More than 50 educational institutions have joined WordPress Credits, giving students worldwide a way to earn academic recognition for contributing to WordPress. The program had two participating institutions in September 2025 and four the following month. By June 2026, that number had reached 27, before passing 50 this October.

The program launched with the University of Pisa and was announced at WordCamp Europe 2025. Since then, it has expanded through partnerships that connect students with experienced contributors and practical projects. The WordPress Credits dashboard recorded participating institutions across 17 countries as of October 19, including Bangladesh, Costa Rica, Spain, Bolivia, and Indonesia. Each institution can adapt the program to its academic requirements, allowing students to contribute as part of their studies.

Learn through contribution

Students work with mentors on projects that reflect their interests and areas of study. They might translate WordPress, improve documentation, create learning materials, or contribute to development and testing. Alongside that work, they practice collaborating with others and responding to feedback, then present their contributions at the end of the program. By October 19, the dashboard recorded 364 graduates and student contributions across 18 WordPress teams. That work supports the software and resources people use throughout the WordPress community.

Help the program grow

Local contributors have helped establish these partnerships by introducing WordPress Credits to nearby schools and adapting it to local languages and educational settings. Mentors guide students through their first contributions, while sponsors provide support and resources. Educators help make that participation part of students’ academic work. Thank you to the students, educators, mentors, and supporters whose involvement has brought the program to more than 50 institutions.

Institutions can include WordPress Credits in an existing course, offer it as an internship, or incorporate it into a final project. The program is available at no cost to partner institutions, with flexible formats to suit their students and curriculum. To get started, read how to launch a WordPress Credits program and register your institution’s interest through the program page.

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

Wait, what happened to 7.2 Beta 3???

WordPress 7.1.4 was released on October 28 which included WordPress 7.2 Beta 3.

How to Test WordPress 7.2 Beta 4

You can test WordPress 7.2 Beta 4 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 4?

For technical details on the issues addressed since Beta 2, see the following links:

• Closed 7.2 WordPress Core Trac tickets since October 27, 2026
• 7.2 Gutenberg commits since October 27, 2026

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 4 continues refining the upcoming release with improvements to accessibility, editor reliability, and developer APIs, alongside additional bug fixes and compatibility updates.

Recent work includes improved keyboard focus visibility in Windows High Contrast mode, refinements to administration interfaces, and fixes for right-to-left block alignment and custom block spacing.

Developers will also benefit from continued improvements to the Abilities API, DataViews extensibility, and REST API behavior. Additional fixes strengthen revision handling, input validation, and compatibility across supported environments.

Learn more: Trac #45910, Trac #66382, Trac #66427, Trac #66383, Trac #66343, Trac #66329

Continued Improvements to Ipsum

The new default theme, Ipsum, continues to receive refinements ahead of WordPress 7.2’s final release. Recent updates improve accessibility with clearer keyboard focus indicators, more descriptive screen reader links, and better support for right-to-left languages. Additional improvements refine block patterns, touch target spacing, and color palette compatibility with other default themes.

Learn more: Trac #66352, GitHub #15113

Improved Translation Update Management

WordPress 7.2 makes managing translation updates easier by displaying individual available updates on the Updates screen. Administrators can now review and selectively install translation updates, bringing language management in line with the familiar plugin and theme update experience.

Learn more: Trac #42281, GitHub #11610

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 4 haiku

Where did Beta Three go?
A surprise along the way
Four arrives on cue.

Props to @audrasjb, @courane01, @huzaifaalmesbah for pre-publish review.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.
WordPress 7.1.4 is a short-cycle release. The next major release will be version 7.2, currently planned for December 8th.

For more information, please visit the WordPress 7.1.4 HelpHub site.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram.
• A stored XSS with specially crafted block markup, reported by Rafie Muhammad (Awesome Motive, Inc.).
• Privacy Data Removal Requests can be created in a way that leads to stored XSS, reported by Anthropic.
• Multiple stored XSS issues in the Interactivity API independently discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0 and Anas cherni, Marcel Karlsson (whoismarcel), and Weston Ruter, Jon Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.
• A stored denial of service issue in the Interactivity API, reported by Jon Surrell of the WordPress Security Team.
• A stored XSS in Customizer selective refresh, reported by Rafie Muhammad (Awesome Motive, Inc.).
• A Stored XSS in the Categories block reported by Ben Bidner of the WordPress Security Team.
• Specially crafted User Logins can lead to a stored XSS reported by Anthropic.
• Unpublished customizer changesets can be discovered by unauthenticated users, reported by Antonio Lorensius Silaban.
• A Stored XSS in Playlist and image blocks, reported by Ben Bidner of the WordPress Security Team.
• Stored XSS in core/comments-pagination-next and core/comments-pagination-previous blocks, reported by Alex Concha of the WordPress Security Team.
• Notes can be read by privileged users that lack access to edit the post the note is attached to, reported by Ramon of the WordPress Security Team.
• An update to the bundled root certificates due to the eMudhra revocation.

Thank you to these WordPress contributors

This release was led by Aaron Jorbin and Nik Tsekouras. WordPress 7.1.4 would not have been possible without the contributions of the following people:

Aaron Jorbin, Adam Silverstein, Alex Concha, Andrew Duthie, Andrew Serong, David Arenas, Dennis Snell, Ella Van Durpe, George Mamadashvili, Isabel Brison, Jake Spurlock, Jb Audras, Jeremy Felt, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Kira Song,Lance Willett, luisherranz, Marco Ciampini, marcs0h, Marin Atanasov, Mario Santos, Miguel Fonseca, Nik Tsekouras, Peter Wilson, ramonopoly, Rudy Faile, Sergey Biryukov, umut3806, Weston Ruter

Backports

As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

WordPress 7.2 Beta 3 has also been released, containing all applicable fixes.

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.2 Beta 2

You can test WordPress 7.2 Beta 2 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 2?

For technical details on the issues addressed since Beta 1, see the following links:

• Closed 7.2 WordPress Core Trac tickets since October 20, 2026
• 7.2 Gutenberg commits since October 20, 2026

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 2 builds on the first beta with additional enhancements, bug fixes, and refinements across the administration experience and developer APIs.

Development continues on the Abilities API, including content querying, capability requirements, and improvements to schema handling and permissions. New server-side registration capabilities for DataViews and DataForm also provide developers with more ways to extend WordPress interfaces.

Additional work includes improvements to REST API flexibility, admin asset loading, and the transition to modern SVG icons throughout WordPress administration.

Learn more: Trac #66268, Trac #66325, Trac #66229, Trac #66343, Trac #57548, Trac #65089

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 2 haiku

Second beta takes shape
New abilities take root
WordPress grows stronger

Props to @mamaduka for pre-publish review.

Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.

Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.

These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.

Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.

If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:

Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

Further information on wordpress.org:

• Get a faster, more secure website: update PHP today
• PHP Compatibility and WordPress Versions
• FAQ My site was hacked

How to Test WordPress 7.2 Beta 1

You can test WordPress 7.2 Beta 1 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

Editing Experience

Responsive Design Controls

Building on the responsive design improvements introduced in WordPress 7.1, WordPress 7.2 expands viewport-specific styling to additional design tools and blocks. Creators gain more granular control over how layouts and visual settings adapt across screen sizes, including responsive Gallery settings for columns, image cropping, and aspect ratios.

Learn more: GitHub #80388, #82003

Improved Global Styles and Design Tools

WordPress 7.2 makes site-wide styling easier to manage with a new Customized filter for finding blocks with modified styles and inherited Global Styles values displayed directly in block inspector controls. Expanded design tools and support for styling form elements provide additional flexibility when creating a consistent visual identity across a site.

Learn more: GitHub #82520, #76525, #34198, #84657

Text Shadow Support

WordPress 7.2 introduces new text shadow controls, giving creators more ways to add depth and emphasis to their content. Text shadows can be customized through block settings and defined as presets in theme.json, making it easier to maintain consistent typography across a site.

Learn more: GitHub #73320, GitHub #79584, Trac #65869

Easier Navigation Management

Improvements to the Site Editor make managing navigation links more intuitive. Creators can add, organize, and edit navigation items directly from the editor sidebar, making it easier to maintain site menus without interrupting their editing workflow.

Learn more: GitHub #77069

Better Collaboration with Notes

WordPress 7.2 introduces Emoji reactions on notes and a new toolbar icon that makes Notes easier to access and manage. Notes move to the editor canvas, bringing conversations directly into the margin. Users can now keep Notes and the block settings sidebar open simultaneously, making it easier to review feedback while editing content.

A new minimized Notes mode reduces visual clutter, while improvements to positioning and display create a smoother, more consistent collaboration experience.

