Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core wordfence.com

Wordfence reports attackers are already probing for CVE-2026-119977, an unauthenticated remote code execution flaw in core that can be triggered during an upgrade and affects 4.7 through 7.1.3. If you look after client sites, check they are on 7.1.4 or the backported release for their branch.

Read it on Wordfence