Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

A WordPress flaw that is currently being exploited can still be attacked during the installation of the fix. This is because the update process uses the site's old, unpatched code to unpack its files, creating a brief window of vulnerability. If an attacker strikes at the right moment, they can run code on the server. The researcher who discovered the flaw recommends blocking web access to prevent this final exploitation opportunity. The vulnerability can be exploited one last time if the update is not installed carefully.