Race Condition in WordPress Core Update Process Leaves Sites Vulnerable During Patching

WordPress site administrators applying core updates for an actively exploited flaw may inadvertently leave their sites exposed to remote code execution, according to Umut Bayram of Picus Security. The vulnerability stems from a race condition in the update mechanism: while the new files are being unpacked, the process relies on the site's old, unpatched code. An attacker who times an exploit to hit the server during this specific window can run arbitrary code, potentially compromising the site despite the update being in progress.

The issue was disclosed after it was found that the update package unpacks files using legacy code paths that have not been secured by the latest patch. This creates a time-of-check to time-of-use race condition. Bayram advised that, until a permanent fix is integrated, site operators should block web access to the update directory—typically via .htaccess or server configuration—to eliminate the exposure window.

The advisory does not detail a code-level patch for the race condition itself; rather, the mitigation focuses on restricting access to the update directory during the vulnerable phase of the update process.