CVE-2026-119977 is a high-severity race condition in WordPress Core. During a full core upgrade, predictable staging paths can let an unauthenticated attacker run code on the server. WordPress released 7.1.4 on October 28 to fix it. On November 3, CISA added the CVE to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Around the same time, Wordfence reported blocking 13,095 attacks targeting the flaw in a single day.
Why it matters: a large share of small-business websites run WordPress. If your site auto-updates, you may already be patched — but you should still confirm.
One step today: in wp-admin → Updates, check that you are on 7.1.4 (or the patched release for your branch). If you are behind, update now, and review who has admin access.
Questions about keeping your site current? Call (818) 791-0055 or visit contact VanquishNet.
Sources: CISA, WordPress, BleepingComputer.