Some WordPress sites remain open to attack while they install a fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found the issue. The update unpacks its files using the site's old, unpatched code. An attacker who strikes at the right moment can run code on the server.
The researcher advises blocking web access to the