Fewer bug reports will count from now on and that’s actually a sign of a maturing security process, not a weaker one.
WordPress’s security team published updated Vulnerability Disclosure Program guidelines on September 1, 2026, narrowing what counts as a valid, reportable security issue.
What actually changed
The update tightens eligibility around role-based issues specifically. Vulnerabilities that require a role only an administrator can grant, like Contributor, generally no longer qualify unless they demonstrate a genuinely high-severity escalation with real security impact. Similarly, one authenticated user role being able to do something normally reserved for a different role isn’t enough on its own to count as a valid report anymore, unless it leads to serious impact.
Why WordPress is doing this
The stated goal is focus: making sure the security team’s time, and the time of the researchers submitting reports, goes toward vulnerabilities with clear, significant real-world impact rather than theoretical edge cases requiring privileged access an attacker likely wouldn’t have anyway. It’s part of a broader push through WordPress’s Core Security Initiative to invest more directly in the security release process itself.
The bigger picture this fits into
WordPress core has consistently been the smallest source of real vulnerabilities in the ecosystem, just a handful logged in all of 2025, all low priority, against over 11,000 found across plugins and themes that same year. Tightening core’s own disclosure rules doesn’t change that math; it reinforces it. The actual risk on a typical WordPress site keeps concentrating in the same place: the plugin stack, not core. A site built without that stack in the first place simply doesn’t carry that exposure to begin with.
Practical takeaway: this doesn’t require any action if your site doesn’t rely on a stack of plugins, it’s a good moment to audit how many plugins your own site actually runs, and whether each one is still worth the risk it adds.