CISA added WordPress Core CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3. The federal deadline is November 6. Update to WordPress 7.1.4 to close the upgrade-window race condition before attackers catch your site mid-update.
