WordPress sites can be attacked while installing a fix for an exploited flaw

Picus Security◼ researcher Umut Bayram reports that the WordPress◆ update which installs the fix for an actively exploited flaw unpacks its files using the site's old, unpatched code, leaving a window in which an attacker can achieve code execution on the server. No CVE identifier or affected version range is given in the excerpt. Defenders should block web access to the site while the update runs, as the researcher advises; the rest of the guidance was not included in the source text.

For security analysts · Written by AI from 1 source · Wrong?