Commit f5e6a75098e for woocommerce

commit f5e6a75098e8662e675b5717da37e55af5eda55f
Author: Darren Ethier <darren@roughsmootheng.in>
Date:   Fri Aug 14 10:34:21 2026 -0400

    Clarify security policy. (#67733)

diff --git a/docs/contribution/releases/security-support.md b/docs/contribution/releases/security-support.md
index 11c900184e4..a18ea41e448 100644
--- a/docs/contribution/releases/security-support.md
+++ b/docs/contribution/releases/security-support.md
@@ -6,19 +6,19 @@ sidebar_position: 10

 # Security Patch Support Policy

-WooCommerce provides security patches for the **last 21 major versions**. If the current stable WooCommerce version is 11.0, that means version **9.0 and newer**.
+When a security fix warrants it (CVSS score >=9), WooCommerce will provide security patches for the **last 21 major versions**. If the current stable WooCommerce version is 11.0, that means version **9.0 and newer**. Otherwise, we publish fixes for the latest version.

 "Major version" follows WooCommerce's release numbering (`10.8`, `10.9`, `11.0`, ...), not semantic versioning. At the current release cadence, 21 major versions correspond to roughly two years of releases.

 ## What this means

-- Security fixes are backported to every supported major version affected by the vulnerability, and ship as [point releases](/docs/contribution/releases/point-releases).
+- When the impact of a security issue warrants it (CVSS score >=9) - security fixes are backported to every supported major version affected by the vulnerability (within the established support window), and ship as [point releases](/docs/contribution/releases/point-releases).
 - Versions older than the support window do not receive security patches. Stores on unsupported versions must update to a supported version to receive fixes.
 - The window is a rolling count: each new major release moves the floor up by one version.

 ## Exceptions

-For critical vulnerabilities - actively exploited, or with severe impact (for example CVSS 9.0+) - the security team may patch versions beyond the standard window. How far back to patch is at the security team's discretion, weighing exploitation risk against the affected install base.
+For some class of critical vulnerabilities, we may as a courtesy backport outside the established policy.

 ## Reporting