{"id":246784,"date":"2026-11-07T02:43:03","date_gmt":"2026-11-07T08:43:03","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/11\/installing-the-fix-for-an-exploited-wordpress-flaw-can-expose-some-sites-one-last-time"},"modified":"2026-11-07T02:43:03","modified_gmt":"2026-11-07T08:43:03","slug":"installing-the-fix-for-an-exploited-wordpress-flaw-can-expose-some-sites-one-last-time","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/11\/installing-the-fix-for-an-exploited-wordpress-flaw-can-expose-some-sites-one-last-time","title":{"rendered":"Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time"},"content":{"rendered":"\n<p>Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.<\/p>\n<p>The update that installs the fix still unpacks its files using the site\u2019s old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the site\u2019s wp-content\/upgrade folder before updating.<\/p>\n<p>The flaw, tracked as <strong><a href=\"https:\/\/thehackernews.com\/2026\/11\/cisa-confirms-hackers-exploiting.html\" target=\"_blank\">CVE-2026\u2013119977<\/a><\/strong>, affects WordPress 4.7 through 7.1.3. During a core update that uses a complete package, WordPress unpacks a copy of the new version into a temporary folder inside wp-content\/upgrade. That copy includes the WordPress installer, and the web server can usually reach it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site\u2019s old, unpatched code, so an attacker who strikes at the right moment can run [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[418,1492],"tags":[],"class_list":["post-246784","post","type-post","status-publish","format-standard","hentry","category-internet","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246784"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246784\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}