WordPress Core upgrade race condition flaw actively exploited, CISA says
Attackers are exploiting a race condition in WordPress Core that lets unauthenticated users run code on the server during a full-package core upgrade. CISA added CVE-2026-119977 to its KEV catalog on November 3, 2026, citing evidence of active exploitation. Update to WordPress 7.1.4 now.
CVE-2026-1199771 min