WordPress Core Update Window Allows Predictable Folder Exploitation in CVE-2026-119977

WordPress 4.7 through 7.1.3 unpacks full update packages into wp-content/upgrade using the vulnerable code, naming the folder after the downloaded file on versions 5.9 and later. An unauthenticated attacker who guesses the name can reach the temporary installer, configure a malicious database, and execute PHP before deletion occurs. The fix in 7.1.4 randomizes the folder but ships inside the same vulnerable unpack routine. Procurement records and WordPress.org update service logs show partial packages for intra-branch updates and full packages for cross-branch moves, both carrying the installer. CISA added the CVE to its exploited list the same week the advisory dropped. Independent analysis of the updater code confirms the window exists regardless of automatic or manual triggers. Blocking web access to wp-content/upgrade via server config eliminates the exposure without breaking the update process. Sites on 4.4-5.8 already receive partial randomization, reducing the risk surface. The pattern reveals that update mechanisms themselves must be hardened before deployment, not after. Widespread exposure will persist for any site applying the patch without the folder block in place, particularly those on 5.9-7.1.3 receiving full packages.