WordPress shipped its third security release in about a month this week, this one patching a flaw where a disguised image upload could run code on your server. Two commercial plugins also got backdoored through their own official update channels, and a public dispute over theme accessibility standards left theme authors without a clear answer on a looming deadline. Away from security, WordPress.org launched a browser extension and new research on plugin reviews challenges what businesses assume drives their ratings.

Security: When a PNG Isn’t a PNG

WordPress 7.0.4 shipped August 12, fixing a flaw where a file named like an image, say holiday.png, could actually contain PostScript code. WordPress trusted the file extension, but the Imagick library that processes uploads reads the file’s real contents, found the PostScript, and handed it to Ghostscript, a program with a long history of being tricked into running commands it shouldn’t. That gave any Author-level account, someone who can normally just publish their own posts, a path to run code on the server. WordPress credited pwn.ai, an AI penetration testing firm, with finding and reporting the bug.

It’s the third core security release since mid-July, following 7.0.3 on August 6, which fixed 12 flaws including a login-screen bug that can escalate to remote code execution against a specifically targeted admin. Alongside that release, WordPress Security Team lead John Blackbourn shared a number worth sitting with: HackerOne bug bounty reports jumped from roughly 30 a month to 450 in July, credited largely to AI tools that now find and prove exploitable bugs rather than just assist a human researcher. Two of 7.0.3’s fixes came directly from AI firms Anthropic and Aikido Security. More reports mean more real bugs caught early, but they also mean security releases like this one will likely keep coming faster than site owners are used to.

Trusted update channels were the attack surface twice this week, too. Seven Elementor add-on plugins from BdThemes got compromised not through their code, but through a promotional banner feed the plugins load from BdThemes’ own servers; attackers hijacked that feed to plant rogue admin accounts and a webshell on sites running the plugins between June 23 and August 8. And a forgotten server left running after WPManageNinja migrated off its old store platform let an attacker serve backdoored copies of Fluent Forms Pro and Ninja Tables Pro for about five hours on July 31, planting hidden admin accounts that survive a normal plugin deletion. If you updated either plugin that day, check your admin users list now.

Separately, a developer’s public testing found that WPForms Lite’s setup wizard sends a one-hour access token to WPForms’ own servers as part of onboarding, without asking first. The wizard only runs when a logged-in administrator triggers it, so it isn’t something an outside attacker can exploit remotely, and WPForms’ maker, Awesome Motive, hadn’t issued a public response as of this writing. The plugin runs on more than 5 million sites, so if you’re setting one up for the first time, know what the wizard connects to before clicking through it.

Accessibility: Standoff Over Theme Guidelines

Matt Mullenweg moved to shut down a WordPress Accessibility Team effort to enforce updated theme standards, calling the initiative “permanently delayed” and saying the team had “overstepped its authority, usefulness, and charter.” The dispute lands squarely on theme authors: the Accessibility Team spent two years rewriting the accessibility-ready guidelines to match WCAG 2.2, the current accessibility standard, and had set a September 30 deadline for the 108 tagged themes to pass re-review or be delisted. Core committer Joe Dolson says that plan still stands. Mullenweg says the initiative is over. Neither has reconciled the two positions, so if your theme carries the accessibility-ready tag, don’t assume the deadline is cancelled, and verify accessibility claims independently rather than relying on the tag alone.

WordPress.org released an official browser extension for Chrome and Safari this week, letting you hide the admin bar on sites you choose while keeping its shortcuts one click away, plus tools like block-boundary overlays and a mobile preview window. WordPress.org says everything runs locally in your browser with no data sent anywhere. It started as an independent project before becoming an official release with backing from Automattic co-founder Mullenweg.

Roots & Fruit founder Matt Cromwell tagged a primary reason behind 3,354 one-star and five-star WordPress.org plugin reviews across popular plugins, and the results cut against how most product teams prioritize. Missing features caused just 2.5% of one-star reviews; reliability failures caused 42%. On the positive side, ease of use (21%) and dependability (20%) beat features as the top reasons for a five-star review, and good support showed up nearly four times as often, proportionally, in five-star reviews as support failures did in one-stars. If you run a plugin business, that’s a case for spending more on reliability and support than on shipping the next feature.

WP Engine’s lawsuit against Automattic also produced another round of filings this week. WP Engine has asked the court to sanction Automattic and CEO Mullenweg, arguing his WhatsApp, Signal, and Telegram messages weren’t properly preserved during discovery; an unsealed filing shows his phone wasn’t successfully copied with that messaging data intact until 20 months after Automattic’s preservation duty began, and two of his other personal devices went missing before they could be checked. Automattic’s opposition, filed this week, argues WP Engine can’t identify a single case-relevant message that actually went missing. The court hasn’t ruled on the motion.

End of article