WordPress articles
Browse plain-English WordPress news and analysis, newest first. Read the Weekend Within weekly roundups or explore standalone articles on security, AI, WordPress updates, performance, WooCommerce, and the block editor.
2026 · 147 articles
Some Rank Math SEO PRO 3.0.123 Downloads Contained Malware. Update to 3.0.124
Some Rank Math SEO PRO 3.0.123 downloads contained malware. If you updated on Oct 15 or 16, treat your site as compromised and update to 3.0.124.
Backuply Flaw Can Give Attackers Admin Access During a Restore. Update to 1.5.9
Update Backuply to 1.5.9 or later. A logged-in attacker can plant malicious data that takes over your site when you restore a database backup.
Issue 23: Patch Your Plugins, and Ask Your Host About Ghostscript
Backuply and All in One SEO need updates, and a critical Ghostscript flaw sits on your server, not in WordPress. Gutenberg 24.2 turns on React 19.
WordPress Delays an Accessibility Fix for Dashboard Notices
WordPress has reverted planned dashboard notice improvements after false counts appeared. Screen reader users still face the existing barriers.
Gutenberg 24.2 Moves Notes Beside Your Content and Turns On React 19
Gutenberg 24.2 moves editor notes into a side margin, sorts galleries, and switches on React 19 by default. Test it on staging first.
All in One SEO Patched Two Security Flaws. Update to 5.0.2.1
All in One SEO, used on 2 million+ sites, patched two medium-severity flaws. Update to 5.0.2.1 or later to close both of them.
A Critical Ghostscript Flaw Could Let a Crafted PDF Take Over Your WordPress Server
A critical Ghostscript flaw (CVSS 9.8) can let a crafted PDF run code on your server. There is no plugin to update, so ask your host if it is patched.
Jetpack 16.3 Adds Video Blocks, Form Logic, and a New Features Tab
Jetpack 16.3 adds three video and scheduling blocks, form conditional logic, and a new Features tab. Update to see the reorganized settings.
Issue 22: Three Plugins Under Attack, and WordPress Opens a Door for AI
Attackers are exploiting Bricksforge, Ninja Forms, and WPC Product Bundles. WordPress 7.1.3 fixes 7 flaws, and the MCP Adapter hits the plugin directory.
WooCommerce 11.2 Adds a Checkout Date Picker and Changes Who Gets Account Emails
WooCommerce 11.2 adds a checkout date picker, UPC-based imports, and sticky filters. Admin email copies and shop manager rights change.
WordPress 7.2 Will Switch Off a Database Mode That Breaks Queries
WordPress 7.2 will switch off the NO_BACKSLASH_ESCAPES database mode to prevent broken queries. Most sites need to do nothing.
Attackers Are Exploiting a Critical Bricksforge Flaw to Upload Code Without a Login
Attackers are exploiting a critical Bricksforge flaw that lets anyone upload and run PHP code without logging in. Update to 3.1.8.10 now.
WordPress's MCP Adapter Plugin Is Now in the Plugin Directory
WordPress's MCP Adapter is now in the plugin directory, giving AI assistants a standard way into your site. It's experimental, so test first.
Attackers Are Exploiting Ninja Forms and WPC Product Bundles to Plant Hidden Admins
Attackers are exploiting Ninja Forms and WPC Product Bundles flaws to plant hidden admin accounts. Update, then check for rogue users.
WordPress 7.1.3 Fixes 7 Security Flaws, Including Exposed Private Comments
WordPress 7.1.3 fixes 7 security flaws, including stored XSS in comment moderation and exposed private comments. Update your site now.
WordPress's AI Plugin 1.4.0 Adds Markdown Feeds and a Comment Value Score
AI plugin 1.4.0 adds opt-in Markdown feeds for AI tools and a Comment Value score for moderation. Update if you use the plugin.
WordPress.org Won't Delist Themes Over the Accessibility-Ready Tag After All
WordPress.org will not delist themes over the accessibility-ready tag. It will become an opt-in listing that can be removed if a theme falls short.
Issue 21: One Click Makes a Rogue Admin, and Few Have a Recovery Plan
A critical Elementor flaw lets one clicked link create a rogue admin. Update to 4.3.2. Only 27.9% of WordPress pros have a hack recovery plan.
Gutenberg 24.1 Brings Matching Design Tools to Nearly Every Block
Gutenberg 24.1 adds background, color, and typography controls to almost every core block, plus a new text shadow panel in Global Styles.
Most WordPress Pros Still Have No Plan for Recovering From a Hack
Only 27.9% of WordPress pros have a breach recovery plan, a Melapress survey finds. Most learn of hacks when someone notices the site acting strangely.
A CSRF Flaw in Elementor Lets a Single Click Create a Rogue Admin Account
A critical flaw in Elementor, active on 10 million+ sites, lets one clicked link create a rogue admin account. Update to 4.3.2 now.
Issue 20: A Second Critical WordPress Patch, Under Attack Within a Day
WordPress 7.1.2 patches a critical, unauthenticated flaw already under active attack. A Tutor LMS bug and blockchain-hiding malware also demand attention.
WordPress Playground Can Now Show You What a Plugin's Emails Actually Look Like
WordPress Playground now lets you preview the emails a plugin or theme would send, so you can test contact forms and order confirmations before going live.
Attackers Are Actively Exploiting the WordPress Flaw From Yesterday's Patch
Attackers are actively exploiting the critical WordPress flaw patched this week, writing files to servers that have not updated. Patch to 7.1.2 now.
Wordfence Found WordPress Malware That Hides on the Ethereum Blockchain
Wordfence found WordPress malware disguised as a must-use plugin that reinstalls itself and hides its control server inside the Ethereum blockchain.
WordPress 7.1.2 Fixes a Critical Bug That Let Anyone Take Over Your Site
WordPress 7.1.2 fixes a critical, unauthenticated flaw that can let attackers run code on your site. It affects versions back to 2016. Update now.
Click2Shell: The Full Story Behind the WordPress Theme Install Bug Patched This Week
A CSRF and selector injection chain called Click2Shell could let attackers run code by tricking an admin into clicking one link. Update to WordPress 7.1.1.
WordPress 7.2 Roadmap: A Secrets API, Admin Re-Authentication, and the Ipsum Theme
WordPress 7.2 is set for December with a Secrets API, admin re-authentication for sensitive actions, and a new default theme called Ipsum.
A Critical Flaw in the Library That Opens iPhone Photos Could Expose Your Server
A critical flaw in libheif, the library servers use to process iPhone photos, can expose files or run code. Ask your host if it is patched.
A High-Severity Flaw in Tutor LMS Lets Subscribers Take Over Your Server
A high-severity flaw in Tutor LMS lets any subscriber-level user take over your server. The plugin runs on 100,000+ sites. Update to 4.0.8 now.
Issue 19: No-Login Site Takeovers, and a New Look for WordPress's Default Theme
Two critical WordPress plugin flaws are being exploited with no login required. WordPress 7.1.1 patches 11 more bugs, and passkey login goes free.
WooCommerce Brings Back Its Purple Block Theme for Public Beta Testing
WooCommerce revived its shelved Purple block theme for public beta testing, with built-in galleries and headers extensions once required. Test on staging.
WordPress 7.1.1 Fixes 11 Security Bugs, Including Two Found by Anthropic
A security release for WordPress fixes 11 vulnerabilities, including two reported by Anthropic. Update your site to 7.1.1 now.
Gutenberg 24.0 Gives the Gallery Block a Real Grid Layout
Gutenberg 24.0 adds a customizable Gallery grid with per-breakpoint columns, post title revision tracking, and site titles that scale to fit.
Wordfence 9 Lets Your Site's Users Log In Without a Password
Wordfence 9 adds free passkey login, letting WooCommerce and WordPress users sign in with a fingerprint or face scan instead of a password.
WordPress Retires Year-Named Themes for a New Default Called Ipsum
WordPress.org unveiled Ipsum, a minimal blank-canvas theme set to replace year-named defaults starting with WordPress 7.2. Test it now and give feedback.
Two Critical Flaws in The Events Calendar Can Hand Attackers Full Site Control
Two critical flaws in The Events Calendar let attackers take over a site with no login required. The plugin runs on 600,000+ sites. Update to 6.17.5.
Attackers Are Exploiting a Critical Flaw in WooCommerce Wholesale Lead Capture
A critical flaw in WooCommerce Wholesale Lead Capture lets attackers upload malicious files without logging in. Update to 2.0.3.2 now.
Issue 18: A New Backstop for Bad Plugin Updates, and a Shake-Up at Automattic
WordPress.org now blocks malicious plugin updates before they ship. Automattic's board put founder Matt Mullenweg on leave, naming a new interim CEO.
WordPress.org Now Holds Every Plugin Update for 6 Hours to Scan for Backdoors
WordPress.org now holds every plugin update for 6 hours to scan it for malware. The system already caught a backdoor in a 20,000-site plugin in July.
Issue 17: Five Critical Fixes and Two Flaws Under Attack
Five plugins shipped critical fixes this week. Two older flaws are under attack, and Rank Math paused a feature that created credentials without consent.
WordPress Is Replacing the Icons in Your Admin Bar and Menu
WordPress is replacing Dashicons with SVG icons in your admin bar and menu, fixing screen reader announcements and high-contrast display glitches.
Attackers Have Been Exploiting a Critical Super Forms Flaw Since July
Attackers have exploited a critical Super Forms plugin flaw since July, and Wordfence has blocked over 250,000 attempts. Update to 6.3.314 now.
Attackers Are Now Actively Exploiting That Critical Elementor Pro Flaw
Wordfence has blocked over 190,000 exploit attempts against the critical Elementor Pro file upload flaw. Update to 4.2.2 now if you haven't already.
Gutenberg 23.9 Makes It Easier to Insert Blocks and Spot Custom Styles
Gutenberg 23.9 adds an inserter shortcut to the block toolbar and dot indicators that flag blocks with custom style overrides.
WordPress Narrows What Counts as a Valid Security Bug Report
WordPress narrowed what counts as a valid bug bounty report after low-severity submissions became unmanageable. Core and Gutenberg rules are unchanged.
SQL Injection Flaw in All-in-One WP Migration and Backup Can Lead to a Full Site Takeover
A SQL injection flaw in All-in-One WP Migration and Backup, used on 5 million sites, can lead to a full takeover during a backup restore. Update to 7.110.
Critical Flaw in Gravity Forms Lets Attackers Upload Malicious Files Without Logging In
A critical flaw in Gravity Forms lets attackers upload malicious files without logging in, if a form allows multiple file uploads. Update to 3.0.3 now.
Rank Math Pauses Its Support Agent Feature After Consent Backlash
Rank Math paused its Support Agent feature after users said it created login credentials without clear consent. It returns once consent flow is rebuilt.
WordPress Launches a Core Security Initiative to Keep Up With AI-Driven Bug Reports
WordPress is scaling its security team after bug reports jumped 15x, driven largely by AI-assisted research. Here's the new Core Security Initiative.
Rank Math's New 'Support Agent' Creates an Admin Password Without Asking First
Rank Math 1.0.277 reportedly creates an admin-level Application Password when you open Help and Support, without asking first. Revoke it now.
Critical Flaw in GiveWP Lets Attackers Take Over Your Site Without Logging In
A CVSS 10 flaw in GiveWP lets attackers take over donation sites without logging in. Update to version 4.16.7.2 immediately.
A New Plugin Turns Your WordPress Dashboard Into a Desktop
OpenStation lets you open wp-admin pages as draggable windows, like a desktop operating system. It's opt-in per user and fully reversible on deactivation.
Pods' Solo Developer Raced to Patch a Critical Flaw Across Six Plugin Versions
Pods shipped patches across six plugin versions after a critical flaw let attackers become admin. Its solo developer took the week off his job to fix it.
Your Store's Return Data Can Tell You Why Customers Send Items Back
Nearly 1 in 5 online orders gets returned. WooCommerce Analytics can show you why, and AutomateWoo can flag repeat offenders before they cost you more.
Issue 16: Six Critical Flaws, One Perfect Score
A CVSS 10 flaw in GiveWP lets attackers hijack donation sites without logging in. Five more critical plugin and theme bugs demanded updates this week.
WP Rocket's Post-Mortem: How a Known Bug Report Sat Ignored for Six Weeks
WP Rocket's post-mortem on last week's WordPress 7.1 outage reveals a bug report sat unassigned for six weeks. About 10% of its sites went down.
Critical Flaw in WPMU DEV Dashboard Lets Attackers Become Your Site Admin
A critical flaw in WPMU DEV Dashboard lets unauthenticated attackers become your site admin if Hub Single Sign-On is enabled. Update to 5.0.2 now.
Critical Flaw in the Avada Theme Lets Attackers Take Over Your Site Without Logging In
A critical, unauthenticated flaw in the Avada theme and its Fusion Builder plugin lets attackers take over your site. Update to 7.16.1 now.
WordPress Wants to Stop Plugins From Storing Your API Keys as Plain Text
WordPress plans a Secrets API so plugins stop storing your API keys as plain text. It targets version 7.2, with the settings screen following in 7.3.
Critical Flaw in TranslatePress Lets Attackers Take Over Your Admin Account
An unauthenticated TranslatePress flaw can expose an admin password reset link when a secondary language is active. Update the plugin now.
WordPress Playground Can Now Run Any Version Back to 2003
WordPress Playground can now boot any version back to 0.7 from 2003, right in your browser. Test old plugins or check compatibility before an upgrade.
WordPress Accessibility Team Previews Its First Official Plugin
WordPress's Accessibility Team previews a plugin that flags skipped heading levels and inaccessible blocks in real time. Not installable yet.
Two Critical Flaws in miniOrange SAML SSO Let Attackers Log In as Your Admin
Two critical flaws in the miniOrange SAML SSO plugin let attackers log in as your admin. Paid editions were missed by update checkers. Patch now.
Critical Flaw in the Pods Plugin Lets Attackers Become Your Site Admin
A critical flaw in the Pods plugin lets attackers become your site admin without logging in. Update to version 3.3.9.1 now if you run Pods.
Issue 15: Zero Logins Needed
Three unauthenticated plugin flaws hit Elementor Pro, Forminator, and User Profile Builder this week. WordPress 7.1 also launched with responsive styling.
WP Rocket Sites Crashed After WordPress 7.1, Fix Now Live
WP Rocket sites crashed after WordPress 7.1 launched, taking down over a third of one host's fleet. Update to WP Rocket 3.23.2.2 to fix it.
Critical Flaw in Elementor Pro Lets Attackers Take Over Your Site Without Logging In
An unauthenticated flaw in Elementor Pro lets attackers upload malicious files and take over your site. Update to version 4.2.2 now.
WordPress 7.1 'Mary Lou' Is Here With Responsive Styling and a Rebuilt Image Editor
WordPress 7.1 is here with responsive design controls, a persistent admin bar, and a rebuilt image editor. Update now to get the new tools.
Gutenberg 23.8 Lets You Link Straight to One Exact Post Revision
Gutenberg 23.8 lets editors link straight to one exact revision, emails you when someone mentions you in a note, and makes List View 40x faster.
WordPress's AI Plugin Can Now Translate Posts and Suggest Slugs
WordPress's AI plugin 1.3.0 adds in-editor content translation and slug suggestions. A key naming change also affects custom Abilities setups.
