Tag
#race condition
WordPress Core Upgrade-Window RCE, Fixed in 7.1.4 (CVE-2026-119977)
WordPress 4.7 to 7.1.3 stages core updates in a predictable, web-served path that unauthenticated attackers race to execute code; fixed in 7.1.4.
Oct 31, 2026