WordPress 7.1.4 fixes CVE-2026-119977, an actively exploited core flaw, but the update that installs the fix can still leave a temporary installer reachable under wp-content/upgrade for a few seconds. A safe WordPress core update this week means blocking that folder on the web first, then updating, then checking what changed.
