Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The report was published by The Hacker News on Nov 06, 2026.

The problem is in the order of operations. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. In other words, the patch arrives through the same door the bug left open.

Bayram's advice is to block web access to something during the update, but the retained text cuts off before it says what. That's the part we'd want before acting on it, and it's the part we don't have. The source also doesn't name the affected plugin or core component, the version range, or a CVE, and it gives no figure for how many sites are exposed. The flaw is described as actively exploited; nobody in the retained text says by whom or against whom.

What's left is a timing problem rather than a missing patch. If you run WordPress and haven't updated yet, the update itself is the risky step, so plan it rather than firing it off from a browser tab. We'd wait for the full advisory before deciding what to block.

Still unknown: which component is affected, and whether the window is seconds or longer.