Critical Flaw in Forminator Forms Lets Attackers Take Over Your Site Without Logging In
A critical flaw in Forminator Forms lets attackers upload malicious files and take over your site without logging in. Update to 1.56.2 now.
Critical Flaw in User Profile Builder Lets Attackers Log In as Your Admin
A critical flaw in User Profile Builder can let attackers log in as your site admin. Update to version 3.16.5 now if Automatic Log In is enabled.
Issue 14: When a PNG Isn't a PNG
WordPress 7.0.4 patches an Imagick RCE flaw, its third security release in weeks. Two plugin backdoors hit official update channels this week too.
Study of 3,400 WordPress Plugin Reviews Finds Reliability, Not Missing Features, Drives 1-Star Ratings
A study of 3,400 WordPress.org plugin reviews found reliability failures drive 42% of 1-star ratings. Missing features caused just 2.5%.
WordPress.org Launches an Official Browser Extension for Chrome and Safari
WordPress.org released an official browser extension for Chrome and Safari that hides your admin bar, adds shortcuts, and previews pages on mobile.
WordPress 7.0.4 Fixes a Flaw That Let a Disguised Image Run Code on Your Server
WordPress 7.0.4 fixes a flaw where a disguised image upload lets an Author-level account run code on your server. Update now.
Matt Mullenweg Calls WordPress's Theme Accessibility Overhaul 'Permanently Delayed'
Matt Mullenweg says a WordPress theme accessibility overhaul is permanently delayed, leaving theme authors unclear on a September delisting deadline
Supply Chain Attack Hits Seven BdThemes Elementor Plugins With Hidden Backdoors
Attackers hijacked a promotional banner feed in seven BdThemes Elementor plugins to plant rogue admin accounts and hidden backdoors. Check your site now.
Issue 13: A Backdoor Rode In Through the Front Door
WordPress 7.0.3 patches 12 flaws, one leading to remote code execution. A backdoored update hit Fluent Forms and Ninja Tables Pro for five hours.
WordPress 7.0.3 Patches 12 Security Flaws, One Could Lead to Remote Code Execution
WordPress 7.0.3 fixes 12 security flaws, including a login screen bug that can lead to remote code execution. Update your site now.
WordPress Security Reports Jumped From 30 a Month to 450 as AI Tools Take Over the Hunting
WordPress security reports jumped from about 30 a month to 450 in July, as AI tools like Anthropic and pwn.ai now find and prove exploitable bugs.
A Forgotten Server Let Attackers Backdoor Fluent Forms Pro and Ninja Tables Pro Updates
A forgotten server let attackers backdoor Fluent Forms Pro and Ninja Tables Pro updates for five hours. Check your site if you updated on July 31.
Patchstack: WordPress.org Holds Security Patches as Long as Cosmetic Updates
Patchstack found WordPress.org holds critical security patches for the same delay as cosmetic updates, leaving known flaws exposed for hours longer.
WooCommerce 11.0 Speeds Up Product Pages, Changes How Refunds Count in Reports
WooCommerce 11.0 speeds up product pages and checkout, fixes refund reporting by month, and lets guest buyers link past orders to a new account.
WordPress 7.1 Lets You Style Button Hover and Focus Colors Without Code
WordPress 7.1 lets you set hover and focus colors on Button and Navigation Link blocks from Global Styles, no custom CSS needed.
WordPress 7.1 Release Candidate 1 Is Out, Final Release Still Set for August 19
WordPress 7.1 Release Candidate 1 is out, with the final release locked for August 19. Test it on a staging site before it reaches your dashboard.
Critical Flaw in WooCommerce Social Login Lets Anyone Log In as Your Admin
A critical flaw in WooCommerce Social Login lets attackers log in as any user, including admins, by faking an Apple sign-in token. Update to 2.8.8 now.
WordPress 7.1 Adds Tooltips to Explain Icon-Only Buttons in Your Admin Screens
WordPress 7.1 adds hover tooltips and an info button to icon-only admin controls, plus an explainer for the login screen's Remember Me checkbox.
