Independent WordPress news for site owners
WordPress, explained for site owners.
WPWithin explains what changed in WordPress, who needs to care, and what to do next. Read the weekly Weekend Within roundup or explore practical articles on security, AI, updates, and more.
Latest WordPress news roundup
Read the latest roundup Issue 13 / Weekend Within · August 07
Issue 13: A Backdoor Rode In Through the Front Door
WordPress 7.0.3 patches 12 flaws, one leading to remote code execution. A backdoored update hit Fluent Forms and Ninja Tables Pro for five hours.
Inside this issue
01
Security WordPress 7.0.3 fixes an RCE flaw, and a backdoored update hit two commercial plugins.
02
Block Editor WordPress 7.1's release candidate locks in August 19, with new button hover styling.
03
Commerce WooCommerce 11.0 speeds up store pages and fixes how refunds count in reports.
04
Business WordPress Credits added 10 new partner institutions in July, its strongest month yet.
Latest WordPress articles
Browse all WordPress articles August 09
Supply Chain Attack Hits Seven BdThemes Elementor Plugins With Hidden Backdoors
Attackers hijacked a promotional banner feed in seven BdThemes Elementor plugins to plant rogue admin accounts and hidden backdoors. Check your site now.
Security
4 min
August 07
Issue 13: A Backdoor Rode In Through the Front Door
WordPress 7.0.3 patches 12 flaws, one leading to remote code execution. A backdoored update hit Fluent Forms and Ninja Tables Pro for five hours.
Weekend Within roundup
5 min
August 07
WordPress 7.0.3 Patches 12 Security Flaws, One Could Lead to Remote Code Execution
WordPress 7.0.3 fixes 12 security flaws, including a login screen bug that can lead to remote code execution. Update your site now.
Security
3 min
August 07
WordPress Security Reports Jumped From 30 a Month to 450 as AI Tools Take Over the Hunting
WordPress security reports jumped from about 30 a month to 450 in July, as AI tools like Anthropic and pwn.ai now find and prove exploitable bugs.
Security
3 min
August 07
A Forgotten Server Let Attackers Backdoor Fluent Forms Pro and Ninja Tables Pro Updates
A forgotten server let attackers backdoor Fluent Forms Pro and Ninja Tables Pro updates for five hours. Check your site if you updated on July 31.
Security
3 min
August 05
Patchstack: WordPress.org Holds Security Patches as Long as Cosmetic Updates
Patchstack found WordPress.org holds critical security patches for the same delay as cosmetic updates, leaving known flaws exposed for hours longer.
Security
4 min