Independent WordPress news for site owners
WordPress, explained for site owners.
WPWithin explains what changed in WordPress, who needs to care, and what to do next. Read the weekly Weekend Within roundup or explore practical articles on security, AI, updates, and more.
Latest WordPress news roundup
Read the latest roundup Issue 21 / Weekend Within · October 02
Issue 21: One Click Makes a Rogue Admin, and Few Have a Recovery Plan
A critical Elementor flaw lets one clicked link create a rogue admin. Update to 4.3.2. Only 27.9% of WordPress pros have a hack recovery plan.
Inside this issue
01
Security Elementor needs a patch now, and most WordPress pros have no hack recovery plan.
02
Block Editor Gutenberg 24.1 spreads the same design tools across nearly every block.
03
WordPress Playground previews plugin emails, and the 7.2 release moves to a livestream.
Latest WordPress articles
Browse all WordPress articles October 02
Issue 21: One Click Makes a Rogue Admin, and Few Have a Recovery Plan
A critical Elementor flaw lets one clicked link create a rogue admin. Update to 4.3.2. Only 27.9% of WordPress pros have a hack recovery plan.
Weekend Within roundup
4 min
September 30
Gutenberg 24.1 Brings Matching Design Tools to Nearly Every Block
Gutenberg 24.1 adds background, color, and typography controls to almost every core block, plus a new text shadow panel in Global Styles.
Block Editor
3 min
September 29
Most WordPress Pros Still Have No Plan for Recovering From a Hack
Only 27.9% of WordPress pros have a breach recovery plan, a Melapress survey finds. Most learn of hacks when someone notices the site acting strangely.
Security
3 min
September 25
A CSRF Flaw in Elementor Lets a Single Click Create a Rogue Admin Account
A critical flaw in Elementor, active on 10 million+ sites, lets one clicked link create a rogue admin account. Update to 4.3.2 now.
Security
3 min
September 25
Issue 20: A Second Critical WordPress Patch, Under Attack Within a Day
WordPress 7.1.2 patches a critical, unauthenticated flaw already under active attack. A Tutor LMS bug and blockchain-hiding malware also demand attention.
Weekend Within roundup
6 min
September 25
WordPress Playground Can Now Show You What a Plugin's Emails Actually Look Like
WordPress Playground now lets you preview the emails a plugin or theme would send, so you can test contact forms and order confirmations before going live.
Playground
3 min