Issue 12: WordPress's New Safety Net Just Passed Its First Real Test
A plugin backdoor never reached a single WordPress site, but WP2Shell attacks have topped 11 million attempts. WordPress 7.1 nears its August 19 release.
Wordfence: WordPress's WP2Shell Attack Has Now Topped 11 Million Attempts
Wordfence has blocked over 11 million attempts to exploit WordPress's WP2Shell flaw. If your site reads 7.0.2, 6.9.5, or 6.8.6, you're already protected.
Wordfence's AI Caught a Backdoored Plugin With 20,000 Installs in Under Two Hours
Wordfence's AI tool caught a backdoored plugin with 20,000 installs within two hours. If you use Advanced Responsive Video Embedder, uninstall it now.
WordPress 7.1 Lets You Layer a Gradient Over a Background Image
WordPress 7.1 finally lets you combine a color gradient with a background image on Group, Quote, and Pullquote blocks, no custom CSS needed.
Issue 11: AI found WordPress's worst RCE in years, attackers followed in 90 minutes
Attackers hit WordPress's critical RCE within 90 minutes of the patch. An AI found the flaw in 10 hours. WordPress 7.1 drops a feature over security fears.
WooCommerce POS Now Runs on iPhone for UK Stores
WooCommerce POS now runs on iPhone for UK stores. Take card payments with Tap to Pay, no extra hardware, and sync sales instantly to your store.
Wordfence's AI Researcher Is Now Finding More WordPress Flaws Than Any Human
Wordfence's AI tool PRISM found 202 WordPress vulnerabilities since May and is now its top researcher. Keep auto-updates on as patches arrive faster.
WordPress 7.1 Beta 3 Drops a Feature Over Security Worries, Fixes Media Upload Bugs
WordPress 7.1 Beta 3 drops Unicode email support over security concerns and fixes 71 bugs, including GIF and HEIC upload failures before August 19.
WordPress 7.1 Turns On Infinite Scrolling in Your Media Library
WordPress 7.1 turns on infinite scrolling in the Media Library by default, replacing the Load more button. Switch it back off from your profile page.
Gutenberg 23.6 Makes the Playlist and Tabs Blocks Permanent
Gutenberg 23.6 makes the Playlist and Tabs blocks permanent, adds threaded inline comments, and lets the Gallery block auto-show every image on a post.
WordPress 7.1 Moves Image Processing Off Your Server and Into the Visitor's Browser
WordPress 7.1 processes your image uploads in the visitor's browser instead of your server, cutting failed uploads and server load. No setup needed.
Attackers Hit WordPress's Critical RCE Flaw Within 90 Minutes of the Patch
Attackers hit WordPress's critical RCE flaw within 90 minutes of the patch, and Patchstack logged over 65,000 attempts. Update to 7.0.2 now if you haven't.
WordPress's AI Plugin Now Drafts Replies to Your Blog Comments
WordPress's official AI plugin 1.2.0 can draft comment replies for you to review and summarize old posts in bulk. Update if you use it.
WordPress's Worst Security Flaw in a Decade Was Found by AI in 10 Hours
A researcher used OpenAI's GPT-5.6 to find WordPress's worst unauthenticated flaw in years, for $25. If you haven't updated to 7.0.2, do it now.
WordPress 7.0.2 Fixes a Critical Flaw That Let Attackers Run Code on Your Site
WordPress 7.0.2 fixes a critical flaw that let anonymous attackers run code on unpatched sites. Confirm you're updated. Attacks are already happening.
Issue 10: 7.1 beta lands, and Mullenweg draws a line on AI in core
WordPress 7.1 Beta 1 brings responsive styling and a media overhaul, with final release set for August 19. WooCommerce adds a free Reddit Ads extension.
Why WooCommerce's AI Support Assistant Gave a Wrong Answer, and How It's Fixing That
WooCommerce built an AI system to keep its support docs current, so its AI assistant stops giving outdated answers about renamed features.
