3Zero WordPress Security Research
Which Months See the Most WordPress Vulnerability Disclosures?
Month-of-year disclosure patterns normalized for month length and annual changes in record volume.
Do disclosure records cluster in particular calendar months across 2021–2025?
The analysis uses complete years and normalizes by both month length and each month’s share of its own year. This prevents 31-day months and later high-volume years from automatically dominating.
| Month | Five-year records | Average per year | Records per day | Average annual share |
|---|---|---|---|---|
| January | 2,707 | 541.4 | 17.46 | 7.89% |
| February | 1,913 | 382.6 | 13.57 | 6.12% |
| March | 2,395 | 479.0 | 15.45 | 7.48% |
| April | 3,124 | 624.8 | 20.83 | 10.01% |
| May | 2,069 | 413.8 | 13.35 | 7.80% |
| June | 2,181 | 436.2 | 14.54 | 8.17% |
| July | 1,813 | 362.6 | 11.70 | 7.17% |
| August | 1,972 | 394.4 | 12.72 | 8.22% |
| September | 2,171 | 434.2 | 14.47 | 8.28% |
| October | 2,354 | 470.8 | 15.19 | 9.42% |
| November | 2,487 | 497.4 | 16.58 | 9.64% |
| December | 2,764 | 552.8 | 17.83 | 9.80% |
Seasonality describes publication timing
These dates describe when records were published in the synchronized source. They do not necessarily identify when a weakness was introduced, discovered, reported privately, fixed, or first exploited.
Download this report’s primary data (CSV)
Data Source, Attribution and Methodology
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Calculations use active Production Feed records in an approved, immutable snapshot. Scanner-only and source-removed records are excluded. A record count is not a direct measurement of software quality, exploitation, infection, installed-base risk or researcher productivity.
Snapshot #1 · dataset cutoff 2026-08-01 11:09:08 UTC · calculation version 1.0.0 · methodology version 1.0.0. Read the full methodology.