WordPress core vulnerabilities: security patches 2020 to 2026
From WordPress 5.4.1 to 7.1.3, the complete record of the 27 releases that fixed core vulnerabilities since 2020: dates, backported branches, CVEs, severity and documented attacks.
Category
WordPress vulnerabilities
What WordPress exposes by default and flaws in its core: enumeration, REST API, XSS, fingerprints.
The WordPress REST API: what is public and how to restrict it
The /wp-json/wp/v2/users route reveals your authors' usernames. Here is what is public by default and how to restrict it properly.
How bots and detection tools recognize WordPress, and which clues to remove
The exact signals Wappalyzer and WPScan use to recognize WordPress, its versions and its plugins, and what you can remove without breaking anything.
How to stop WordPress user enumeration
A bot does not need to guess your usernames: WordPress publishes several of them by default. The five sources of leaks, how to test your site…