WordPress Core RCE Vulnerability: Upgrade-Window Race Condition Guide
On October 28, 2026, the WordPress security team deployed an emergency maintenance release: WordPress 7.1.4. While the release notes listed fixes for 22 individual bugs, security researchers and threat intelligence desks immediately focused on one critical item: an unauthenticated Remote Code Execution (RCE) vulnerability tracked as CVE-2026-119977 with a CVSS score of 8.1. The vulnerability affects every WordPress Core release from version 4.7 up through 7.1.3. Within hours of the advisory goi…