Two security stories dominated this week, and both came through channels site owners trust by default: a core update and a plugin vendor’s own servers. WordPress 7.1 also locked in its feature list ahead of the August 19 release, and WooCommerce shipped a speed-focused update of its own.

Security: A rough week for update trust

WordPress’s 7.0.3 security release shipped August 6, fixing 12 flaws. The worst is a login-screen bug that can escalate to remote code execution, though only against a specific admin tricked into clicking a crafted link, not a drive-by scan. Every branch back to 4.7 got the patch. Patchstack’s technical write-up of the release adds useful context: reports to WordPress’s HackerOne bug bounty program held steady at 20 to 30 a month for roughly a decade, then jumped to 450 in July, driven largely by AI-assisted researchers, including Anthropic, pwn.ai, and Aikido Security among this release’s credited reporters. WordPress’s security team says the total mixes valid finds with duplicates and low-quality automated submissions, but the volume itself marks a shift in how core vulnerabilities now get found.

The update channel itself became the attack this week, too. A forgotten server, left running after WPManageNinja migrated its store off Easy Digital Downloads, let an attacker serve tampered builds of Fluent Forms Pro and Ninja Tables Pro for about five hours on July 31. The backdoor planted rogue admin accounts and hid itself inside mu-plugins, where it survives a normal plugin deletion. If you updated either plugin that day, check your admin users list now.

Separately, WooCommerce Social Login had a critical flaw of its own: a forged Apple sign-in token let anyone log in as any user, including admins, with no password needed. Wordfence rated it 9.8 out of 10. Update to 2.8.8 immediately if your store uses it.

And Patchstack found that WordPress.org’s “Protect the Shire” malware-scanning hold delays critical security fixes by the same margin as cosmetic ones, about 6.8 hours since a July 16 change. The policy caught its first real backdoor last week; this week’s finding is a reminder the same hold has a cost.

Block Editor: WordPress 7.1 locks in for August 19

Release Candidate 1 shipped this week, confirming WordPress 7.1’s August 19 launch at WordCamp US in Phoenix. Don’t install it on a live site, it’s a testing build, but if you manage a staging environment, this is the week to check your theme and plugins against it.

Two smaller changes are worth trying on staging. WordPress 7.1 adds hover tooltips to icon-only admin controls, so you’re no longer guessing what an arrow icon does in a meta box, and it lets you set hover and focus colors on Button and Navigation Link blocks from Global Styles, no custom CSS required.

The release also got a leadership note this week: Automattic’s Anne McCarthy, who is leading the 7.1 release cycle, joined the PHP Foundation’s governing board as Automattic’s platinum sponsor representative. McCarthy said they want to use the seat to bring the PHP and WordPress communities closer together, starting with conversations at WordCamp US.

Commerce: WooCommerce 11.0 focuses on speed

WooCommerce 11.0 shipped August 5, with most changes aimed at store speed and cleaner reporting rather than new storefront features. Larger stores should see faster Orders screens, and refunds now count in the month they happened rather than the month of the original sale, making month-over-month sales comparisons more reliable. Guest checkout also got friendlier: past guest orders now link automatically to a new account created with the same email address.

Business: Credits program keeps outgrowing its own targets

WordPress’s Credits program, which places students with WordPress teams as a structured, mentored internship, added 10 new partner institutions in July alone, its strongest month yet. That brings the total to 38 partners across 16 countries, including CUNY City Tech, the program’s first partnership with a US public university. WordPress Executive Director Mary Hubbard described Credits as building “a portable record” of real contributions that students can point to in job interviews, rather than coursework.

End of article