Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

Security researchers warn that installing an active WordPress security update can temporarily expose sites to remote code execution attacks. Because the patch unpacks using old, unpatched code, attackers can exploit a window of vulnerability during the update process. Administrators are advised to block web access to specific directories while applying patches.