On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise.
This article has been indexed from Blog – Wordfence
Read the original article:
Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core