WordPress Core security history

WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 369 vulnerability records associated with WordPress, published between 2003 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

369Total records

16Critical

92High

243Medium

8Low

10Informational

367Patched records

2Currently marked unpatched

2003-06-09First disclosure

2026-07-17Latest disclosure

340 of 369CVE coverage

368Network attack vector

147No privileges required

298No user interaction

Year-by-Year Timeline

Year	Records	Relative volume
2003	2	2 records
2004	2	2 records
2005	10	10 records
2006	14	14 records
2007	40	40 records
2008	12	12 records
2009	12	12 records
2010	9	9 records
2011	13	13 records
2012	19	19 records
2013	17	17 records
2014	19	19 records
2015	17	17 records
2016	21	21 records
2017	41	41 records
2018	16	16 records
2019	22	22 records
2020	22	22 records
2021	10	10 records
2022	22	22 records
2023	14	14 records
2024	5	5 records
2025	2	2 records
2026	8	8 records

Severity Breakdown

Severity	Records	Share
Critical	16	4.3%
High	92	24.9%
Medium	243	65.9%
Low	8	2.2%
Informational	10	2.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

137 records37.1%

First: 2004. Latest: 2026.

Other

88 records23.8%

First: 2003. Latest: 2026.

Missing Authorization

40 records10.8%

First: 2006. Latest: 2026.

Information Disclosure

36 records9.8%

First: 2005. Latest: 2024.

SQL Injection

24 records6.5%

First: 2003. Latest: 2026.

CSRF

17 records4.6%

First: 2007. Latest: 2023.

Path Traversal

10 records2.7%

First: 2006. Latest: 2024.

Arbitrary File Upload

7 records1.9%

First: 2007. Latest: 2018.

Privilege Escalation

6 records1.6%

First: 2007. Latest: 2020.

Authentication Bypass

4 records1.1%

First: 2007. Latest: 2020.

Patch Status

Patched: 367
Currently marked unpatched: 2
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.8.6
7.0.2
6.9.5
6.9.2
6.8.4
6.8.3
6.7.4
6.6.4
6.5.7
6.4.7
6.3.7
6.2.8
6.1.9
6.0.11
5.9.12
5.8.12
5.7.14
5.6.16
5.5.17
5.4.18
5.3.20
5.2.23
5.1.21
5.0.24
4.9.28
4.8.27
4.7.31
5.8.10
5.7.12
5.6.14
5.5.15
5.4.16
5.3.18
5.2.21
5.1.19
5.0.22
4.9.26
4.8.25
4.7.29
4.6.29
4.5.32
4.4.33
4.3.34
4.2.38
4.1.41
6.5.5
6.4.5
6.3.5
6.2.6
6.1.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 3.7)`	WordPress Core < 3.9.2 - Denial of Service via XML	August 6, 2014	3.7.4, 3.8.4, 3.9.2	Low
`3.9-3.9.1`	WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass	August 6, 2014	3.7.4, 3.8.4, 3.9.2	High
`3.8-3.8.3`	WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass	August 6, 2014	3.7.4, 3.8.4, 3.9.2	High
`3.7-3.7.3`	WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass	August 6, 2014	3.7.4, 3.8.4, 3.9.2	High
`[*, 3.7)`	WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass	August 6, 2014	3.7.4, 3.8.4, 3.9.2	High
`[*, 3.9.2)`	WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness	August 6, 2014	3.9.2	Medium
`3.8.1`	WordPress Core < 3.8.2 - SQL Injection	April 9, 2014	3.8.2	High
`3.8-3.8.1`	WordPress Core < 3.8.2 - Authentication Cookie Forgery	April 8, 2014	3.7.2, 3.8.2	Medium
`3.7-3.7.1`	WordPress Core < 3.8.2 - Authentication Cookie Forgery	April 8, 2014	3.7.2, 3.8.2	Medium
`[*, 3.7)`	WordPress Core < 3.8.2 - Authentication Cookie Forgery	April 8, 2014	3.7.2, 3.8.2	Medium
`3.8-3.8.1`	WordPress Core < 3.8.2 - Contributor Users Can Publish Posts	April 8, 2014	3.7.2, 3.8.2	Medium
`3.7-3.7.1`	WordPress Core < 3.8.2 - Contributor Users Can Publish Posts	April 8, 2014	3.7.2, 3.8.2	Medium
`[*, 3.7)`	WordPress Core < 3.8.2 - Contributor Users Can Publish Posts	April 8, 2014	3.7.2, 3.8.2	Medium
`*-2.0.11`	WordPress Core < 2.1 - Cross-Site Request Forgery to Denial of Service	December 17, 2013	2.1	High
`*-3.6`	WordPress Core < 3.6.1 - Deserialization	September 11, 2013	3.6.1	High
`*-3.6`	WordPress Core < 3.6.1 - Spoof Post Authorship	September 11, 2013	3.6.1	Medium
`[*, 3.6.1)`	WordPress Core < 3.6.1 - .swf and .exe File Upload	September 11, 2013	3.6.1	Medium
`*-3.6`	WordPress Core < 3.6.1 - HTML File Upload	September 11, 2013	3.6.1	Medium
`*-3.6`	WordPress Core < 3.6.1 - Open Redirect	September 11, 2013	3.6.1	Medium
`*-3.5.1`	WordPress Core < 3.5.2 - Missing Authorization Checks	June 21, 2013	3.5.2	Medium
`*-3.5.1`	WordPress Core < 3.5.2 - Sensitive Information Disclosure	June 21, 2013	3.5.2	Medium
`*-3.5.1`	WordPress Core < 3.5.2 - Cross-Site Scripting	June 21, 2013	3.5.2	Medium
`[*, 3.5.2)`	WordPress Core <= 3.5.1 - Denial of Service via wp-postpass cookie	June 21, 2013	3.5.2	Medium
`*-3.5.1`	WordPress Core < 3.5.2 - Server Side Request Forgery	June 21, 2013	3.5.2	Medium
`*-3.5.1`	WordPress Core < 3.5.2 - Cross-Site Scripting via Multiple Vectors	June 21, 2013	3.5.2	Medium

Selected source records

Latest Records

CriticalCVE-2026-63030

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

Published: July 17, 2026

Affected versions: [6.9, 6.9.5); [7.0, 7.0.2)
Patched versions: 6.9.5, 7.0.2

Original Wordfence record

HighCVE-2026-60137

WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter

Published: July 17, 2026

Affected versions: [6.8, 6.8.5); [6.9, 6.9.5); [7.0, 7.0.2)
Patched versions: 6.8.6, 6.9.5, 7.0.2

Original Wordfence record

Medium

WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint

Published: March 10, 2026

Affected versions: 6.8-6.8.3; 6.9-6.9.1
Patched versions: 6.8.4, 6.9.2

Original Wordfence record

Medium

WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery

Published: March 10, 2026

Affected versions: 6.8-6.8.3; 6.9-6.9.1
Patched versions: 6.8.4, 6.9.2

Original Wordfence record

Medium

WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items

Published: March 10, 2026

Affected versions: 6.8-6.8.3; 6.9-6.9.1
Patched versions: 6.8.4, 6.9.2

Original Wordfence record

Medium

WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area

Published: March 10, 2026

Affected versions: 6.8-6.8.3; 6.9-6.9.1
Patched versions: 6.8.4, 6.9.2

Original Wordfence record

MediumCVE-2026-3906

WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

Published: March 10, 2026

Affected versions: 6.9-6.9.1
Patched versions: 6.9.2

Original Wordfence record

Medium

WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

Published: March 10, 2026

Affected versions: 6.8-6.8.3; 6.9-6.9.1
Patched versions: 6.8.4, 6.9.2

Original Wordfence record

Highest-Severity Records

CriticalCVE-2026-63030

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

Published: July 17, 2026

Affected versions: [6.9, 6.9.5); [7.0, 7.0.2)
Patched versions: 6.9.5, 7.0.2

Original Wordfence record

CriticalCVE-2006-4028

WordPress Core < 2.0.4 - Privilege Escalation

Published: July 9, 2006

Affected versions: [*, 2.0.4)
Patched versions: 2.0.4

Original Wordfence record

CriticalCVE-2007-6318

WordPress Core < 2.3.2 - SQL Injection

Published: September 8, 2007

Affected versions: *-2.3.1
Patched versions: 2.3.2

Original Wordfence record

CriticalCVE-2021-29476

WordPress Core < 5.5.3 - PHP Object Injection Gadget

Published: October 29, 2020

Affected versions: [*, 3.7); [3.7, 3.7.35); [3.8, 3.8.35); [3.9, 3.9.33); [4.0, 4.0.32); [4.1, 4.1.32); [4.2, 4.2.29); [4.3, 4.3.25); [4.4, 4.4.24); [4.5, 4.5.23); [4.6, 4.6.20); [4.7, 4.7.19); [4.8, 4.8.15); [4.9, 4.9.16); [5.0, 5.0.11); [5.1, 5.1.8); [5.2, 5.2.9); [5.3, 5.3.6); [5.4, 5.4.4); [5.5, 5.5.3)
Patched versions: 3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.8, 5.2.9, 5.3.6, 5.4.4, 5.5.3

Original Wordfence record

Critical

WordPress Core 2.1.1 - Supply Chain Compromise

Published: March 2, 2007

Affected versions: 2.1.1
Patched versions: 2.1.2

Original Wordfence record

CriticalCVE-2017-14723

WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders

Published: September 19, 2017

Affected versions: [*, 3.7); 3.7-3.7.21; 3.8-3.8.21; 3.9-3.9.19; 4.0-4.0.18; 4.1-4.1.18; 4.2-4.2.15; 4.3-4.3.11; 4.4-4.4.10; 4.5-4.5.9; 4.6-4.6.6; 4.7-4.7.5; 4.8-4.8.1
