# Patch Coverage Is a Distribution Problem Not a Code Problem ## Claim Writing a security fix is the cheap part; getting it onto every version anyone still runs is where plugin security actually fails. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for any software with a long tail of installed versions and no forced upgrade path — WordPress plugins, self-hosted applications, embedded firmware, distro packages. - There is always a floor. Even generous backporting stops somewhere, and the users below that line are the ones least likely to know they are below it. - The gap is structural, not negligent: a maintainer cannot patch a branch they no longer have a build environment for, which is precisely what makes tooling that reconstructs old environments a security capability rather than a convenience. - Breaks where upgrades are forced or the version spread is narrow — a SaaS product has no distribution problem because it has no versions in the field. ## Evidence Pods 3.3.9.2 backported five security fixes across **seven** release branches, down to 2.7.31.4 supporting WordPress 4.5 — unusual discipline, since most plugins patch only the current line. The team credits WordPress Playground's era-testing work as what made validating those old branches possible at all. And the floor still bites. The advisory states *Affected versions: Pods 2.0+* and *Patched versions available: Pods 2.7+* on adjacent lines without comment, while the opening instructs readers to update "if you are running any version of Pods." Sites on 2.0–2.6 are inside the affected range, outside the patched range, and given no guidance. On a plugin with roughly 100,000 active installs, the residual exposure is a distribution artifact — the code fix exists and cannot reach them. Nothing in the plugin directory tells a user they are sitting on an affected branch with no patch. ## Links - [[3. Resources/Permanent Notes/A Patch Release Starts an Exploitation Race Not a Grace Period]] — extends: that note sets the clock running at release; this one observes that for part of the install base the clock never stops, because no patch is coming. - [[3. Resources/Permanent Notes/A Single Discretionary Update Channel Is a Security Dependency]] — evidence-for: every patched build here is a `downloads.wordpress.org` link, so the fix's reach is bounded by one channel's reach. - [[3. Resources/Permanent Notes/A Release Policy Should Separate Code-Integrity Risk From Patch-Delivery Urgency]] — applies-in: this is the delivery half of that separation, isolated and made concrete. - [[3. Resources/Permanent Notes/A Plugins Survival Requires Owning Distribution Beyond the Repo]] — parallels: the same distribution dependency that limits commercial reach also limits security reach. - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: hosts are the only actor positioned to close the branch-floor gap, by inventorying versions rather than relying on user action. - [[3. Resources/Permanent Notes/A Patched Vulnerability Still Exposes Whoever Has Not Updated]] — contrasts: this note is about installs a patch structurally cannot reach at all; that note is about installs the patch already reached that simply haven't applied it — different mechanism, same result of exposure outliving the fix - [[3. Resources/Permanent Notes/An SVN Commit Succeeding Is Not Users Receiving the Update]] — the WordPress.org instance, where a review pipeline and cooldown now sit between a fix existing and a fix arriving. ## Tests / falsifiers - Sample recent WordPress plugin security releases and count how many patch more than the current branch. If most do, seven branches is unremarkable and the "distribution is where it fails" framing overstates the norm. - Check whether wp.org exposes version-distribution data for a plugin. If a maintainer can see how many installs sit below their patch floor, the gap is measurable rather than invisible, and the claim weakens toward "unmeasured" rather than "structural." - Watch whether Playground-based era testing correlates with deeper backports across projects over the next year. ## Maintenance - Last tended: 2026-08-31