WordPress Security

WordPress powers a large share of the web, and keeping it secure is a shared responsibility. The WordPress Security fund pays for the work that protects WordPress core and the sites that run it.

AI has changed how vulnerabilities are found and reported. The volume of reports is rising, and the cost of triaging, fixing and shipping security releases is rising with it. This fund helps cover that cost so it is shared across the ecosystem.

Donations to this fund are used only for WordPress security, and distributed by the WordPress security team, including:

The fund is held by the WordPress Foundation, a 501(c)(3) nonprofit, and is kept separate from the Foundation’s general funds. Spending is reported publicly on this page. Payments are listed without details of any vulnerability, so nothing about unpatched issues is disclosed.

Contributors are thanked publicly on this page. Contributing does not give access to vulnerability reports or advance notice of security releases. Security information is shared only through the WordPress Security Team’s normal disclosure process.

Companies interested in a larger contribution, or in sponsoring contributors to the Security Team, can contact [email protected].