WooCommerce Launches a Free Reddit Ads Extension for Store Owners
WooCommerce's free Reddit Ads extension automates pixel setup, catalog sync, and campaign launches to reach Reddit's 121 million daily users.
WordPress 7.1 Beta 1 Is Out, Final Release Lands August 19
WordPress 7.1 Beta 1 is out for testers only, do not install it on a live site. The final release ships on August 19, 2026.
WordPress 7.1 Fixes the Confusing Back Button in Your Editor
WordPress 7.1 swaps the confusing W-logo back button for a chevron and shows the toolbar by default in the editor. Distraction Free mode still hides it.
Issue 9: WordPress backs off, patches up, and counts the cost
WordPress 7.0.1 patches a registration spam hole and 31 other bugs. The Classic block stays after a reversed plan, and plugin sales data shows real strain.
WordPress 7.0.1 Is Out: 31 Bug Fixes, No Action Required
WordPress 7.0.1 fixes 31 bugs in the block editor, admin UI, and media handling. Sites with auto-updates enabled will update on their own.
WordPress's AI Plugin Now Encrypts Your Stored API Keys
WordPress's official AI plugin 1.1.0 encrypts stored API keys and adds inline writing suggestions in the block editor. Update if you use it.
WordPress Reverses Course: The Classic Block Isn't Going Away
WordPress reversed course, the Classic block stays in the inserter in version 7.1. No action needed, remove the workaround plugin if you installed it.
Issue 8: AI gets official access, a customs deadline, and Elementor's reset
The EU's customs exemption ended July 1, and shipments now get rejected for bad HS codes. Elementor just cut 30% of its staff to chase AI.
WordPress 7.1 Will Let You Style Blocks Differently on Mobile, No CSS Needed
WordPress 7.1 will let you style blocks differently per device, right in the editor, no custom CSS needed. Testers can try it now on WordPress Playground.
Gutenberg 23.5 Adds In-Editor Image Cropping and a Resizable Canvas
Gutenberg 23.5 lets you crop images directly in the Cover block, resize the editor to any width, and turn off real-time collaboration per post type.
WordPress 7.1 Will Let AI Agents Read Your Settings, Content, and Users
A WordPress 7.1 proposal lets AI tools read site settings, posts, and user data through permission-checked APIs. Existing access controls still apply.
New Free Plugin Lets Claude or ChatGPT Run Your WordPress Site by Chat
SeedProd's free Vibe AI plugin lets Claude or ChatGPT edit posts and fix SEO on your WordPress site by chat. Destructive actions need your approval first.
EU Drops Its €150 Customs Exemption July 1: What UK Sellers Must Fix Now
The EU's low-value customs exemption ends July 1. UK WooCommerce sellers need clean HS codes, matching invoices, and an EORI number to avoid rejections.
WordPress's First AI Leaders Cohort Just Graduated
40 students earned a new AI literacy credential by building real WordPress projects. The program shows what skilled, AI-fluent contributors look like.
Om Malik, an Early WordPress Adopter Who Helped Build Automattic, Has Died
Om Malik, one of WordPress's first users and the person who connected Matt Mullenweg to Automattic's founding team, died Wednesday at 59.
Issue 7: Security patches, a classic exit, and a community loss
Update Ultimate Member now or attackers can reset admin passwords. Avada Builder also needs a patch. A 13-year backdoor hit 44 WordPress plugins.
WP Rocket 3.22 Adds a Built-In Free CDN for Your Most Important Pages
WP Rocket 3.22 adds a free built-in CDN covering up to three pages. Point it at high-traffic pages to serve them faster for visitors far from your server.
Update Ultimate Member Now: Attackers Can Hijack Admin Accounts
Ultimate Member 2.11.4 and earlier lets contributor-level attackers reset admin passwords. Update to version 2.12.0 now.