Learn more: GitHub #79970, GitHub #83786, GitHub #80015, Trac #64638

Faster, More Efficient Media Uploads

WordPress 7.2 expands client-side media processing to the Media Library, allowing images to be resized, compressed, and converted directly in the browser before being uploaded. This can improve upload performance, reduce server resource usage, and provide better support for modern image formats, particularly on hosting environments with limited image-processing capabilities.

Learn more: Trac #65661, GitHub #12585

New “On This Day” Dashboard Widget

WordPress 7.2 introduces a new On This Day dashboard widget that helps users rediscover content published on the same date in previous years. By highlighting posts from the site’s history, the widget makes it easier to revisit past content, celebrate milestones, and find opportunities to refresh or reshare older posts.

Learn more: Trac #65116

Block Editor Usability Improvements

WordPress 7.2 includes a collection of smaller improvements aimed at reducing friction in everyday editing. These changes include clearer error messages, more helpful feedback when something goes wrong, and refinements to common editor interactions, making the editing experience more predictable and approachable.

Learn more: GitHub #81453, #82496, #84656, #84649

A More Consistent WordPress Admin

WordPress 7.2 continues modernizing the administration experience by replacing legacy Dashicons in the admin bar and sidebar with icons from the WordPress icon library. The updated icons bring greater visual consistency between the traditional WordPress dashboard and newer editing interfaces.

Learn more: GitHub #12270

An Updated Block Settings Experience

A new DataForm-powered inspector introduces a refreshed approach to managing block settings in the editor. Built on the DataForm component system, this work aims to provide more consistent controls and a more extensible foundation for future block editing improvements.

Learn more: GitHub Gutenberg · Call for Testing

Faster WordPress Administration

WordPress 7.2 improves admin performance by modernizing how scripts and stylesheets are loaded. Instead of combining assets into large files, WordPress now loads them individually for better browser caching. A new prefetching mechanism also anticipates which admin screen users are likely to visit next, loading its resources in advance to make navigation between the dashboard, post lists, and editor faster.

Learn more: Trac #57548

For Developers

New Secrets API

WordPress 7.2 introduces a Secrets API, providing developers with a standardized, secure way to store sensitive credentials such as API keys and authentication tokens. The API supports encryption at rest, credential rotation, and customizable storage providers, helping plugins and integrations manage sensitive information more securely.

Learn more (Trac #66187)

Random Content Redirects

WordPress 7.2 adds support for random content redirects, allowing visitors to discover a randomly selected post through a dedicated URL. This provides a simple way to encourage content exploration and help readers rediscover older posts.

Learn more: Trac #64498

More Powerful APIs for Developers

WordPress 7.2 expands the Abilities API with new capabilities for accessing and querying WordPress data, providing a more consistent foundation for integrations, automation, and AI-powered tools. (Trac #66268, #64605, #64657)

Enhancements to the Interactivity API introduce new ways to render trusted HTML and manage reactive navigation, giving developers more flexibility when building dynamic, interactive blocks. (Trac #66246, Gutenberg PR #83092)

Additional improvements to the HTML API, block supports, and responsive design tools provide more reliable markup processing and greater control over how custom blocks are styled and displayed across devices. (Trac #65824, #66150, #65869)

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

WordPress 7.2 will include new features that were previously only available in the Gutenberg plugin. Learn more about Gutenberg updates since WordPress 7.1 in the What’s New in Gutenberg posts for versions 23.7, 23.8, 23.9, 24.0, 24.1, 24.2, and 24.3.

What’s new in WordPress 7.2?

With so much in progress for WordPress 7.2 Beta 1, this is still only the beginning; expect continued refinement with each Beta and RC release ahead of the final release on December 8, 2026

Just for you: a Beta 1 haiku:

Ipsum takes the stage
Secrets bloom, designs take shape
New blocks come alive

Props to @audrasjb, @annezazu, @adamsilverstein, @westonruter, @markoserb, @im3dabasia1, @jorbin, and @noruzzaman for proofreading and review.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A stored XSS on the Comments administration page, exploitable via pending comments, reported by Trail of Bits in collaboration with OpenAI.
• A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic
• A second-Order SQL injection in WordPress WXR export, reported by Anthropic
• A weakness allowing Author role users to sticky posts, reported by Anthropic
• Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack
• Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong
• Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team

Thank you to these WordPress contributors

This release was led by Jake Spurlock.

