Quick follow-up on the exploited WordPress core flaw, CVE-2026-119977 (original post). The researcher who found it, Umut Bayram of Picus Security, says the update that installs the fix can be attacked while it runs, The Hacker News reports.
Why
The fix gives the temp folder in wp-content/upgrade a random name. But the update that delivers it still unpacks using the old code, which on 5.9+ names the folder predictably. A fast attacker could hit the copied installer and run PHP before the copy is deleted. Branch jumps (say, 7.0.x to 7.1.4) get full packages, which is the risky path. Auto-updates go through the same steps.
What to do
- Nginx:
location ^~ /wp-content/upgrade/ { deny all; } - Apache:
Require all deniedfor that directory, orRedirectMatch 403 ^/wp-content/upgrade/in the root .htaccess - Don’t drop an .htaccess inside upgrade/. The updater wipes it
My take
A fix you can get exploited while installing needs garlic. Block the folder, then update.
God Bless, and Needs Garlic!
