WordPress administrators are being urged to restrict access to a temporary update directory before applying fixes for CVE-2026-119977, an actively exploited vulnerability affecting WordPress versions 4.7 through 7.1.3.
According to security researcher Umut Bayram of Picus Security, some sites may remain exposed during the update process itself. Although WordPress 7.1.4 and supported branch releases address the issue, older updater code can still unpack the update package into a web-accessible temporary directory before the new protections take effect.
The issue centers on files placed under wp-content/upgrade. During certain core updates, WordPress extracts a full release package in that location. If an attacker can predict or discover the temporary folder name and reach installer files before they are removed, they may be able to execute code with the web server's permissions.
CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. Wordfence reported seeing attack activity shortly after it released a firewall rule for the flaw, including behavior consistent with attempts to target sites while updates were in progress.
Who may be affected
The level of exposure depends on the update package delivered to a site. Full packages include installer components, while partial packages may not. Sites upgrading between major or older WordPress branches are more likely to receive full packages. On WordPress 5.9 and later, the older updater may use a predictable temporary directory name, increasing the risk during the transition to a fixed version.
Recommended mitigation
Administrators should deny web requests to wp-content/upgrade before running an update, while allowing WordPress to continue using the directory locally. The restriction can be applied in the web server configuration or, where necessary, through an appropriate root-level Apache rule.
- Confirm that requests to the upgrade directory return an access-denied response.
- Install WordPress 7.1.4 or the fixed release available for the supported branch in use.
- Consider manually updating core files from a location outside the web root if server controls cannot be changed.
- Review logs and files for unexpected requests or PHP files within wp-content/upgrade, as well as unfamiliar administrator accounts or plugins.
WP-CLI's standard core update command may not eliminate the concern because it uses the same underlying updater workflow. WordPress versions 4.6 and earlier are unsupported and should be migrated to a maintained release.