Patched versions: 3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

Original Wordfence record

CriticalCVE-2007-4894

WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection

Published: September 8, 2007

Affected versions: [*, 1.2.5)
Patched versions: 1.2.5

Affected versions: [*, 2.2.3)
Patched versions: 2.2.3

Original Wordfence record

CriticalCVE-2024-31211

WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain

Published: December 6, 2023

Affected versions: 6.4.0; 6.4.1
Patched versions: 6.4.2

Original Wordfence record

Currently Marked Unpatched Records

InformationalCVE-2022-3590

WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery

Published: September 6, 2022

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

InformationalCVE-2017-14990

WordPress Core - All Known Versions - Cleartext Storage of wp_signups.activation_key

Published: October 10, 2017

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

3Zero Interpretation

The WordPress Core vulnerability history is long-running and varied rather than concentrated in a single release or weakness. The synchronized dataset contains 369 records published from June 2003 through July 2026. Cross-site scripting is the largest normalized category with 137 records (37.1%), followed by 40 missing-authorization and 36 information-disclosure records. The history also includes 16 critical and 92 high-severity records.

The latest records materially affect how this history should be read. The dataset identifies a critical remote-code-execution record affecting the 6.9 and 7.0 branches before 6.9.5 and 7.0.2, together with a high-severity SQL-injection record affecting several maintained branches. This demonstrates why WordPress Core maintenance should follow the supported release branch and security releases, not simply a fixed calendar schedule.

Of the 369 associated records, 367 are marked patched and two are currently marked unpatched in the synchronized source. Those counts describe source records; they do not establish that a particular website is exposed or compromised.

Practical Next Steps

Identify the exact Core release. Record the installed WordPress version and whether the site is following the current major branch or an older supported branch.
Compare it with the affected ranges. Recent source records list patched values including 7.0.2, 6.9.5 and 6.8.6. Use the branch-specific value shown for each record rather than treating one version number as universal.
Apply security releases with a tested recovery path. Take a verified backup, update Core, clear application and edge caches, then test login, publishing, REST API and scheduled tasks.
Review exposure separately from patching. If the site ran an affected release while a high-impact issue was public, review administrator accounts, file changes, request logs and unexpected scheduled activity. An affected version alone does not prove exploitation.
Keep automatic minor security updates observable. Confirm that update notifications, failure reporting and backups are functioning so a failed automatic update does not remain unnoticed.

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory