Unauthenticated RCE in WordPress core 4.7–7.1.3 via a TOCTOU race during full-package core upgrades. Predictable, web-accessible staging paths used by the upgrader allow an attacker to execute server-side code during the upgrade window. Cisa confirms active exploitation of this CVE. Upgrade to patched versions 7.1.4, 7.0.8, 6.9.11, or 4.7.39 to mitigate.