WordPress 4.7.2 REST API security fix
WordPress disclosed an unauthenticated privilege-escalation flaw in a core REST API endpoint, fixed in 4.7.2. This is a historical core issue; plugin vulnerabilities need separate attribution.
Source ↗Key facts
| Model | Open-source CMS; GPL license |
|---|---|
| Content | Posts, pages and custom content types |
| Workflow | Scheduled publishing and revisions |
| Best suited to | Editorial sites and structured publishing. |
| Before you commit | Self-hosting requires PHP and a compatible database. |
| Pricing & plans | Free license; hosting billed separately Official website ↗ |
| Source | wordpress.org ↗ wordpress.org ↗ |
Usage history
Published observations; lines connect measured dates. Global identified-CMS share, not absolute website counts. W3Techs ↗
Data
| Platform profile | Jan 1, 2023 | Jan 1, 2024 | Jan 1, 2025 | Jan 1, 2026 | Oct 19, 2026 |
|---|---|---|---|---|---|
| WordPress | 63.7% | 62.9% | 62% | 60.2% | 58.4% |
A closer look
Oct 20, 2026
Watch it in action
Introduction to WordPress · WordPress
Pricing & plans
Free license; hosting billed separately
Software license only; hosting and operations cost extra.
Pricing & plans ↗Usage by country
| Country | Live websites |
|---|---|
| 🇺🇸 United States | 16,814,166 |
| 🇩🇪 Germany | 1,919,804 |
| 🇬🇧 United Kingdom | 1,379,460 |
| 🇫🇷 France | 976,981 |
| 🇧🇷 Brazil | 963,408 |
| 🇮🇹 Italy | 933,924 |
| 🇳🇱 Netherlands | 872,504 |
| 🇪🇸 Spain | 718,373 |
| 🇯🇵 Japan | 715,868 |
| 🇮🇳 India | 712,650 |
Live websites detected by BuiltWith. Leading countries; partial coverage. · Source ↗
Company
| Company name | WordPress open-source project |
|---|---|
| Founders | Matt Mullenweg, Mike Little |
Timeline 10
- Launch↗
WordPress released 0.70 as open source, allowing the community to inspect, modify and redistribute the software.
- Product update↗
WordPress 1.2 introduced plugin hooks, allowing developers to extend behavior without repeatedly changing the CMS core.
- Product update↗
WordPress 3.0 merged WordPress MU into core, enabling multiple sites to share one installation and administration system.
- Security↗
WordPress 4.7.2 fixed an unauthenticated privilege-escalation vulnerability in the core REST API.
- Product update↗
WordPress 5.0 made the Gutenberg block editor the default, replacing classic editing and reshaping plugin and theme workflows.
- Product update↗
WordPress 5.9 introduced full-site editing and block themes, extending blocks from post content to headers, footers and navigation.
- Crisis↗
WordPress.org blocked WP Engine’s access to its resources during a dispute over contributions and trademark licensing; access was later restored.
- Crisis↗
A federal court granted a preliminary injunction requiring restoration of WP Engine’s WordPress.org access; this was interim relief, not a final judgment.
- Crisis↗
Automattic, the company behind WordPress.com, announced a 16% workforce reduction; the announcement concerned its employees, not the entire WordPress project.
- Product update↗
WordPress 6.9 added block-level review notes and an Abilities API, bringing contextual team feedback and machine-readable capabilities into core.
Known incidents
Community voices
Blog
Before you commit
Self-hosting requires PHP and a compatible database.
Your practical checklist
