WordPress Core CVE-2026-119977 (CVSS 8.1): Race Condition RCE in the Upgrade Window, Now Actively Exploited in CISA KEV – Patch to 7.1.4
If you run WordPress, this is a stop-and-update alert. CISA added a high-severity WordPress Core flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming attackers are exploiting it in the wild. Tracked…