WordPress CVE-2026-119977: Upgrade-Window RCE

Every full core update on unpatched WordPress (4.7 through 7.1.3) opens a gap of a few seconds. During it, a complete copy of WordPress, installer included, sits in a folder under wp-content/upgrade/,