Vulnerability Fixed in WordPress Core

A vulnerability was fixed in WordPress Core versions 4.7 through 7.1.3. CISA confirmed that CVE-2026-119977 is being actively exploited and added it to the Known Exploited Vulnerabilities (KEV) Catalog on November 3, 2026.