Installing the fix for an exploited WordPress flaw can expose some sites one last time

CVE-2026-119977 affects WordPress versions 4.7 through 7.1.3. The flaw is fixed in version 7.1.4 and corresponding releases for older branches, but the update that installs the fix still uses the site's old, unpatched updater code. An unauthenticated attacker who acts at the right moment may execute code on the server through the temporary WordPress copy. The source describes active exploitation.