed during the transition phase. Security researchers have outlined specific architectural precautions that system administrators must implement to shield vulnerable environments from potential exploitation.

The primary recommendation put forward by Umut Bayram involves blocking external web access to the wp-content/upgrade directory at the web server configuration level, utilizing tools like Nginx directives or Apache .htaccess rules. Because WordPress interacts with this directory directly on the underlying server disk rather than through HTTP requests, restricting web accessibility does not disrupt or break the core update functionality, yet it effectively isolates the temporary installer from external malicious web traffic.

Alternatively, administrators managing high-value or mission-critical infrastructure are advised to perform manual updates completely outside the web root directory served by the web server. This manual procedure requires taking comprehensive, verified backups of both the site files and the underlying database. The administrator then unpacks the new WordPress release in an isolated directory inaccessible to external web browsers, copies the core files into the production environment while explicitly preserving the existing wp-config.php file and wp-content directory, and finally executes the requisite database migration routines. This methodology ensures that a temporary, reachable installer script is never materialized within the web-accessible file tree.

For legacy installations running versions 4.6 and older, which no longer receive official security patches from the WordPress security team, no native fix exists. Security researchers note that the underlying structural vulnerability traces its lineage back to WordPress 2.7, released nearly two decades ago in 2008. Administrators overseeing these legacy deployments are strongly urged to migrate their infrastructure to currently supported versions to prevent total compromise.

As automated threat actors continue to scan for vulnerable update windows across the global ecosystem, security professionals maintain that proper file-system permission management and proactive server-level access restrictions remain the most reliable defenses against active exploitation during the transition to patched software releases.