Some WordPress websites can nonetheless be attacked whereas they set up the repair for an actively exploited flaw, based on Umut Bayram, the Picus Safety researcher who discovered it.
The replace that installs the repair nonetheless unpacks its information utilizing the location’s outdated, unpatched code, so an attacker who strikes on the proper second can run code on the server. The researcher advises blocking net entry to the location’s wp-content/improve folder earlier than updating.
The flaw, tracked as CVE-2026-119977, impacts WordPress 4.7 by way of 7.1.3. Throughout a core replace that makes use of a whole bundle, WordPress unpacks a duplicate of the brand new model into a brief folder inside wp-content/improve. That duplicate consists of the WordPress installer, and the online server can normally attain it.
An attacker with no account who can decide the folder’s identify and entry the installer earlier than WordPress deletes the copy can find yourself working code on the server. The U.S. Cybersecurity and Infrastructure Safety Company (CISA) added the flaw to its catalog of identified exploited vulnerabilities earlier this week.
WordPress launched the repair final week in model 7.1.4 and in matching updates for older branches again to 4.7, all listed in its safety advisory.
The repair offers the short-term folder a random identify. However the replace that installs the repair unpacks its information utilizing the outdated code already on the location, as WordPress’s updater code reveals. On websites working 5.9 or later, that outdated code names the folder after the downloaded file, so the identify might be predicted one final time.
Earlier than the repair, an attacker may use the installer to put in writing a brand new configuration file, wp-config.php, into the short-term copy. The replace would then overwrite the location’s actual file with that file. The a part of the repair that stops this already works throughout the replace that installs it, as a result of WordPress copies the information into place utilizing the brand new code.
An attacker who catches the window throughout that replace can nonetheless arrange the short-term copy of WordPress with their very own database, log in to it, and run PHP code with the online server’s permissions earlier than the copy is deleted, Bayram says in his technical write-up. From there, the attacker can learn or write information within the dwell WordPress website.
Who Is Uncovered In the course of the Replace
Not each replace exposes the installer, the researcher says. Full packages all the time embody the installer information. A smaller partial bundle, constructed for one particular beginning model, exposes a website provided that it occurs to include them.
On websites that enable computerized background updates, WordPress installs the repair mechanically, through the identical updater and the identical steps.
The Hacker Information checked WordPress.org’s replace service immediately for a number of variations. For updates inside a department, akin to from 7.1.3 to 7.1.4, it provided a partial bundle, together with for computerized updates. For a transfer from an older department, akin to from 7.0.7 to 7.1.4, it provided solely full packages.
On 4.4 by way of 5.8, the outdated code provides random characters to the folder’s identify. That hides the identify except the location leaks it another manner, akin to in an error message, the researcher says.
As soon as 7.1.4 or a department repair is put in, later updates use a random folder identify, and a wp-config.php file within the short-term copy is rarely copied over the actual one.
What to Do Earlier than Updating
The researcher’s first advice is to cease the online server from serving wp-content/improve in any respect. WordPress works with that folder immediately on disk, so blocking net entry doesn’t break updates, he says.
- Block the folder within the net server configuration. On Nginx, add location ^~ /wp-content/improve/ { deny all; }. On Apache, add Require all denied inside a
block for that folder within the digital host configuration. - In case you can solely edit .htaccess, add RedirectMatch 403 ^/wp-content/improve/ to the .htaccess file within the WordPress root, above the WordPress rewrite guidelines.
- Don’t put an .htaccess file inside wp-content/improve itself. The outdated updater deletes all the pieces in that folder earlier than it unpacks an replace, so the file could be gone when it’s wanted.
- Verify {that a} request to /wp-content/improve/ returns a 403 error.
- Replace to 7.1.4 or to the fastened launch to your department.
The opposite protected route, he says, is a handbook replace completed exterior the online root, the folder the online server serves. Again up the location information and database, unpack the brand new launch in a folder the online server doesn’t serve, copy the core information into place with out touching wp-config.php or wp-content, after which run the WordPress database replace. This fashion, no short-term installer is ever created in a folder the online can attain.
WP-CLI’s wp core replace command isn’t any substitute, as a result of it runs the identical updater and unpacks the bundle into the identical folder.
WordPress 4.6 and earlier not obtain safety updates, so there isn’t any repair for them. The researcher says the flaw goes again to WordPress 2.7, launched in 2008, and that these websites ought to transfer to a supported model.
Assaults and What to Test
CISA’s catalog addition earlier this week was based mostly on proof of energetic exploitation, however the company didn’t describe the assaults.
Wordfence, the WordPress safety firm that assigned the CVE identifier, noticed assault makes an attempt start 9 minutes after it deployed a firewall rule for the flaw on the day of the discharge. Two of the busiest sources stored checking small teams of websites for about 14.5 hours, which the corporate says, in its assault evaluation, aligns with makes an attempt to catch the second a website updates.
Its rating for the flaw within the CVE report is 8.1 out of 10 on the CVSS scale. In its lab checks, the window lasted solely seconds. WordPress’s personal advisory charges the flaw low.
Code that its authors describe as an exploit for the flaw has appeared in public GitHub repositories since earlier this week. Considered one of them says its code additionally works on websites that also use a predictable folder throughout complete-package updates. Whether or not the code works has not been established.
For websites that stayed on an affected model after the discharge, Wordfence suggests on the lookout for:
- sudden requests to PHP information beneath wp-content/improve
- administrator accounts nobody acknowledges
- plugins nobody put in
- PHP information in wp-content/improve that nobody put there
Replace
Bayram advised The Hacker Information on November 6 that whether or not a partial replace is uncovered will depend on what that particular bundle accommodates. A partial bundle holds solely the information that modified between two releases. If these don’t embody the installer information, the short-term copy can’t run as a WordPress set up, and the installer by no means turns into reachable.
A website additionally doesn’t all the time get a partial bundle when one exists. WordPress falls again to a whole bundle if the location’s core information don’t match the official checksums or if the replace is a reinstall.
The deciding issue, the researcher stated, “isn’t partial versus full. It’s whether or not the updater already put in on the location has been fastened.”
