{ "title": "WordPress core vulnerabilities: security patches 2020 to 2026", "seo_title": "WordPress security releases and exploits, 2020 to 2026", "h1": "WordPress core vulnerabilities: security patches 2020 to 2026", "description": "27 WordPress core security releases since 2020: dates, backports, CVEs, severity, exploited vulnerabilities and the end of support for old branches.", "lead": "From WordPress 5.4.1 to 7.1.3, the complete record of the 27 releases that fixed core vulnerabilities since 2020: dates, backported branches, CVEs, severity and documented attacks.", "language": "en", "locale": "en-US", "type": "article", "url": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/", "canonical": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/", "markdown": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/index.md", "json": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/index.json", "published": "2026-10-25T08:00:00+00:00", "modified": "2026-10-28T23:00:42+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "WordPress core vulnerabilities: security patches 2020 to 2026", "url": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/", "markdown": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/index.md", "json": "https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Failles du cœur WordPress : les correctifs de 2020 à 2026", "url": "https://www.wp-masquerade.com/fr/chronologie-failles-coeur-wordpress/", "markdown": "https://www.wp-masquerade.com/fr/chronologie-failles-coeur-wordpress/index.md", "json": "https://www.wp-masquerade.com/fr/chronologie-failles-coeur-wordpress/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Vulnerabilidades del núcleo de WordPress: parches de 2020 a 2026", "url": "https://www.wp-masquerade.com/es/cronologia-fallos-nucleo-wordpress/", "markdown": "https://www.wp-masquerade.com/es/cronologia-fallos-nucleo-wordpress/index.md", "json": "https://www.wp-masquerade.com/es/cronologia-fallos-nucleo-wordpress/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "WordPress-Core: Sicherheitslücken und Patches von 2020 bis 2026", "url": "https://www.wp-masquerade.com/de/wordpress-core-sicherheitsluecken-chronologie/", "markdown": "https://www.wp-masquerade.com/de/wordpress-core-sicherheitsluecken-chronologie/index.md", "json": "https://www.wp-masquerade.com/de/wordpress-core-sicherheitsluecken-chronologie/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Vulnerabilità del core di WordPress: le patch dal 2020 al 2026", "url": "https://www.wp-masquerade.com/it/cronologia-vulnerabilita-core-wordpress/", "markdown": "https://www.wp-masquerade.com/it/cronologia-vulnerabilita-core-wordpress/index.md", "json": "https://www.wp-masquerade.com/it/cronologia-vulnerabilita-core-wordpress/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Vulnerabilidades do núcleo do WordPress: correções de 2020 a 2026", "url": "https://www.wp-masquerade.com/pt/cronologia-falhas-nucleo-wordpress/", "markdown": "https://www.wp-masquerade.com/pt/cronologia-falhas-nucleo-wordpress/index.md", "json": "https://www.wp-masquerade.com/pt/cronologia-falhas-nucleo-wordpress/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Kwetsbaarheden in de WordPress-core: alle patches van 2020 tot 2026", "url": "https://www.wp-masquerade.com/nl/tijdlijn-kwetsbaarheden-wordpress-core/", "markdown": "https://www.wp-masquerade.com/nl/tijdlijn-kwetsbaarheden-wordpress-core/index.md", "json": "https://www.wp-masquerade.com/nl/tijdlijn-kwetsbaarheden-wordpress-core/index.json" } ], "headings": [ { "level": 1, "text": "WordPress core vulnerabilities: security patches 2020 to 2026" }, { "level": 2, "text": "WordPress core in brief" }, { "level": 2, "text": "Timeline of security releases" }, { "level": 3, "text": "2020: three releases, 23 vulnerabilities" }, { "level": 3, "text": "2021: four releases, 7 vulnerabilities" }, { "level": 3, "text": "2022: four releases, 26 vulnerabilities" }, { "level": 3, "text": "2023: four releases, 14 vulnerabilities" }, { "level": 3, "text": "2024 and 2025: the quiet years" }, { "level": 