WordPress Launches Core Security Initiative to Build a Safer Future

WordPress is starting a new team effort to make a safer future. The plan is to improve how security problems are fixed, make fixes happen faster, and use AI to find weak spots in the code.

In the last year, there has been a big jump in the number of security reports about WordPress. This is because new AI tools make it easier to check code for possible problems. More reports are good because they help find issues, but they also mean the system needs to be improved to handle all this information quickly.

At a recent meeting, the security team talked about these challenges. Now, the team is sharing their new plan.

The New Plan to Make WordPress Safer

The security team launches a coordinated effort called the WordPress Core Security Initiative. This initiative pursues one goal: a stronger, safer WordPress. The work organizes around three main pillars called "ABC": A Better Release Process, Breaking the Backlog, and Crush Vulnerabilities with AI.

A Better Release Process

First, the team builds a tighter and more automated security release process. End-to-end testing also becomes more robust. Consequently, fixes ship reliably and predictably. As a result, the security team schedules upcoming releases.

Breaking the Backlog

Next, the initiative recruits more members and volunteers. These individuals tackle the queue of open reports and known issues. Ultimately, the aim is to drive open findings all the way down to zero.

Crush Vulnerabilities with AI

Finally, the team applies AI-assisted scanning and additional tooling. These tools detect vulnerabilities before attackers can exploit them. In addition, this scanning supplements the reports that responsible disclosure brings in.

The WordPress core security team, longtime core contributors, and contributors sponsored by companies across the WordPress ecosystem support all this work.

Working Together Behind the Scenes

This plan is supported by the WordPress security team, long-time contributors, and workers from companies that help build WordPress. This group has a lot of experience and resources to tackle security from different sides.

How the Community Can Contribute

Security research and responsible reporting remain the main line of defense. Anyone who believes a problem has been found in WordPress core is encouraged to report it through the official channel at: hackerone.com/wordpress. Before submitting, reviewing the reporting guidelines carefully is important. Report quality matters more than ever because of the high number of submissions.

A Safer Future for WordPress

The WordPress Core Security Initiative is a big step forward in protecting the millions of websites that use the Content Management System (CMS). By using better processes, quicker fixes, and new AI tools, the platform is building a stronger future. The team's commitment to always improve means WordPress can continue to be a trusted and safe choice for users everywhere.

For more information about the Core Security Initiative and to stay updated on progress, following the official WordPress security channels is recommended. Together, the community can assist in making WordPress safer for everyone.

Originally published at https://shapedplugin.com on September 4, 2026.