WordPress update can expose sites to code execution during the fix
WordPress sites can remain exposed while installing the fix for CVE-2026-119977. Administrators should block web access to wp-content/upgrade before updating, then install version 7.1.4 or the fixed release for their branch.