Independent WordPress news for site owners
WordPress, explained for site owners.
WPWithin explains what changed in WordPress, who needs to care, and what to do next. Read the weekly Weekend Within roundup or explore practical articles on security, AI, updates, and more.
Latest WordPress news roundup
Read the latest roundup Issue 19 / Weekend Within · September 18
Issue 19: No-Login Site Takeovers, and a New Look for WordPress's Default Theme
Two critical WordPress plugin flaws are being exploited with no login required. WordPress 7.1.1 patches 11 more bugs, and passkey login goes free.
Inside this issue
01
Security Two unauthenticated flaws are under active attack, and WordPress 7.1.1 patches 11 more bugs.
02
Block Editor Gutenberg's Gallery block gets a real grid, and WordPress unveils its first non-year-named default theme.
Latest WordPress articles
Browse all WordPress articles September 19
Click2Shell: The Full Story Behind the WordPress Theme Install Bug Patched This Week
A CSRF and selector injection chain called Click2Shell could let attackers run code by tricking an admin into clicking one link. Update to WordPress 7.1.1.
Security
3 min
September 19
WordPress 7.2 Roadmap: A Secrets API, Admin Re-Authentication, and the Ipsum Theme
WordPress 7.2 is set for December with a Secrets API, admin re-authentication for sensitive actions, and a new default theme called Ipsum.
WordPress Updates
3 min
September 18
A Critical Flaw in the Library That Opens iPhone Photos Could Expose Your Server
A critical flaw in libheif, the library servers use to process iPhone photos, can expose files or run code. Ask your host if it is patched.
Security
2 min
September 18
A High-Severity Flaw in Tutor LMS Lets Subscribers Take Over Your Server
A high-severity flaw in Tutor LMS lets any subscriber-level user take over your server. The plugin runs on 100,000+ sites. Update to 4.0.8 now.
Security
2 min
September 18
Issue 19: No-Login Site Takeovers, and a New Look for WordPress's Default Theme
Two critical WordPress plugin flaws are being exploited with no login required. WordPress 7.1.1 patches 11 more bugs, and passkey login goes free.
Weekend Within roundup
5 min
September 18
WooCommerce Brings Back Its Purple Block Theme for Public Beta Testing
WooCommerce revived its shelved Purple block theme for public beta testing, with built-in galleries and headers extensions once required. Test on staging.
Commerce
2 min