Security
WordPress core update flaw CVE-2026-119977 is now on CISA's exploited list: check you're on 7.1.4
CISA added CVE-2026-119977, a race condition in WordPress core's own updater, to its Known Exploited Vulnerabilities catalog on November 3. It affects WordPress 4.7 through 7.1.3 and can give an unauthenticated attacker code execution during a core update, so every self-hosted site should confirm it is on 7.1.4 or its branch's latest release.