WordPress still sits at the center of the public web, powering about 2/5 of all sites and a clear majority of those that run a recognizable content management system.
That reach is why a midsummer pair of core flaws, later chained into unauthenticated remote code execution on recent versions, produced emergency patches, automatic updates, and alerts from national cyber centers.
A follow-on point release in August addressed a wider set of core issues, including a pre-authentication problem on the login screen.
Most of the broader risk, researchers keep finding, still lives in plugins.
Patchstack counted 11,334 newly disclosed vulnerabilities across the ecosystem in 2025, a 42% rise from the year before, with highly exploitable bugs climbing even faster and mass exploitation often beginning within hours of public disclosure.
The reporting pipeline has grown for another reason.
Frontier AI models have made it cheaper to scan large codebases, and the WordPress project says incoming security reports rose substantially over the past year.
Contributors treated that as a mixed blessing at WordCamp US in mid August: more eyes can make the software safer, but only if the project can triage, validate, and ship fixes at the new pace. The official security team has more than 50 trusted experts and sponsored contributors, yet the queue of open findings has become a capacity problem rather than a shortage of attention.
With that in mind, WordPress introduces 'Core Security Initiative.'
In the announcement, Core Security Initiative is described as a tighter, more automated security release process with stronger end-to-end testing, so patches arrive on a more predictable schedule.
Another is staffing, with additional team members and volunteers tasked with driving the backlog of open reports toward zero.
The third applies AI-assisted scanning to find weaknesses earlier, as a complement to responsible disclosure rather than a replacement for it. Company-sponsored contributors and longtime core developers are part of the support around the security team.
The initiative is aimed first at how core is tested and shipped.
Plugins and themes remain the larger attack surface, and earlier this year the project separately tightened directory review and, for a time, delayed some auto-updates to inspect new code. Forced updates have already been used when a plugin flaw allowed unauthenticated account takeover.
Hosting companies at WordCamp U.S. also pressed for features such as native two-factor authentication in core, a sign that operational security is being debated as loudly as disclosure volume.
Researchers who think they have found a core issue are still directed to HackerOne and asked to follow the project's reporting guidelines, with quality now treated as essential because volume is high.
For site owners the practical picture is unchanged in one respect and sharpened in another.
Updates still matter, because attackers move quickly once a patch exists. The new work is an attempt to make those patches more predictable and to shrink the pile of unresolved reports before the next research wave, human or machine-assisted, arrives.