3, "text": "2026: eight releases, 44 vulnerabilities" }, { "level": 2, "text": "What the numbers show" }, { "level": 2, "text": "Backports and automatic updates" }, { "level": 2, "text": "What this means for you" }, { "level": 3, "text": "Key takeaways" }, { "level": 2, "text": "Sources" }, { "level": 2, "text": "WordPress security, without the noise", "id": "wpm-nl-box-title" } ], "body": "Between January 2020 and October 22, 2026, WordPress published 27 releases that fix vulnerabilities in its core, for a total of 122 distinct fixes. This record goes through every official announcement, release by release: date, backported branches, vulnerability types, CVEs, published severity and who reported them. Afterwards, you will know how to read a security announcement and decide how fast to act.\n\n## WordPress core in brief\n\nThe core is the software shared by every WordPress site, before plugins and themes. A dedicated security team receives reports, notably through HackerOne, and ships fixes in minor releases (7.1.2, 7.1.3). A core vulnerability therefore potentially affects every site.\n\nYet the core accounts for only a small share of the ecosystem's vulnerabilities. According to Patchstack's annual report, 11,334 new vulnerabilities were recorded in 2025: 91% in plugins, 9% in themes, and only 6 in the core, all of them low priority. See our [Elementor](https://www.wp-masquerade.com/elementor-security-vulnerabilities/), [WooCommerce](https://www.wp-masquerade.com/woocommerce-security-vulnerabilities/) and [LiteSpeed Cache](https://www.wp-masquerade.com/litespeed-cache-security-vulnerabilities/) timelines. For the major episodes, read our history of core vulnerabilities; this article is the release-by-release register.\n\n## Timeline of security releases\n\nMethod: we reread every \"Releases\" and \"Security\" announcement on wordpress.org since 2020 and kept those that fix at least one vulnerability (not pure maintenance releases such as 5.5.3 or 6.6.2). The backported version numbers come from the official release archive.\n\n![Timeline from 2020 to 2026: 5.4.1 (April 2020), critical 5.5.2 (October 2020), 5.7.2 (May 2021), 5.8.3 (January 2022), 6.0.3 with 16 vulnerabilities (October 2022), end of branches 3.7 to 4.0 (December 2022), 6.3.2 (October 2023), 6.4.3 (January 2024), end of branches 4.1 to 4.6 (July 2025), 6.9.2 and 6.9.4 (March 2026), 7.0.2 wp2shell exploited (July 2026), 7.0.3 (August 2026), 7.1.2 exploited (September 2026), 7.1.3 (October 2026)](https://www.wp-masquerade.com/media/2026/10/chronologie-versions-securite-wordpress-en.webp)\n\n*Key releases and reductions in backporting; two vulnerabilities fixed in 2026 were exploited.*\n\nThe \"Severity\" column gives the highest [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) published for the release, by the NVD or by the authority that assigned the [CVE](https://www.wp-masquerade.com/glossary/cve/) (CNA). WordPress rarely publishes one; when there is no score, we write \"not published\".\n\n### 2020: three releases, 23 vulnerabilities\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| April 29, 2020 | 5.4.1, plus 3.7.33 to 5.3.3 | 7: five XSS (Customizer, search block, object cache, file uploads), password reset link not invalidated, private posts visible without an account | CVE-2020-11025 to CVE-2020-11030 | 8.1 (NVD) | Muaz Bin Abdus Sattar, Jannes, Evan Ricafort and others |\n| June 10, 2020 | 5.4.2, plus 3.7.34 to 5.3.4 | 6: XSS (block editor, media, theme upload), open redirect, privilege escalation via set-screen-option, comments on protected posts visible | CVE-2020-4046 to CVE-2020-4050, CVE-2020-25286 | 6.8 (NVD) | Sam Thomas, Simon Scannell (RIPS) and others |\n| October 29, 2020 | 5.5.2, plus 3.7.35 to 5.4.3 | 10: deserialization, two privilege escalations via XML-RPC, denial of service leading to code execution, file deletion, XSS, CSRF, unwanted embeds on multisite | CVE-2020-28032 to CVE-2020-28040 | 9.8 (NVD) | Sucuri, RIPS, WPScan, Justin Tran and others |\n\n*WordPress core security releases in 2020*\n\n### 2021: