WordPress CVE-2026-119977 Exploited: Update to 7.1.4 Now
CVE-2026-119977 in WordPress core is actively exploited. Update to 7.1.4, block wp-content/upgrade in nginx or Apache, and check for compromise.
CVE-2026-119977 in WordPress core is actively exploited. Update to 7.1.4, block wp-content/upgrade in nginx or Apache, and check for compromise.
Fix “Another update is currently in progress” in WordPress: find the core_updater.lock row, delete it safely with WP-CLI or SQL, and update.
WordPress 7.2 adds a /random/ URL that is on by default. Turn it off with one filter, or exclude post types and categories from it.
WordPress returns HTTP 500 and auto-updates fail when the hosting disk quota is full. Find what fills the disk, free space safely and repair core.
WP Rocket preload failing with 403 or status code 0? Find the block in your access log and allowlist the preload requests in your WAF or Cloudflare.
Every wp-admin screen sends you to profile.php? Check your capabilities with WP-CLI, rule out the object cache and log the file that redirects.
WP_DEBUG_LOG is on but debug.log stays empty? Find where PHP really logs, fix constants, permissions and overrides, then move the log off the web root.
WordPress 7.1 resizes editor uploads in the browser and skips server image hooks. Check if it runs, disable it with one filter, or keep it safely.
Site Health says the loopback request failed and cron returns status code 0? Find the DNS or firewall cause and run WP-Cron from a real server cron.