You Don’t Need to Update to New Major Releases of WordPress to Get WordPress Security Updates
Recently, we ran across someone who was asking why they needed to keep updating WordPress itself when they all they needed were security updates and not new features. What they didn’t know is that you don’t need to do all those updates.
If you just want security updates, you can stay on an older major release of WordPress. Security updates are still being released for versions back to 4.1, which was released in 2014. So, for example, if you were currently on 6.6, when 6.7 is released, you can avoid updating to that. You will still get security updates for the older version 6.6 being used. Normally, that happens automatically.
Depending on the plugins you use, you may need to update to a new major release of WordPress to get security updates for the plugins, as the developers of those may change what versions of WordPress they support.
You also may need to update to support newer versions of server software, including PHP, but that isn’t a frequent issue unless you are always running the latest version of that software.