---
title: "WordPress Core Security Initiative: Two Months In"
url: https://nexterwp.com/blog/wordpress-core-security-initiative/
date: 2026-11-03
modified: 2026-11-03
lang: en
author: "Aditya Sharma"
description: "Four WordPress security releases in 41 days. Here are the numbers from the Core Security Initiative update and what to do on your sites."
image: https://nexterwp.com/wp-content/uploads/2026/11/nexter-wordpress-core-security-initiative-featured-1024x538.webp
word_count: 624
---

# WordPress Core Security Initiative: Two Months In

## Key Takeaways

- WordPress Core Security Initiative ships four security releases in 41 days, including 7.1.1 on September 17 and 7.1.4 on October 28.
- WordPress HackerOne receives 450 reports in July and 773 in August, with more than 3,000 reports so far this year.
- AI-powered triage closes nearly 3,000 reports this year and cuts the untriaged queue from 359 to double digits.
- WordPress security releases now use two waves and automation covers 73% of the 109 steps, while backporting reaches every branch still receiving security updates back to 4.7.

WordPress has shipped four security releases in 41 days. That is the headline of the Core Security Initiative update the WordPress Security Team posted on October 29, 2026, two months after the initiative launched. The numbers behind it explain why releases have felt so frequent.

This guide summarises the update, explains what the report volume means for site owners, and lists what you should do on your own sites. Every figure comes from the official [Core Security Initiative: two months in](https://make.wordpress.org/security/2026/10/29/the-core-security-initiative-two-months-in/) post.

Table of Contents

## The Volume Of Reports

For about a decade, the WordPress HackerOne program received 20 to 30 reports a month. In July it received 450, and in August 773. The program page shows 2,306 reports in the past 90 days, and more than 3,000 so far this year, which the team says is more than the previous twelve years combined.

The post says much of this is real research made faster by AI tools, and that it is making WordPress safer. It also means triage, fixing, backporting, testing and shipping all have to speed up.

## Three Pillars

| Pillar | What the team reports |
| ------ | --------------------- |
| A better release process | Four security releases in 41 days: 7.1.1 on September 17, 7.1.2 on September 22, 7.1.3 on October 6 and 7.1.4 on October 28. Seven core security releases since mid July, with more than 50 Critical or High vulnerabilities closed |
| Breaking the backlog | Program scope was narrowed on September 1. An AI-powered triage system reproduces reports and recommends a verdict while researchers make the final call. Nearly 3,000 reports closed this year, and the untriaged queue fell from 359 to double digits |
| Crush vulnerabilities with AI | The triage tooling now also hunts for bugs in core before anyone reports them, and WordPress enrolled in Anthropic’s OSS Scanner, with Anthropic credited in release announcements |

## How Releases Got Faster

Each security release now has a set squad with clear roles: a release host, core committers, someone to build packages, a WordPress.org committer to turn on auto-updates and language packs, a HelpHub editor and a Gutenberg lead. Releases ship in two waves, with the most widely used versions first and older branches after, so most sites are protected as early as possible.

Automation covers 73% of the 109 steps in a security release. Backporting a fix used to mean running scripts by hand across up to 25 branches. Every fix went to every branch still receiving security updates, back to 4.7. Some friction remains on purpose: only a small group can package a release, which helps guard against supply chain attacks.

***Also Read:** [WordPress 7.1.4 Security Release](https://nexterwp.com/blog/wordpress-7-1-4-security-release/) for what the latest release in this run fixed.*

## What This Means For Your Sites

- **Keep auto-updates on.** Releases now come in quick succession, and the two-wave rollout assumes sites update on their own.
- **Check version numbers.** A site with auto-updates off can sit several releases behind.
- **Update plugins too.** Core fixes do not patch plugin code.
- **Expect more releases.** The report volume is high, and the team is building the process to keep up.

## How People Can Help

The post asks researchers to read the updated guidelines before reporting through HackerOne, since one clear, high-impact report helps more than ten out-of-scope ones. Organisations that rely on WordPress are asked to sponsor people for triage and release work and to contribute to the bounty program. Contributors can use the open release tooling in core-release-utils and help test packages on release days.

## What This Doesn’t Cover

This guide reports the team’s own figures and does not verify them independently. It does not list individual vulnerabilities, which are covered in each release announcement. For the specific releases, read the guides below.

#### Suggested Reading

- [WordPress 7.1.2 Security Update](https://nexterwp.com/blog/wordpress-7-1-2-security-update/)
- [The Critical PHP Security Release](https://nexterwp.com/blog/php-security-release/)
- [WordPress Plugin Security Review](https://nexterwp.com/blog/wordpress-plugin-security-review/)

#### Stay updated with Helpful WordPress Tips, Insider Insights, and Exclusive Updates – Subscribe now to keep up with Everything Happening on WordPress!

Subscribe

## Frequently Asked Questions

**Q: Why are WordPress security releases happening so often right now?**
A: The pace comes from the report volume, not random churn. The WordPress HackerOne program went from about 20 to 30 reports a month for years to 450 in July and 773 in August, with 2,306 reports in the past 90 days. That surge means triage, fixing, backporting, testing, and shipping all have to move faster. The team says much of the increase is real research accelerated by AI tools.

**Q: What should site owners do when WordPress security releases come in quick succession?**
A: Keep auto-updates on and watch version numbers closely. The update process now ships in two waves, with the most widely used versions first and older branches after, so sites that update themselves get protected earlier. A site with auto-updates off can sit several releases behind, which matters when four security releases land in 41 days. Core fixes also do not patch plugin code, so plugins still need separate attention.

**Q: Does the WordPress core security initiative cover plugin vulnerabilities too?**
A: No. This update is about core security work, release speed, and triage capacity. It does not list individual vulnerabilities, and plugin issues are handled in separate release announcements such as [WordPress Plugin Security Review](https://nexterwp.com/blog/wordpress-plugin-security-review/). That separation matters because a clean core update does not fix vulnerable plugin code, so site owners still need to track plugin updates independently.

**Q: How did WordPress get security fixes out faster?**
A: The release process was reorganized around a dedicated squad with clear roles: a release host, core committers, someone to build packages, a WordPress.org committer for auto-updates and language packs, a HelpHub editor, and a Gutenberg lead. Automation now covers 73% of the 109 steps in a security release. That reduces manual backporting work across branches while still keeping some packaging control tight to reduce supply chain risk.

**Q: What changed in WordPress vulnerability triage after the initiative started?**
A: The backlog got attacked from both ends: scope was narrowed on September 1, and an AI-powered triage system now reproduces reports and recommends a verdict while researchers make the final call. Nearly 3,000 reports were closed this year, and the untriaged queue fell from 359 to double digits. The practical effect is less backlog drag and faster movement from report to shipped fix.

**Q: How can researchers or organizations help with WordPress core security work?**
A: Researchers are being asked to read the updated guidelines before filing through HackerOne so one clear high-impact report beats a pile of out-of-scope ones. Organizations that depend on WordPress can sponsor people for triage and release work and contribute to the bounty program. Contributors can also use the open release tooling in core-release-utils and help test packages on release days.