WordPress Core flaw allows code execution during upgrades
The NVD says an unauthenticated attacker could execute code on a server during a full-package WordPress Core upgrade. Operators should apply vendor mitigations by November 6, 2026, or discontinue use if mitigations are unavailable.