CVE-2026-119977

A flaw was found in WordPress. During core package upgrades, temporary files are placed into predictable, web-accessible staging directories. An unauthenticated remote attacker could exploit this condition during an upgrade window to access these staging paths and achieve arbitrary code execution...