Some WordPress websites can nonetheless be attacked whereas they set up the repair for an actively exploited flaw, based on Umut Bayram, the Picus Safety researcher who discovered it.
The replace that installs the repair nonetheless unpacks its recordsdata utilizing the positioning’s outdated, unpatched code, so an attacker who strikes on the proper second can run code on the server. The researcher advises blocking net entry to the positioning’s wp-content/improve folder earlier than updating.
The flaw, tracked as CVE-2026-119977, impacts WordPress 4.7 by 7.1.3. Throughout a core replace that makes use of an entire package deal, WordPress unpacks a replica of the brand new model into a brief folder inside wp-content/improve. That replicate contains the WordPress installer, and the online server can often attain it.
An attacker with no account who can decide the folder’s identify and entry the installer earlier than WordPress deletes the copy can find yourself operating code on the server. The U.S. Cybersecurity and Infrastructure Safety Company (CISA) added the flaw to its catalog of recognized exploited vulnerabilities earlier this week.
WordPress launched the repair final week in model 7.1.4 and in matching updates for older branches again to 4.7, all listed in its safety advisory.
The repair provides the non permanent folder a random identify. However the replace that installs the repair unpacks its recordsdata utilizing the outdated code already on the positioning, as WordPress’s updater code reveals. On websites operating 5.9 or later, that outdated code names the folder after the downloaded file, so the identify might be predicted one final time.
Earlier than the repair, an attacker might use the installer to put in writing a brand new configuration file, wp-config.php, into the non permanent copy. The replace would then overwrite the positioning’s actual file with that file. The a part of the repair that stops this already works through the replace that installs it, as a result of WordPress copies the recordsdata into place utilizing the brand new code.
An attacker who catches the window throughout that replace can nonetheless arrange the non permanent copy of WordPress with their very own database, log in to it, and run PHP code with the online server’s permissions earlier than the copy is deleted, Bayram says in his technical write-up. From there, the attacker can learn or write recordsdata within the stay WordPress website.
Who Is Uncovered Throughout the Replace
Not each replace exposes the installer, the researcher says. Full packages all the time embody the installer recordsdata. A smaller partial package deal, constructed for one particular beginning model, exposes a website provided that it occurs to include them.
On websites that enable automated background updates, WordPress installs the repair mechanically, by way of the identical updater and the identical steps.
The Hacker Information checked WordPress.org’s replace service in the present day for a number of variations. For updates inside a department, similar to from 7.1.3 to 7.1.4, it provided a partial package deal, together with for automated updates. For a transfer from an older department, similar to from 7.0.7 to 7.1.4, it provided solely full packages.
On 4.4 by 5.8, the outdated code provides random characters to the folder’s identify. That hides the identify until the positioning leaks it another method, similar to in an error message, the researcher says.
As soon as 7.1.4 or a department repair is put in, later updates use a random folder identify, and a wp-config.php file within the non permanent copy isn’t copied over the true one.
What to Do Earlier than Updating
The researcher’s first advice is to cease the online server from serving wp-content/improve in any respect. WordPress works with that folder instantly on disk, so blocking net entry doesn’t break updates, he says.
- Block the folder within the net server configuration. On Nginx, add location ^~ /wp-content/improve/ { deny all; }. On Apache, add Require all denied inside a <Listing> block for that folder within the digital host configuration.
- For those who can solely edit .htaccess, add RedirectMatch 403 ^/wp-content/improve/ to the .htaccess file within the WordPress root, above the WordPress rewrite guidelines.
- Don’t put an .htaccess file inside wp-content/improve itself. The outdated updater deletes every little thing in that folder earlier than it unpacks an replace, so the file could be gone when it’s wanted.
- Verify {that a} request to /wp-content/improve/ returns a 403 error.
- Replace to 7.1.4 or to the fastened launch to your department.
The opposite secure route, he says, is a handbook replace executed exterior the online root, the folder the online server serves. Again up the positioning recordsdata and database, unpack the brand new launch in a folder the online server doesn’t serve, copy the core recordsdata into place with out touching wp-config.php or wp-content, after which run the WordPress database replace. This fashion, no non permanent installer is ever created in a folder the online can attain.
WP-CLI’s wp core replace command isn’t any substitute, as a result of it runs the identical updater and unpacks the package deal into the identical folder.
WordPress 4.6 and earlier not obtain safety updates, so there isn’t a repair for them. The researcher says the flaw goes again to WordPress 2.7, launched in 2008, and that these websites ought to transfer to a supported model.
Assaults and What to Verify
CISA’s catalog addition earlier this week was primarily based on proof of lively exploitation, however the company didn’t describe the assaults.
Wordfence, the WordPress safety firm that assigned the CVE identifier, noticed assault makes an attempt start 9 minutes after it deployed a firewall rule for the flaw on the day of the discharge. Two of the busiest sources stored checking small teams of web sites for about 14.5 hours, which the corporate says, in its assault evaluation, aligns with makes an attempt to catch the second a website updates.
Its rating for the flaw within the CVE report is 8.1 out of 10 on the CVSS scale. In its lab exams, the window lasted solely seconds. WordPress’s personal advisory charges the flaw low.
Code that its authors describe as an exploit for the flaw has appeared in public GitHub repositories since earlier this week. One among them says its code additionally works on websites that also use a predictable folder throughout complete-package updates. Whether or not the code works has not been established.
For websites that stayed on an affected model after the discharge, Wordfence suggests searching for:
- sudden requests to PHP recordsdata below wp-content/improve
- administrator accounts nobody acknowledges
- plugins nobody put in
- PHP recordsdata in wp-content/improve that nobody put there
Replace
Bayram informed The Hacker Information on November 6 that whether or not a partial replace is uncovered is determined by what that particular package deal comprises. A partial package deal holds solely the recordsdata that modified between two releases. If these don’t embody the installer recordsdata, the non permanent copy can not run as a WordPress set up, and the installer by no means turns into reachable.
A website additionally doesn’t all the time get a partial package deal when one exists. WordPress falls again to a whole package deal if the positioning’s core recordsdata don’t match the official checksums or if the replace is a reinstall.
The deciding issue, the researcher stated, “isn’t partial versus full. It’s whether or not the updater already put in on the positioning has been fastened.”