WooCommerce 10.9: Track Failed Order Emails and a Faster Checkout
WooCommerce 10.9 adds failed order email logs, reduces checkout database load, and cleans up the admin for store owners.
WordPress 7.1 Will Hide the Classic Block From the Inserter
WordPress 7.1 planned to hide the Classic block from the inserter. Existing blocks would remain editable, while new ones would need a filter.
WordPress 7.1 May Give Your Site a Built-In Content Standards Hub
A merge proposal would add a Knowledge post type and Guidelines feature to WordPress 7.1, giving site owners a built-in place to store editorial rules.
The Official WordPress Swag Store Has a New Look
Mercantile, the official WordPress swag store, has been rebuilt on blocks and WooCommerce running WordPress 7.0.
Avada Builder has a critical file deletion flaw
Avada Builder users should update now. A patched flaw can let attackers delete server files without logging in.
Issue 6: Bad week for trusted updates
Trusted plugin updates spread malware this week. OptinMonster, TrustPulse, and ShapedPlugin Pro were all compromised. Check your admin accounts now.
Update Gravity SMTP now, attackers are targeting unpatched sites
Attackers are hitting a Gravity SMTP flaw that can expose email service keys, secrets, and login tokens.
ShapedPlugin Pro updates carried a backdoor
Attackers slipped a backdoor into ShapedPlugin Pro plugin updates sent through the official licensed channel.
Check for rogue admins if you use OptinMonster, TrustPulse, or PushEngage
A supply chain attack tampered with scripts from three marketing plugins and created hidden WordPress admin accounts.
Issue 5: Security got stricter
WordPress added a 24-hour delay before plugin auto-updates. UpdraftPlus patched a site takeover bug. Update now if you ever connected it to UpdraftCentral.
UpdraftPlus fixed a critical site takeover bug
If you use UpdraftPlus and connected it to UpdraftCentral, update now to close a critical admin takeover risk.
Issue 04: Patch now, watch 7.1
Three plugins have critical flaws under active attack. Burst Statistics, Everest Forms Pro, and Kirki all need updating before anything else this week.
Update Everest Forms Pro now, attackers are exploiting a critical bug
Attackers are exploiting a critical Everest Forms Pro bug that can let them take over unpatched WordPress sites.
Update Burst Statistics now, attackers are already using a site takeover flaw
Burst Statistics users should update to 3.4.2 now. Attackers are already exploiting a critical flaw that can take over a site.
Update Kirki now to stop an account takeover flaw
A Kirki plugin flaw could let attackers take over WordPress accounts, including admins. Update the plugin now.
Update WP Maps Pro now, this bug can hand over your site
A WP Maps Pro flaw lets attackers create admin accounts. If you use the plugin, update to 6.1.1 now.
Issue 3: Update now, lock it down
WordPress 7.0 had a strong first week. Most sites can update with confidence. WP Maps Pro has a critical flaw that lets attackers create admin accounts.
Issue 2: Test 7.0, patch checkout now
WordPress 7.0 is out. A critical FunnelKit flaw is stealing payment data from checkout pages. Recurring malware usually means a server breach.
Malware that keeps coming back may be a server breach, not a WordPress bug
If redirect malware returns after cleanup, your server may be compromised outside WordPress.
WordPress 7.0 Adds AI Tools, a New Dashboard, and Better Editing Controls
WordPress 7.0 is a major release with AI tools, a refreshed dashboard, new blocks, and stronger design controls.
Critical FunnelKit flaw lets attackers steal WooCommerce payment data
Attackers actively exploit a FunnelKit flaw to inject payment skimmers into WooCommerce checkout pages.
Issue 1: 7.0 Gets Real
WordPress 7.0 is nearly out. Burst Statistics and Avada Builder both have critical flaws to patch now. The AI plugin for WordPress hits 1.0 this week.
Update Burst Statistics and Avada Builder Right Away
Burst Statistics has a critical admin bypass. Avada Builder can expose files and database data. Update both plugins now.