WordPress 7.1.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Adam Silverstein, Adi Moldovan, Adrian Duffell, Alex Concha, Arkaprabha Chowdhury, Deepak Kumar, donniam, Ehtisham Siddiqui, Jake Spurlock, Jb Audras, Jeremy Felt, Joe Dolson, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Ken Gagne, Khokan Sardar, Lance Willett, lucatume, marcs0h, Peter Wilson, Paul Kevan, RS Software, Rudy Faile, Sergey Biryukov, siliconforks, smerriman, Stephen Bernhardt, Suryakant Upadhyay, vortfu, webVerts, Weston Ruter, Yogesh Bhutkar

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security update included in this release

The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).

Thank you to these WordPress contributors

This release was led by John Blackbourn. WordPress 7.1.2 would not have been possible without the contributions of the following people:

Aaron Jorbin, Aki Hamano, Alex Concha, Ehtisham Siddiqui, fiocavallari, Jb Audras, Jeffrey Paul, Jeremy Felt, Joe McGill, John Blackbourn, Jon Surrell, Lance Willett, Manuel Camargo, marcs0h, martin.krcho, Mukesh Panchal, Olga Gleckler, Pascal Birchler, Peter Wilson, Rajin Sharwar, Ressl, Rudy Faile, Sergey Biryukov, Shail Mehta, Stephanie Walters, and vortfu.

CVE and GHSA references

Further details can be found in the advisory: CVE-2026-87902 / GHSA-7hp8-65ch-5whp.

Backports

As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported.

WordPress announced its participation in the Alliance in 2024, building on our work with Drupal, Joomla!, and TYPO3 to respond to the European Union’s Cyber Resilience Act. While many open source projects focus on underlying digital infrastructure, our content management systems power the websites where businesses reach customers and sell products and services. We asked policymakers to account for that economic role when setting security requirements, while respecting how communities of developers, translators, educators, and other contributors build and maintain the software. We share a belief that everyone should have the freedom to use, change, and share the tools they rely on.

This commitment to openness builds on efforts such WordPress’s recent signing of the Open Weights and American AI Leadership letter. Our mission to democratize publishing means giving anyone a voice and welcoming everyone to contribute. Working with other communities puts those values into practice beyond WordPress, supporting the freedoms that make participation possible. I invite you to read the Open Website Alliance charter to learn more about the commitments its members share and how the Alliance works.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
• Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Thank you to these WordPress contributors

This release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin.

WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, abrahamfariaz, Adam Silverstein, Adi Moldovan, Adrian Duffell, Aki Hamano, Alex Concha, Andrea Fercia, andreasca, Andrei Draganescu, Andrew Duthie, Andrew Serong, André Maneiro, annezazu, Anthony White, Arkaprabha Chowdhury, Ashar Fuadi, Azragh, Barry, buffer1024, Chunhui Ouyang, Courtney Robertson, Dagan, Daniel Richards, Daniel Rodriguez, Darshit Rajyaguru, David Biňovec, Deepak Kumar, Dennis Snell, DevSaiful, Dhruvang21, Dominik Schilling, Ehtisham Siddiqui, Ella Van Durpe, Erick Wambua, FahimMurshed, Fernando Tellado, fiocavallari, George Mamadashvili, George Vasiliades, gregbenz, Harish Tewari, Hit Bhalodia, Isabel Brison, Jake Spurlock, Jamie Dąbrowiecki, Jb Audras, Jeffrey Paul, Jeremy Felt, Jiwoon Kim, Joe Dolson, Joe Hoyle, Joe McGill, Joen Asmussen, Johannes Jülg, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Josh, Kamran Abdul Aziz, Khokan Sardar, Kira Schroder, kleisauke, Kushagra Goyal, l1onofjudah, Lance Willett, luksusspokoju, Manzoor Wani, Marco Ciampini, marcs0h, Marin Atanasov, Michael, Mohammad Jangda, mrkenobi, Mukesh Panchal, Nawazkhan Pathan, Nik Tsekouras, Parth Jogi, Pascal Birchler, Paul Biron, Paul Kevan, Peter Wilson, Rafie Muhammad, ramonopoly, Rashed Hossain, Ressl, Riad Benguella, Rudy Faile, Sainath Poojary, Scott Kingsley Clark, Sergey Biryukov, Shail Mehta, Shameem – a11n, siliconforks, Slava Abakumov, Stephen Bernhardt, Sukhendu Sekhar Guria, Ugyen Dorji, Utsav Ladani, vortfu, Weston Ruter, w3bdsgn, wolf45 plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine.

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Props to Ehtisham Siddiqui, Lance Willett, Weston Ruter, and Adam Silverstein for proofreading.