Welcoming 2024 with WordPress 6.5 Beta 1

It’s start of a new year, and WordPress 6.5 is almost ready – the first major releaseMajor Release A set of releases or versions having the same major version number may be collectively referred to as “X.Y” -- for example version 5.2.x to refer to versions 5.2, 5.2.1, and all other versions in the 5.2. (five dot two dot) branch of that software. Major Releases often are the introduction of new major features and functionality. of 2024!

The BetaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. 1 is set to be launched tomorrow, February 13, 2024. Like previous major releases, we’re inviting security researchers to try and find security issues between Beta 1 and the final release candidateRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge. that target the new code. Valid submissions will be eligible for double the bounties.

Several new features and improvements are planned for WordPress 6.5. As an example, here’s a summary of the improvements we’re going to see in the Editor, where one likely spends most of their time.

Full release schedule is here.

How to report security issues?
WordPress security team accepts security issues through our HackerOne program. The general eligibility criteria for reports is mentioned in the program policy and must be followed.

As a reminder, reports that highlight issues in the new code will be eligible for double bounties.

X-post: Incident Response Team: Call for Nominations

X-comment from +make.wordpress.org/project: Comment on Incident Response Team: Call for Nominations

X-post: Update on Matrix Migration: Pausing the Transition

X-comment from +make.wordpress.org/project: Comment on Update on Matrix Migration: Pausing the Transition

X-post: Embracing Matrix for Enhanced Communication

X-comment from +make.wordpress.org/project: Comment on Embracing Matrix for Enhanced Communication

X-post: Create Tours for Make P2s

X-comment from +make.wordpress.org/meta: Comment on Create Tours for Make P2s

Bug bounty for WordPress 6.4 Beta

Think you found a security bug in WordPress 6.4 BetaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process.?

The WordPress Security Team wants to find potential security issues before they land in the final WordPress release. Like last time, we’d love to see researchers focusing more of their attention on new code being introduced in beta releases, so we’re offering to double the bounty for any new vulnerability in CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. that is reported after Beta 1 and before the final release candidateRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge. (RCRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge.).

For example, a bug that would normally be awarded $600 would be doubled to $1200 if reported in the new code between Beta 1 and the final RC.

Release schedule for WordPress 6.4 Beta/RC releases can be found here (Beta 1 is scheduled for today). There’s usually about a month between the first beta and the last release candidate (RC).

How can I report security issues?

WordPress security team accepts security issues through our HackerOne program. The general eligibility criteria for reports is mentioned in the program policy and must be followed.

Do existing vulnerabilities qualify if I report them during the beta period?

No, the intent of the bonus is to catch security bugs before they make it into a final release, so only vulnerabilities in new code qualify.

Doubling the Bounties for WordPress 6.3 Beta

WordPress 6.3 BetaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. 1 will be released later today, June 28th. As with the previous release cycles, this time too we’re focused on finding new security issues before they make it to the final release.

WordPress security team is inviting security researchers to find security bugs in WordPress 6.3. We will double the bounties for any new vulnerabilities reported in the new code for WordPress. The submission window will open today with the release of Beta 1 and close before the final release candidateRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge. (RCRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge.) is out.

We post here whenever a beta or RC release is ready: https://wordpress.org/news/.

Release schedule for WordPress 6.3 beta/RC releases can be found here.

How can I report security issues?

WordPress security team accepts security issues through our HackerOne program, which can be found here. The general eligibility criteria for reports is mentioned in the program policy and must be followed.

Do existing vulnerabilities qualify if I report them during the beta period?

No, the intent of the bonus is to catch security bugs before they make it into a final release, so only vulnerabilities in new code qualify.

We have more info in this previous announcement.

#bounties

Dropping security updates for WordPress versions 3.7 through 4.0

The WordPress Security Team will cease providing updates for WordPress versions 3.7 – 4.0 in three months time, as of December 1, 2022.

Officially WordPress only provides support for the latest version of the software. The Security team historically has a practice of backporting security fixes as a courtesy to sites on older versions in the expectation the sites will be automatically updated.

Until now, these courtesy backports have included all versions of WordPress supporting automatic updates. Versions WordPress 3.7 – 4.0 have reached levels of usage, namely less than 1% of total installs, where the benefit of providing these updates is outweighed by the effort involved.

Background

Sites running WordPress 3.7 – 4.0 form a very low percentage of total WordPress installations. Conversely, backporting security updates to older versions of WordPress takes a substantial amount of time; this effect compounds with each new major version released.

The effect of this imbalance means that the Security team spends most of the time preparing backports for the vast minority of WordPress installations. By dropping support for these older versions, the newer versions of WordPress will become more secure as more time can be focused on their needs.

The decision on which versions to drop support for was based on the percentage of sites reported on the statistics page.

Process

An out of date version of WordPress, in this case versions 4.0.* and older, will display a non-dismissible notice in the dashboard informing users an update is available. In the final updates for these WordPress versions, these notices will be made more prominent and inform the administrator their version of WordPress is no longer receiving security updates.

Update notice for sites no longer receiving security updates: "WordPress 6.0.2 is available! Please update now. Important! Your version of WordPress (3.8.39) is no longer supported, you will not receive any security updates for your website. To keep your site secure, please update to the latest version of WordPress".

An additional string will be added to the code base to allow for the future dropping of security support.
These strings will be committed to trunk and backported to each of the earlier versions prior to the release date. This will allow the Polyglot teams to translate them and for the strings to begin appearing in translation packages. Don’t panic: not all of the versions of WordPress containing these strings will be affected any time soon.

X-post: Contributor Teams: Submit WCUS 2022 Table Leads Signup Form by July 29

X-comment from +make.wordpress.org/community: Comment on Contributor Teams: Submit WCUS 2022 Table Leads Signup Form by July 29

X-post: Announcement: Incident Response Training

X-comment from +make.wordpress.org/updates: Comment on Announcement: Incident Response Training