Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

A security researcher at Picus Security, Umut Bayram, discovered that some WordPress sites remain vulnerable during the installation of a patch for an actively exploited flaw. The update process unpacks files using the old, unpatched code, creating a race condition window during which an attacker can execute code on the server. This means that even sites attempting to remediate a known vulnerability can be attacked at the precise moment of patching. The researcher advises blocking web access during the update process to mitigate this risk. The flaw is actively being exploited in the wild, making the timing of patching particularly critical. This issue highlights a broader challenge in patch management where the remediation process itself can introduce a temporary attack surface.