Wordpress 2.x — End of Life
EOL High riskWordpress 2.x reached end of life on Jun 17, 2010, 5984 days ago, and no longer receives security fixes. The most recent release in this series is 2.9.2. 1 CVE is tracked for this series. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is Wordpress 3. See Wordpress 3 →
Wordpress 2.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 2.9 | Dec 18, 2009 | Jun 17, 2010 | Jun 17, 2010 | 2.9.2 | EOL | |
| 2.8 | Sep 10, 2009 | Dec 18, 2009 | Dec 18, 2009 | 2.8.6 | EOL | |
| 2.7 | Dec 10, 2008 | Sep 10, 2009 | Sep 10, 2009 | 2.7.1 | EOL | |
| 2.6 | Jul 14, 2008 | Dec 10, 2008 | Dec 10, 2008 | 2.6.5 | EOL | |
| 2.5 | Mar 29, 2008 | Jul 14, 2008 | Jul 14, 2008 | 2.5.1 | EOL | |
| 2.3 | Sep 24, 2007 | Mar 29, 2008 | Mar 29, 2008 | 2.3.3 | EOL | |
| 2.2 | May 15, 2007 | Sep 24, 2007 | Sep 24, 2007 | 2.2.3 | EOL | |
| 2.1 | Jan 22, 2007 | Sep 24, 2007 | Sep 24, 2007 | 2.1.3 | EOL | |
| 2.0 | Dec 26, 2005 | Aug 5, 2007 | Aug 5, 2007 | 2.0.11 | EOL |
CVEs affecting Wordpress 2.x (9)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.7 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.6 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.3 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.9 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.2 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.1 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.5 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.0 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
| CVE-2011-4899 | HIGH | 7.5 | — | — | 2.8 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie… | Jan 30, 2012 |
Wordpress 2.x is EOL — migrate to Wordpress 3.x
Wordpress 3.x is the next major release. Plan your upgrade before Wordpress 2.x stops receiving security patches.
Add a Wordpress 2 EOL badge to your README
Show your users which Wordpress version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/wordpress/2)Frequently asked questions
Is Wordpress 2 end of life?
Yes. All Wordpress 2.x releases have reached end of life and no longer receive security patches. There are 1 known CVE affecting Wordpress 2.x. Migrate to Wordpress 3.x as soon as possible.
What CVEs affect Wordpress 2?
There are 1 CVE tracked for Wordpress 2.x. See the full list above with CVSS and EPSS scores.
What is the latest Wordpress 2 version?
The latest Wordpress 2.x patch release is 2.9.2, released on February 15, 2010. Always run the latest patch to benefit from all security fixes.
How to migrate from Wordpress 2 to Wordpress 3?
To migrate from Wordpress 2 to Wordpress 3: (1) review the official Wordpress 3 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Wordpress 2 in production?
No. Wordpress 2 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA