Two months ago we launched the Core Security Initiative: three pillars, one goal, a stronger and safer WordPress. Here’s where it stands, what we’ve changed, and how you can help.
The volume
For about a decade, the WordPress HackerOne program received 20 to 30 reports a month. In July it received 450. In August it received 773. The program page currently shows 2,306 reports in the past 90 days. We’ve received more than 3,000 reports this year, which is more than the previous twelve years combined.
A lot of this is real research made faster by AI tools, and it’s making WordPress safer. It also means everything after a report lands (triage, fixing, backporting, testing, shipping) has to move faster too. That’s what this initiative is for.
A: A better release process
WordPress has shipped four security releases in 41 days: 7.1.1 on September 17, 7.1.2 on September 22, 7.1.3 on October 6, and 7.1.4 on October 28. That’s seven core Core is the set of software required to run WordPress. The Core Development Team builds WordPress. security releases since mid July, with more than 50 Critical or High vulnerabilities closed. Every fix went to every branch still receiving security updates, all the way back to 4.7.
Each release has a set squad filled by trusted and experienced contributors with clear roles: a release host, core committers, someone on Mission Control to build packages, a WordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ committer to turn on autoupdates and language packs, a HelpHub editor, and a Gutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc.
https://wordpress.org/gutenberg/ lead. Everyone knows their part before release day. Releases ship in two waves, the most widely used versions first, then older branches, so most sites get protected as early as possible.
We’re also automating the slow parts. Backporting a fix used to mean running scripts by hand across up to 25 branches, for every fix. Tools that aren’t security sensitive live in public in core-release-utils. Today, 73% of the 109 steps in a security release have automation. Some friction stays on purpose e.g. only a small group can package a release, which helps protect against things like supply chain attacks.
B: Breaking the backlog
On September 1st we updated the program’s scope to focus researchers on issues with clear security impact. We’ve also developed an AI powered triaging system that reads incoming reports, reproduces them securely, and posts a summary and a recommendation (is it valid, how severe, etc) and our security researchers still make the final call. We’ve closed nearly 3,000 reports this year. The untriaged queue went from 359 to double digits, and we’re working to keep it there.
C: Crush vulnerabilities with AI
Reacting to reports isn’t enough, we want to find bugs before anyone else does. The agentic tooling we built to triage incoming reports, which reads the code and checks whether a report holds up, is now pointed the other way: hunting for vulnerabilities in core before anyone reports them. We’re running it with open weight models and purpose built harnesses, and what it finds goes through the same release process.
We also enrolled WordPress in Anthropic’s OSS Scanner which gives open source Open Source denotes software for which the original source code is made freely available and may be redistributed and modified. Open Source **must be** delivered via a licensing model, see GPL. projects free security scans with Anthropic’s strongest models and we’ve already started addressing the issues flagged by the first scan results, with Anthropic credited in the release announcements.
How you can help
Researchers: read the updated guidelines before you report through HackerOne. One clear, high impact report helps more than ten informative or out of scope reports.
Organizations: if your business runs on WordPress, help us keep this pace! The most useful help is sponsoring people for triage and release work, and contributing to the bounty program.
Contributors: the release tooling is open in core-release-utils, and on release days you can help test packages in #core on Making WordPress Slack.
Thank you to everyone on the security team, the core committers, and every contributor who’s been part of this. We’re on it, and there’s room for more people to join us.
