The WordPress 7.1.4 security release fixes CVE-2026-119977, an actively exploited core flaw, but the old, vulnerable updater is what installs it, which can leave a site open for a few seconds. If you suspect your WordPress site was hacked after the update, here is how to check, and how to close that window before you patch.
