Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core 

On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise.
The post Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core appeared first on Wordfence.WordfenceRead More