Wordpress WordPress CVE-2026-119977 security fix 7.1.4

Heads up, WordPress CVE-2026-119977 security vulnerability fixed in 7.1.4 release.

The fix was already reported, but known exploitation is new. The flaw can be reached during a vulnerable core update; it is not a claim that every visit to an unpatched site triggers it. WordPress 7.1.4 fixes it, with backports to maintained older branches down to 4.7.

Verify that each site actually runs its appropriate fixed release and review for compromise where warranted. WordPress advisory

---