WordPress security fix timeline
Public commits from WordPress/wordpress-develop whose messages cite a vulnerability or a security fix. Patch text is not stored.
4 security-fix timeline events
Sep 21, 2026
Tests: Replace deprecated with in date query tests.
Tests: Replace deprecated `mb_split()` with `preg_split()` in date query tests. Oniguruma, which is the regex engine behind the `mbstring` extension, ended maintenance in April 2025. Since the PHP project can no longer expect upstream security fixes on it, all `mbstring` regex…
Aug 6, 2026 · CVE-2026-67434
Build/Test Tools: Ignore PHPCS Security Advisory CVE-2026-67434
Build/Test Tools: Ignore PHPCS Security Advisory CVE-2026-67434 Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs. WordPress tooling does not use the vulnerabile `Gitblame`, `Hgblame` or `Svnblame` report formats, so the p…
Jul 14, 2026
General: Bump the pinned hash for Gutenberg to .
General: Bump the pinned hash for Gutenberg to `v23.5.0`. This updates the pinned commit hash of the Gutenberg repository from `98a796c8780c480ef7bcfe03c42302d9564d785c` (version `23.4.0`) to `b5574edc8a952b2f1e528693761a97b1b3b580eb` (version `23.5.0`). A full list of changes…
Mar 3, 2026
AI: Sync API enhancement to harden security
AI: Sync `Ability_Function_Resolver` API enhancement to harden security Make `WP_AI_Client_Ability_Function_Resolver` non-static and require specifying the allowed abilities list in the constructor. This hardens security by ensuring that only explicitly specified abilities can…