What the WordPress 4.7.0 to 7.1.1 file inclusion bug teaches about patch windows

A practical look at CVE-2026-87902, its exploitation preconditions and what the near-zero patch window means for site operators.