On August 28, 2026, WordPress announced the Core Security Initiative — a formal shift from waiting for security researchers to report vulnerabilities to actively hunting them with AI. The announcement landed quietly on the make.wordpress.org/security blog, but it represents the most significant change to how WordPress handles security in years. The old model, where the core team triaged reports from external researchers and patched what they found, is no longer fast enough. AI made sure of that.

The timing matters. Aaron D. Campbell, who led the WordPress Security Team and now runs security at Monarx, laid out the problem in blunt terms on the WP Tavern podcast in September: attacks that once required human ingenuity are now orchestrated by AI agents that can chain vulnerabilities together in ways humans would struggle to conceive. The gap between when a vulnerability is discovered and when it is exploited has narrowed from weeks to hours. Supply chain attacks — where a malicious actor compromises a popular plugin and pushes a backdoored update to hundreds of thousands of sites — are increasing. The compute power available to attackers is growing faster than the headcount available to defenders.

WordPress powers roughly 40% of the web. That makes it the single biggest target on the internet. The old approach of reacting to reports was not keeping up. The new initiative is WordPress admitting that out loud.

What the initiative actually does

The Core Security Initiative has three parts, and each one addresses a specific failure of the old model.

The first is a better release process. Security patches need to ship faster and more reliably. In the past, a critical vulnerability report could sit in the queue for days or weeks while the team worked through triage, verification, patching, and release logistics. The initiative aims to compress that timeline. Faster releases mean less time for attackers to exploit known-but-unpatched holes.

The second is breaking the backlog. WordPress has accumulated a pile of known security reports and issues that have not been fully addressed. Some are low-priority edge cases. Some are more serious. The initiative is a push to clear that backlog systematically rather than letting it grow. A backlog is a liability — every unpatched report is a potential exploit someone else might find first.

The third is the interesting one: use AI to find vulnerabilities proactively. Instead of waiting for an external researcher to discover a flaw and report it, WordPress is deploying AI tools to scan the codebase, analyze plugin behavior, and identify potential vulnerabilities before anyone else does. The goal is to find and fix the bugs before attackers find and exploit them.

This is not a hypothetical. Security companies have been using AI-assisted vulnerability discovery for a couple of years now. What changed is that WordPress is building it into the core security process rather than relying on the ecosystem to do it. The initiative draws on contributions from the core security team, longtime contributors, and sponsored contributors from companies across the WordPress ecosystem.

The AI arms race nobody asked for

The uncomfortable reality is that AI made this initiative necessary by making the attacker's job easier. A year ago, finding a SQL injection vulnerability in a WordPress plugin required understanding PHP, MySQL, and the specific plugin's code structure. Today, an AI agent can scan thousands of plugin files, identify input sanitization failures, and generate exploit code — all in minutes.

Campbell described it as a shift from a battle of wits to a battle of compute power. Attackers no longer need to be clever. They need to be fast and well-resourced. AI agents can chain multiple low-severity vulnerabilities together to achieve something an individual attacker would never attempt. A missing capability check here, an unsanitized input there, a predictable nonce somewhere else — individually minor, but devastating in combination.

Supply chain attacks make this worse. When a popular plugin with a million active installations gets compromised, the blast radius is enormous. AI accelerates the discovery of those entry points. It also accelerates the exploitation. The window between disclosure and mass exploitation has shrunk to the point where a vulnerability announced on Monday can be actively exploited by Tuesday.

WordPress's response — using AI to defend against AI-powered attacks — is the only rational move. You cannot out-think an adversary that operates at machine speed with human-level creativity. You need your own machine-speed defense.

What this means if you run a WordPress site

The Core Security Initiative is good news for WordPress site owners, but it does not let you off the hook. The initiative improves the security of WordPress core — the software itself. It does not fix your plugins, your themes, your server configuration, or your password hygiene.

Here is what actually matters for your site right now.

Keep WordPress updated. Automatic minor version updates have been the default for years, and they work. If you are running a version from six months ago because you are worried an update might break something, you are accepting a known security risk in exchange for avoiding a hypothetical compatibility issue. That is a bad trade.

Audit your plugins. Deactivate and delete anything you are not using. Every active plugin is an attack surface. If you have fifteen plugins installed and you only use five, the other ten are liability with no benefit. Check when each plugin was last updated. A plugin that has not been updated in eighteen months is a warning sign.

Use a security-focused host. Managed WordPress hosts like Kinsta, WP Engine, Pressable, and Cloudways run server-level security that catches things a plugin cannot. Web application firewalls, malware scanning, and isolated environments are worth the premium. If you are on shared hosting that costs three dollars a month, your security posture is exactly what you paid for.

Monitor for compromised credentials. If your admin password was part of a data breach, no amount of core security improvements will help you. Use a password manager, enable two-factor authentication, and check haveibeenpwned.com periodically.

The WordPress security team is doing the right thing by going proactive. But security is a shared responsibility. The core team can harden the software. You need to harden your installation.

The bigger picture

The Core Security Initiative is also a signal about where open source security is heading. The old model — volunteer researchers finding bugs in their spare time, projects patching when they get around to it — does not scale when AI can weaponize a vulnerability faster than a human can write a report. Every major open source project will face the same pressure. WordPress is just the biggest and most visible, so it moved first.

The initiative also matters because of the context around WordPress right. The ecosystem has been turbulent. The WP Engine antitrust case is heading to trial. Matt Mullenweg was briefly ousted as CEO, then returned. Cloudflare launched EmDash as a WordPress alternative. Through all of that, the security team quietly built something that actually protects users. The politics are loud. The security work is quiet. That is how it should be.

If you have been watching the WordPress drama and wondering whether the platform is still worth building on, the security initiative is evidence that the people doing the actual work are still focused on the right things. The governance fights are real, but they are happening in boardrooms and courtrooms. The code is still getting better.

AI changed the threat landscape for every website on the internet. WordPress is the first major CMS to respond with an AI-powered defense built into its core security process. It will not be the last. If you run a WordPress site, update your installation, audit your plugins, and pick a host that takes security seriously. The core team is doing their part. Make sure you are doing yours.

Sources: Search Engine Journal — WordPress Announces A Proactive Security Initiative, WP Tavern — #232 Aaron D. Campbell on Navigating WordPress Security in the AI Era, make.wordpress.org — The Core Security Initiative