WordPress’s plugin security net just proved itself in the real world, catching a backdoor before it ever reached a site. The WP2Shell exploit chain keeps racking up attack attempts, but patched sites remain unaffected. WordPress 7.1 keeps closing in on its August 19 release, adding a new background gradient control while pausing a feature that wasn’t ready.
Security: A safety net catches its first real threat
Earlier this week, Wordfence’s AI research tool PRISM caught a backdoor planted inside Advanced Responsive Video Embedder, a plugin with 20,000 active installs. WordPress.org closed the plugin for downloads within two hours of the malicious code appearing.
New details show the story ended better than it first looked. WordPress.org’s Plugins Team has confirmed the tampered version never reached a single site. A mandatory hold on new plugin releases, part of a WordPress.org security initiative launched in June, kept the update from going out while Wordfence’s report was still being verified. If you run ARVE, you should still remove it, but the backdoor itself never got the chance to spread through auto-updates.
The WP2Shell attack chain, meanwhile, keeps climbing. Wordfence now counts more than 11 million exploitation attempts against the flaw patched in WordPress 7.0.2 on July 17. If your site reads 7.0.2, 6.9.5, or 6.8.6, you’re already protected. The high attack count reflects broader monitoring, not a wave of new break-ins.
Block Editor: WordPress 7.1 closes in on its August 19 release
WordPress 7.1 now lets you layer a gradient over a background image on Group, Quote, Pullquote, Accordion, and Post Content blocks. Previously you could have one or the other, not both. Now a photo background can carry a dark gradient over it, so headline text stays readable without custom CSS.
The release isn’t without friction. Beta 4 shipped a way to turn off responsive style editing, the feature that lets you design for different screen sizes directly in the block editor. Testers, including a UX designer who maintains a university’s enterprise WordPress theme, flagged confusing UI around device selection. Core contributors responded with a new editor setting that site owners can use to disable responsive style editing entirely, without losing any styles already saved.
A second planned feature, showing which block styles are inherited from a parent, got dropped before Beta 4 after contributors couldn’t agree on a design. It’s now aimed at WordPress 7.2 instead. WordPress 7.1’s release candidate is due August 5, with the final release landing August 19 at WordCamp US.
Commerce: WooCommerce POS comes to iPhone
WooCommerce POS now runs on iPhone for UK-based stores. The headline feature is Tap to Pay: your phone becomes the card reader, so there’s no extra hardware to buy for in-person sales. Sales sync straight back to your WooCommerce store, whether they happened online or at a market stall.
The feature needs WooPayments or Stripe connected to your store, plus iOS 26 or later. WooCommerce hasn’t said when it’s coming beyond the UK.
Community: A student program grows up
The WordPress Credits program published its first analysis of student feedback this week, drawing on 242 responses collected since the program launched at WordCamp Europe 2025. Satisfaction scored high across the board, and even the weakest-rated question, ease of getting started, still averaged 4 out of 5.
The gap shows up after graduation. Students on the longer 150-hour course kept contributing at 82%, against 69% for the condensed 50-hour track. Program lead Isotta Peira said the shorter format doesn’t leave enough time to build the mentor relationships that keep people contributing. Separately, the program is now designing its first developer-focused track after a US college said it wanted to join Credits but needed a path centered on writing code.
End of article