clareoc

Greetings Jan – thank you for your rapid response.

Generally speaking the answer is “no”.

Where I am puzzled is that the code changes for this patch appear to be in the core browser for those 3.x versions, and because the 4/21 security release just 6 days before was pushed out to these versions right away.

For what it’s worth, I think it’d be good for security release announcements to explicitly say which (x.x) versions will be patched, and “all others will not receive a patch.”

I think this is especially important, as the auto-update process for versions >= 3.7 can lead to a feeling of security that those auto-update-capable versions will be updated.

Same thing is going on with 3.8.8 and 3.7.8, which are the equivalent patch versions to 3.9.6 (that were a part of the 4/27/15 patch).

The Codex pages for those 3.x.x versions (incl the one the OP linked to) all say, “This page references a future version of WordPress which is under development. It will be completed when the release is made publicly available.”

Other versions of the 4/27/15 patch (4.0.4, 4.1.4, and 4.2.1) don’t seem to have this problem.

Share hope that resolved soon for the auto-updating (>= 3.7) branches of WP.