WordPress patch installation enables code execution window

A researcher discovered that installing WordPress patches for an actively exploited vulnerability leaves a temporary attack window. The update unpacks files using the old unpatched code before applying the fix, allowing attackers to execute code on servers during the installation process. Site administrators should take web access offline or block external traffic before patching to prevent exploitation during this critical window.