four releases, 7 vulnerabilities\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| April 15, 2021 | 5.7.1, plus 4.7.20 to 5.6.3 | 2: XXE in the Media Library under PHP 8, disclosure of password-protected content via the editor | CVE-2021-29447, CVE-2021-29450 | 6.5 (NVD), 7.1 (CNA GitHub) | SonarSource, Mikael Korpela |\n| May 13, 2021 | 5.7.2, plus 3.7.36 to 5.6.4 | 1: object injection in the PHPMailer library | CVE-2020-36326, CVE-2018-19296 | 9.8 (NVD) | Fix by the security team |\n| September 9, 2021 | 5.8.1, plus 5.2.12 to 5.7.3 | 3: data exposure via the REST API, XSS in the editor, Lodash update | CVE-2021-39200, CVE-2021-39201, CVE-2021-23337 | 7.2 (NVD, Lodash) | Michał Bentkowski (Securitum), security team |\n| November 10, 2021 | 5.8.2, plus 5.2.13 to 5.7.4 | 1: removal of the expired DST Root CA X3 root certificate | None | Not published | Not specified |\n\n*WordPress core security releases in 2021*\n\n### 2022: four releases, 26 vulnerabilities\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| January 6, 2022 | 5.8.3, plus 3.7.37 to 5.7.5 | 4: SQL injections in WP_Query and WP_Meta_Query, XSS via slugs, object injection on multisite | CVE-2022-21661 to CVE-2022-21664 | 8.8 (NVD) | SonarSource, ngocnb and khuyenn via Trend Micro ZDI, security team |\n| March 11, 2022 | 5.9.2, plus 3.7.38 to 5.8.4 | 3: two JavaScript prototype pollutions (jQuery dependency, block editor), one stored XSS | None cited | Not published | Melar Dev, Johns Hopkins University, security team |\n| August 30, 2022 | 6.0.2, plus 3.7.39 to 5.9.4 | 3: possible SQL injection in the Links API, XSS on the Plugins screen, missing escaping in the_meta() | CVE-2022-4973 | 5.4 (NVD) | Fariskhi Vidyan, Khalilov Moe, security team |\n| October 17, 2022 | 6.0.3, plus 3.7.40 to 5.9.5 | 16: nine XSS (post by email, Customizer, comments, RSS blocks, search, featured image), SQL injection in WP_Date_Query, CSRF, open redirect, data leaks | CVE-2022-43497, CVE-2022-43500, CVE-2022-43504 | 6.1 (NVD) | JPCERT, Automattic, third-party audit and others |\n\n*WordPress core security releases in 2022*\n\n### 2023: four releases, 14 vulnerabilities\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| May 16, 2023 | 6.2.1, plus 4.1.38 to 6.1.2 | 5: shortcodes executed in block theme content, CSRF, XSS via oEmbed, KSES bypass, path traversal via translations | CVE-2023-2745 | 6.1 (NVD) | WP Engine, Securitum, Wordfence, third-party audit, security team |\n| May 20, 2023 | 6.2.2, plus 5.9.7 to 6.1.3 | Hardening of the 6.2.1 shortcode fix | None | Not published | Liam Gladdy (WP Engine) |\n| October 12, 2023 | 6.3.2, plus 4.1.39 to 6.2.3 | 8: shortcode execution by a logged-in user, POP chain, three XSS, leaks of emails and private comments, cache poisoning | CVE-2023-38000, CVE-2023-39999, CVE-2023-5561 | 6.5 (CNA Patchstack) | Automattic, Patchstack and others |\n| December 6, 2023 | 6.4.2 only (vulnerability introduced in 6.4) | 1: POP chain leading to code execution, not exploitable on its own | CVE-2024-31211 | 9.8 (NVD), 5.5 (CNA GitHub) | Not specified |\n\n*WordPress core security releases in 2023*\n\n### 2024 and 2025: the quiet years\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| January 30, 2024 | 6.4.3, plus 4.1.40 to 6.3.3 | 2: PHP file upload via the plugin installer (administrator required), POP chain | CVE-2024-31210 | 8.8 (NVD) | m4tuto, Pentest Ltd via Trend Micro ZDI |\n| April 9, 2024 | 6.5.2, plus 6.0.8 to 6.4.4 | 1: XSS in the Avatar block | CVE-2024-4439 | 7.2 (CNA Wordfence) | Security team |\n| June 24, 2024 | 6.5.5, plus 4.1.41 to 6.4.5 | 3: XSS in the HTML API and the Template Part block, path traversal on Windows | CVE-2024-6307, CVE-2024-31111, CVE-2024-32111 | 6.5 (CNA Patchstack) | Patchstack, David Fifield and others, security team |\n\n*WordPress core security releases in 2024*\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| September 30, 2025 | 6.8.3, plus 4.7.31 to 6.7.4 | 2: logged-in users accessing restricted content, XSS (menus) | CVE-2025-58246, CVE-2025-58674 | 5.9 (CNA Patchstack) | Mike Nelson, Phill Savage and others |\n\n*The only WordPress core security release in 2025*\n\n### 2026: eight releases, 44 vulnerabilities\n\n| Date | Releases (and backports) | Vulnerabilities fixed | CVE | Severity | Reported by |\n| --- | --- | --- | --- | --- | --- |\n| March 10 and 11, 2026 | 6.9.2 then 6.9.4 (3 fixes completed), plus 4.7.32 to 6.8.5 from March 10 to 13 | 10: blind SSRF, POP chain, ReDoS, three XSS, two authorization bypasses, PclZip path traversal, XXE in getID3 | None cited | Not published | sibwtf, kaminuma, Phill Savage and others |\n| July 17, 2026 | 7.0.2, plus 6.9.5 and 6.8.6 | 2 (\"wp2shell\"): SQL injection via author__not_in, REST API batch route confusion leading to code execution; forced update | CVE-2026-60137, CVE-2026-63030 | 9.8 (CNA WPScan) | TF1T, dtro, haongo; Adam Kues (Searchlight Cyber) |\n| August 6, 2026 | 7.0.3, plus 4.7.34 to 6.9.6 | 12: unauthenticated XSS on the login screen, four XSS from Contributor up, privilege escalation on multisite, SSRF, information leaks | CVE-2026-64638, CVE-2026-114570 | 8.9 (CVSS 4.0, CNA HackerOne) | pwn.ai, Aikido Security, Anthropic, Asaf Mozes and others |\n| August 12, 2026 | 7.0.4, plus 4.7.35 to 6.9.7 | 1: code execution by an Author via a booby-trapped file (Imagick and Ghostscript) | CVE-2026-65640 | 8.8 (CNA HackerOne) | pwn.ai |\n| September 17, 2026 | 7.1.1, plus 4.7.36 to 7.0.5 | 11: unauthenticated stored XSS via wpautop(), post overwriting from Contributor up, path traversal (REST API), theme installation via a crafted URL, leaks | None in the GitHub advisories | High (WordPress GitHub advisory) | Awesome Motive, Anthropic, pwn.ai and others |\n| September 22, 2026 | 7.1.2, plus 4.7.37 to 7.0.6 | 1: unauthenticated local PHP file inclusion via page templates, code execution under certain conditions | CVE-2026-87902 | 9.2 (CVSS 4.0, GitHub advisory) | Robert Ressl |\n| October 6, 2026 | 7.1.3, plus 4.7.38 to 7.0.7 | 7: stored XSS on the Comments page, second-order SQL injection in the export, DoS, private comments disclosed, XSS in Imgur embeds | CVE-2026-66666 | 6.9 (CVSS 4.0, CNA Patchstack) | Trail of Bits with OpenAI, Anthropic, Patchstack, security team |\n\n*WordPress core security releases in 2026, up to October 22*\n\nOnly two of these releases fix vulnerabilities listed in the US CISA Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-60137 and CVE-2026-63030 (7.0.2), added on July 21, 2026, and CVE-2026-87902 (7.1.2), added on September 25, 2026. For wp2shell, BleepingComputer reported public proofs of concept as early as July 18 and, according to watchTowr, the first exploitation attempts.\n\n*Video: wp2shell (CVE-2026-63030 and CVE-2026-60137) explained by SecureLayer7 Cybersecurity (in English)*\n\n## What the numbers show\n\n![Bar chart by year of vulnerabilities fixed in WordPress core: 23 in 2020, 7 in 2021, 26 in 2022, 14 in 2023, 6 in 2024, 2 in 2025 and 44 in 2026 up to October 22](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-coeur-wordpress-en-1.webp)\n\n*Our count from the official announcements: 122 distinct vulnerabilities, 44 of them in the first ten months of 2026.*\n\n- **[XSS](https://www.wp-masquerade.com/glossary/xss/) dominates**: about 45 fixes out of 122 by our count, often exploitable from the Contributor or Author role. See XSS vulnerabilities.\n- **Severe vulnerabilities are often conditional**: \"facilitated\" SQL injection that requires a plugin passing untrusted data (5.8.3, 7.0.2), a POP chain not exploitable on its own (6.4.2), code execution tied to Imagick and Ghostscript (7.0.4) or to `pearcmd.php` (7.1.2). See also [PHP object injection](https://www.wp-masquerade.com/php-deserialization-object-injection/).\n- **Bundled libraries matter**: PHPMailer (5.7.2), Lodash (5.8.1), getID3 and PclZip (6.9.2).\n- **2026 is on another scale**: 44 vulnerabilities in ten months, versus 2 announced in 2025. Reports from Anthropic, pwn.ai and Trail of Bits with OpenAI suggest that AI-assisted research is contributing.\n- **Fixes get fixed too**: 6.2.2 four days after 6.2.1, 6.9.3 and 6.9.4 the day after 6.9.2.