WordPress has released four security updates for the core in 41 days: 7.1.1 on September 17, 7.1.2 on September 22, 7.1.3 on October 6, and 7.1.4 on October 28. Since mid-July, seven such updates have appeared, which together close more than 50 security vulnerabilities rated critical and high. Background information and new processes are described in the interim review of the Core Security Initiative.
Since August 28, the initiative is meant to speed up updates and track down vulnerabilities before anyone reports them from outside.
Why are there so many security updates?
The number of reported vulnerabilities has risen sharply in 2026. WordPress collects such reports through a bug bounty program on the HackerOne platform and pays rewards there for discovered security vulnerabilities. For around ten years, 20 to 30 reports came in per month, whereas in July there were 450 and in August 773. Since the beginning of the year, more than 3,000 reports have accumulated, more than in the twelve years before combined. WordPress attributes a large share of them to serious security research, which progresses faster with AI tools.
Security reports to WordPress per month
Submissions to the bug bounty program on HackerOne, excluding spam and invalid reports
- For around ten years20–30
- July 2026450
- August 2026773
For the years before 2026, WordPress only gives a range, not monthly figures
Source: WordPress Security
To cope with the onslaught, the security team itself relies on AI. A system reads every incoming report, reproduces the reported bug in a protected test environment, and proposes a severity rating; the decision is still made by security researchers. The queue of unreviewed reports shrank from 359 to a two-digit number. The same tools now also search for vulnerabilities in the core themselves, using freely downloadable language models. In addition, WordPress participates in Anthropic's OSS Scanner, which checks open-source projects free of charge. Two of the security vulnerabilities that WordPress 7.1.4 closes were reported by Anthropic.
What is changing about the updates?
Security updates now appear in two waves. First, the most widely used WordPress versions receive their fix, then the older version series down to 4.7. Only the latest version is actively supported. WordPress carries out the backporting to older version series voluntarily; for 7.1.4 it was still ongoing after the release.
For each update, a fixed team is on standby, from the lead through package building to someone who enables the automatic updates and language packs on WordPress.org. 73 percent of the 109 work steps are now automated. Building the finished packages deliberately remains reserved for a small group, to make attacks on the supply chain more difficult.
What this means for you
The short cadence is likely to stay as long as so many reports keep coming in. Automatic updating therefore protects you best: existing installations install maintenance and security updates on their own, and since WordPress 5.6, newly created sites also install the major version jumps. Under Dashboard > Updates you can see which variant applies to your website.
- It is best to check yourself or with your agency whether the wp-config.php file contains
AUTOMATIC_UPDATER_DISABLED or WP_AUTO_UPDATE_CORE with the value false. Both entries turn off automatic updates for the core. - If your website still runs on an older, rarely used version series, the fix only arrives there with the second wave. Switching to 7.1 shortens the time a known security vulnerability stays open on your site.
- The initiative only concerns the WordPress core. WordPress updates plugins and themes by itself only in special cases; the security team decides what those are. In the plugin overview, you can enable automatic updates for each plugin individually.
For the vulnerability in the update process that 7.1.4 closes, Wordfence has been counting targeted attack attempts since October 28. If you look after your website yourself, a beginner course on WordPress explains the basics starting with installation.
WordPress published the interim review on October 29, 2026.
Sources
