Picus Security

WordPress sites can be attacked while installing a fix for an exploited flaw

Researcher Umut Bayram of Picus Security◼ found that the update installing the fix for an actively exploited WordPress◆ flaw still unpacks files using the site's old, unpatched code. An attacker who strikes at the right moment can execute code on the server. The researcher advises blocking web access to the site during the update, though the article is cut off before giving the full guidance.