Ethical Hacking News
WordPress 7.1.4 update exposes sites to attack due to vulnerability in update mechanism. By taking proactive steps to secure their websites, webmasters can reduce the risk of attacks.
WordPress 7.1.4 update addresses a vulnerable update mechanism, CVE-2026-119977, which affects versions 4.7 through 7.1.3.Installing the fix can expose sites to attack due to the temporary folder's vulnerability.Blocking web access to the wp-content/upgrade folder before updating can help prevent attacks.Manually updating outside the web root can also prevent attacks.Updating the updater regularly is crucial to ensure the latest security patches are applied.WordPress 4.6 and earlier no longer receive security updates.
In the ever-evolving landscape of web security, a new vulnerability has emerged, one that threatens the stability and integrity of websites built on the popular content management system, WordPress. The latest update, WordPress 7.1.4, has been released to address the actively exploited flaw, CVE-2026-119977, which affects versions 4.7 through 7.1.3. However, in a surprising twist, installing the fix can expose some sites to attack, raising questions about the security of the update process.
According to Umut Bayram, the Picus Security researcher who discovered the flaw, the update that installs the fix still unpacks its files using the site's old, unpatched code, creating a window of opportunity for an attacker to run code on the server. The researcher advises blocking web access to the site's wp-content/upgrade folder before updating, a measure that can help prevent attacks.
The flaw, tracked as CVE-2026-119977, is a result of a vulnerability in WordPress's core update mechanism. When a complete package is used, WordPress unpacks a copy of the new version into a temporary folder inside wp-content/upgrade. This folder contains the WordPress installer, and the web server can usually reach it. An attacker with no account who can determine the folder's name and access the installer before WordPress deletes the copy can end up running code on the server.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its catalog of known exploited vulnerabilities, highlighting the severity of the issue. WordPress released the fix last week in version 7.1.4 and in matching updates for older branches back to 4.7, all listed in its security advisory.
However, the update process itself can be a point of vulnerability. The fix gives the temporary folder a random name, but the update that installs the fix unpacks its files using the old code already on the site, as WordPress's updater code shows. On sites running 5.9 or later, the old code names the folder after the downloaded file, so the name can be predicted one last time.
The researcher advises blocking web access to the site's wp-content/upgrade folder before updating, a measure that can help prevent attacks. On Nginx, this can be achieved by adding a location block with a deny all directive, while on Apache, it requires adding a Require all denied block inside a Directory block for that folder in the virtual host configuration. If only editing .htaccess is possible, adding a RedirectMatch 403 directive to the .htaccess file in the WordPress root, above the WordPress rewrite rules, can also help prevent attacks.
The researcher also suggests a manual update done outside the web root, the folder the web server serves. Backing up the site files and database, unpacking the new release in a folder the web server does not serve, copying the core files into place without touching wp-config.php or wp-content, and then running the WordPress database update, can help prevent attacks.
WordPress 4.6 and earlier no longer receive security updates, so there is no fix for them. The researcher notes that the flaw goes back to WordPress 2.7, released in 2008, and that those sites should move to a supported version.
The situation highlights the ongoing cat-and-mouse game between attackers and defenders in the world of web security. As new vulnerabilities are discovered and patched, it is essential for webmasters to stay vigilant and implement measures to prevent attacks.
In the wake of this discovery, the cybersecurity community is urging webmasters to take proactive steps to secure their websites. By blocking web access to the wp-content/upgrade folder before updating, and by implementing manual updates outside the web root, webmasters can reduce the risk of attacks.
In addition, the researcher's advice to block web access to the site's wp-content/upgrade folder before updating can help prevent attacks. The use of a complete package for updates always includes the installer files, but a partial package holds only the files that changed between two releases. If those do not include the installer files, the temporary copy cannot run as a WordPress installation, and the installer never becomes reachable.
The deciding factor, according to the researcher, "isn’t partial versus complete. It’s whether the updater already installed on the site has been fixed." This highlights the importance of regularly updating the updater to ensure that the latest security patches are applied.
In conclusion, the WordPress 7.1.4 update has exposed some sites to attack due to a vulnerability in the update mechanism. By taking proactive steps to secure their websites, webmasters can reduce the risk of attacks. The use of a complete package for updates, blocking web access to the wp-content/upgrade folder before updating, and implementing manual updates outside the web root can help prevent attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Vulnerability-The-WordPress-714-Fix-and-the-Unforeseen-Consequences-of-Updating-ehn.shtml
https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
https://nvd.nist.gov/vuln/detail/CVE-2026-119977
https://www.cvedetails.com/cve/CVE-2026-119977/
Published: Fri Nov 6 11:53:05 2026 by llama3.2 3B Q4_K_M
