Wordpress 4.x — End of Life
Active Actively exploitedWordpress 4.x is partially supported: only 4.9, 4.8, 4.7 still receive security fixes. The most recent release in this series is 4.9.34. 2 CVEs are tracked for this series, including 1 actively exploited according to CISA KEV. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is Wordpress 5. See Wordpress 5 →
Wordpress 4.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 4.9 | Nov 16, 2017 | Dec 6, 2018 | No | 4.9.34 | Active | |
| 4.8 | Jun 8, 2017 | Nov 16, 2017 | No | 4.8.33 | Active | |
| 4.7 | Dec 6, 2016 | Jun 8, 2017 | No | 4.7.38 | Active | |
| 4.6 | Aug 16, 2016 | Dec 6, 2016 | Jul 31, 2025 | 4.6.30 | EOL | |
| 4.5 | Apr 12, 2016 | Aug 16, 2016 | Jul 31, 2025 | 4.5.33 | EOL | |
| 4.4 | Dec 9, 2015 | Apr 12, 2016 | Jul 31, 2025 | 4.4.34 | EOL | |
| 4.3 | Aug 18, 2015 | Dec 9, 2015 | Jul 31, 2025 | 4.3.35 | EOL | |
| 4.2 | Apr 23, 2015 | Aug 18, 2015 | Jul 31, 2025 | 4.2.39 | EOL | |
| 4.1 | Dec 18, 2014 | Apr 23, 2015 | Jul 31, 2025 | 4.1.42 | EOL | |
| 4.0 | Sep 4, 2014 | Dec 18, 2014 | Dec 1, 2022 | 4.0.38 | EOL |
CVEs affecting Wordpress 4.x (19)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.0 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.5 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.3 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.6 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.8 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.2 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.4 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.1 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.9 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 4.7 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.2 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.5 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.7 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.3 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.4 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.6 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.9 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.8 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 4.1 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
Wordpress 4.x will reach end of life — migrate to Wordpress 5.x
Wordpress 5.x is the next major release. Plan your upgrade before Wordpress 4.x stops receiving security patches.
Add a Wordpress 4 EOL badge to your README
Show your users which Wordpress version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/wordpress/4)Frequently asked questions
Is Wordpress 4 end of life?
Partially. 7 of the 10 Wordpress 4.x releases have reached end of life. Still supported: 4.9, 4.8, 4.7.
What CVEs affect Wordpress 4?
There are 2 CVEs tracked for Wordpress 4.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Wordpress 4 version?
The latest Wordpress 4.x patch release is 4.9.34, released on October 6, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Wordpress 4 to Wordpress 5?
To migrate from Wordpress 4 to Wordpress 5: (1) review the official Wordpress 5 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Wordpress 4 in production?
Only on a supported release (4.9, 4.8, 4.7). Make sure you run the latest patch (4.9.34) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA