Wordpress 5.x — End of Life
Active Actively exploitedWordpress 5.x is still supported and has no announced end-of-life date yet. The most recent release in this series is 5.9.19. 2 CVEs are tracked for this series, including 1 actively exploited according to CISA KEV. The next major version is Wordpress 6. See Wordpress 6 →
Wordpress 5.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 5.9 | Jan 25, 2022 | May 24, 2022 | No | 5.9.19 | Active | |
| 5.8 | Jul 20, 2021 | Jan 25, 2022 | No | 5.8.18 | Active | |
| 5.7 | Mar 9, 2021 | Jul 20, 2021 | No | 5.7.20 | Active | |
| 5.6 | Dec 8, 2020 | Mar 9, 2021 | No | 5.6.22 | Active | |
| 5.5 | Aug 11, 2020 | Dec 8, 2020 | No | 5.5.23 | Active | |
| 5.4 | Mar 31, 2020 | Aug 11, 2020 | No | 5.4.24 | Active | |
| 5.3 | Nov 12, 2019 | Mar 31, 2020 | No | 5.3.26 | Active | |
| 5.2 | May 7, 2019 | Nov 12, 2019 | No | 5.2.29 | Active | |
| 5.1 | Feb 21, 2019 | May 7, 2019 | No | 5.1.27 | Active | |
| 5.0 | Dec 6, 2018 | Feb 21, 2019 | No | 5.0.30 | Active |
CVEs affecting Wordpress 5.x (20)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.6 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.7 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.1 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.9 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.2 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.0 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.4 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.3 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.8 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2026-87902 | HIGH | 8.1 | 39.97% | KEV | 5.5 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph… | Sep 22, 2026 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.3 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.6 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.0 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.7 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.5 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.1 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.4 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.9 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.8 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
| CVE-2023-39999 | MEDIUM | 4.3 | 1.19% | — | 5.2 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, … | Oct 13, 2023 |
Wordpress 5.x will reach end of life — migrate to Wordpress 6.x
Wordpress 6.x is the next major release. Plan your upgrade before Wordpress 5.x stops receiving security patches.
Add a Wordpress 5 EOL badge to your README
Show your users which Wordpress version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/wordpress/5)Frequently asked questions
Is Wordpress 5 end of life?
No. Wordpress 5.x is still supported. It continues to receive security patches and bug fixes.
What CVEs affect Wordpress 5?
There are 2 CVEs tracked for Wordpress 5.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Wordpress 5 version?
The latest Wordpress 5.x patch release is 5.9.19, released on October 6, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Wordpress 5 to Wordpress 6?
To migrate from Wordpress 5 to Wordpress 6: (1) review the official Wordpress 6 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Wordpress 5 in production?
Yes, Wordpress 5 is still supported. Make sure you run the latest patch (5.9.19) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA