WordPress’s Core Security Initiative addresses a sharp rise in vulnerability reports: the HackerOne programme received 450 submissions in July and 773 in August, after averaging 20 to 30 per month for roughly a decade. More than 3,000 reports arrived this year, increasing pressure on the teams responsible for validation, fixes and releases.

The response combines faster release operations with controlled automation. Seven core security releases since mid-July closed more than 50 Critical or High vulnerabilities, with fixes backported to supported branches as far back as WordPress 4.7. Releases use defined contributor roles and ship first to widely used versions. Automation now covers 73% of 109 release steps, while package creation remains restricted to limit supply-chain risk.

AI-assisted triage securely reproduces reports and recommends validity and severity, leaving final decisions to security researchers. The untriaged queue has fallen from 359 to double digits. Similar agentic tools, running open-weight models with purpose-built harnesses, now search core for vulnerabilities; findings follow the established release process. WordPress has also begun addressing issues identified through Anthropic’s OSS Scanner.

Author of the original text: Rudy Faile (Make WordPress)