WordPress Core versions 4.7 through 7.1.3 contain a remote code execution vulnerability due to predictable, web-accessible staging paths during full-package core upgrades. This flaw allows unauthenticated attackers to execute code on the server during the upgrade window.