\n\n## Backports and automatic updates\n\nOnly the latest version is officially supported; fixes are backported \"as a courtesy\" to older eligible branches. The rule has changed twice:\n\n- **Until November 2022**: every branch since 3.7, the first one to update itself, received the fixes.\n- **December 1, 2022**: end of fixes for 3.7 to 4.0, announced on September 7. Last releases published on November 30 (3.7.41, 3.8.41, 3.9.40, 4.0.38).\n- **July 2025**: end for 4.1 to 4.6, announced on June 19. The last releases (4.1.42 to 4.5.33 on July 15, 4.6.30 on July 17) fix nothing but show in the Dashboard that the version is no longer supported.\n- **Today**: backports down to 4.7, \"where necessary\". In 2026, some branches received their fix up to four weeks after the main release (6.0.12 on April 8 for 6.9.2).\n\nOn the site side, minor releases have installed themselves in the background since WordPress 3.7. WordPress 5.6 added an option for major releases: enabled by default on new installations, disabled on existing sites, which must turn it on in **Dashboard → Updates**. For 7.0.2, WordPress.org even forced the update through this system, citing the severity of the vulnerabilities.\n\n## What this means for you\n\n- **Keep automatic minor updates on**. It is the fastest way to receive a fix. If a site falls behind, check `WP_AUTO_UPDATE_CORE`, filters, the presence of a `.git` folder and WP-Cron, as detailed in our history and in our guide to automatic updates.\n- **Update the same day** for any release labeled \"Security\". wp2shell had public proofs of concept the day after the fix, and CVE-2026-87902 was in the KEV catalog three days later.\n- **An old branch is not a safe branch**. It receives fixes, sometimes late, but not the improvements of recent versions.\n- **Below 4.7, nothing arrives anymore**. A site on 4.6 or older has received no fixes since July 2025, however severe the vulnerabilities published afterwards: migrate.\n- **Stay on the latest major version**, tested on staging first if the site is critical.\n\nThe core is only part of the risk: remove abandoned plugins, consider a web application firewall and monitor vulnerabilities.\n\nEvery day, WP Masquerade Pro compares the version of WordPress, your plugins and your themes with the public WPVulnerability.net database and sends you an [email alert](https://www.wp-masquerade.com/features/email-alerts/) with the severity and the fixed version ([vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/)). The member area lists pending updates and vulnerable sites ([monitoring](https://www.wp-masquerade.com/features/#surveillance)), and the [integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) spots core files modified after an exploited vulnerability. Pro alerts you; it does not fix anything and is not a firewall: updating remains your main defense.\n\n### Key takeaways\n\n- 27 security releases and 122 vulnerabilities fixed in the core from January 1, 2020 to October 22, 2026, 44 of them in 2026.\n- Two fixes were followed by documented attacks: 7.0.2 (wp2shell) and 7.1.2 (CVE-2026-87902).\n- Backports stop at 4.7 since July 2025 and remain a courtesy.\n- Automatic minor updates, active since 3.7, are your best protection.\n- Plugins remain the main source of vulnerabilities: 91% in 2025 according to Patchstack.\n\n## Sources\n\n- WordPress.org: official blog, Security category (https://wordpress.org/news/category/security/)\n- WordPress.org: release archive (https://wordpress.org/download/releases/)\n- WordPress Developer Resources: Upgrading WordPress, automatic updates (https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)\n- GitHub: WordPress security advisories (wordpress-develop) (https://github.com/WordPress/wordpress-develop/security/advisories)\n\nOther sources consulted: official documentation, official vendor pages, trade press articles and Patchstack database.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.", "categories": [ "WordPress vulnerabilities" ], "format": "application/json" }