Three unauthenticated plugin vulnerabilities demanded attention this week, in Elementor Pro, Forminator Forms, and User Profile Builder, each offering attackers a path to full site control without a password. WordPress 7.1 “Mary Lou” also shipped during WordCamp US 2026 in Phoenix, and planning for the next release, WordPress 7.2, is already underway. Away from core, a new study on plugin reviews, a free WordPress.com plan for students, and the WordPress community’s first sentiment survey round out the issue.

Security: Three Critical Flaws, Zero Logins Needed

Elementor Pro, the premium page builder used on an estimated 6 million sites, had a critical unauthenticated file upload flaw (CVE-2026-32475, severity 9.0) in its Forms widget. An attacker could submit two file parts for the same upload field, letting a PHP file skip the extension check and land in a public folder where visiting it in a browser would run it, a direct path to full site takeover. No login was required, just a published page with a File Upload field that isn’t marked required. Update to version 4.2.2 now.

Forminator Forms, active on more than 600,000 sites, had a similar unauthenticated file upload bug (CVE-2026-15748, severity 9.8) that let attackers run malicious PHP directly on the server. It only triggers on forms combining a File Upload field with a Select field, but since that’s easy to lose track of across a site with many forms, WPMU DEV recommends updating to 1.56.2 regardless of whether you think you’re exposed.

User Profile Builder had a critical authentication bypass (CVE-2026-15826, severity 9.8) that let an attacker log in as user ID 1, typically the site’s original admin account, without a password. It only affects sites with the plugin’s Automatic Log In setting turned on. Update to 3.16.5, and if you don’t use Automatic Log In, turn it off as extra insurance.

WordPress Core: Mary Lou Ships, 7.2 Gets a Date

WordPress 7.1 “Mary Lou” launched August 19 during WordCamp US 2026, the project’s second major release of the year. You can now style a block differently per screen size directly from Global Styles, without writing custom CSS. The admin bar stays visible across every editor instead of disappearing on some screens, and a new media editor modal handles cropping, flipping, rotation, and metadata in one workflow. Notes, the built-in feedback tool, now supports rich text and @mentions. The update rolls out automatically; if you manage your own hosting, check WordPress’s updated PHP compatibility recommendations for this release.

The release landed at WordCamp US 2026, which drew more than 1,100 people to Phoenix despite 111°F heat. Organizers replaced the usual Contributor Day format with a hackathon: 425 participants across 26 teams shipped 21 items in a single day, including three new plugins. AI was the dominant theme of the sessions program, with at least 18 talks explicitly about AI in WordPress.

Planning for the next release has already started. Fueled contributor Jeffrey Paul published a call for volunteers on the Make WordPress Core blog this week, proposing December 9 as the final release date for WordPress 7.2, timed to land during December’s State of the Word address.

AI: Translate In the Editor, Watch Your Meta Keys

WordPress’s official AI plugin reached version 1.3.0. It’s a separate, free plugin from WordPress.org, not something built into core, and its new features are opt-in experiments. The Content Translation experiment lets you translate a post’s paragraphs, headings, and title into another language directly in the block editor. Slug Generation suggests a search-friendly permalink based on your title and content, and shows how your manual edits get cleaned up before you accept them.

If you’ve built an integration on the plugin’s Abilities API, note that Custom Abilities now sit behind their own opt-in setting, so your integration may stop working after you upgrade until you turn that setting back on. The internal meta key prefix also changed from ai_ to wpai_ in this release, worth checking if you built anything against the old keys.

Block Editor: Faster List View, Shareable Revisions

Gutenberg 23.8 is mostly about collaboration. Revision history now supports shareable links: open a specific past version of a post and the URL updates to match it, so you can send a colleague straight to that exact revision instead of asking them to scroll through history. Mentioning someone in a Note, introduced last month, now also sends them an email with a direct link back to the conversation.

The performance fix is worth knowing about if you write long-form content. Selecting every block in List View on a 1,000-paragraph test post used to take 16.8 seconds. It now takes 0.4 seconds.

Business: What Reviews, Students, and Surveys Reveal

A study of 3,354 WordPress.org plugin reviews found reliability, not missing features, drives one-star ratings. Plugins that broke or crashed caused 42% of one-star reviews; a genuinely missing feature caused just 2.5%. On the positive side, ease of use and dependability beat feature lists as the top reasons for a five-star review. If you’re choosing between plugins, that’s a case for checking a plugin’s support forum and update history before comparing feature checklists.

Automattic launched a free WordPress.com plan for teachers and students this week, following a year-long pilot that reached more than 5,000 students in 27 countries. It includes a free custom domain, 6 GB of storage, and plugin support at no cost for the first year, with no credit card required. Educators can apply at wp.com/edu to set up accounts for their students.

Separately, the WP Open Community Collective published its first State of the Community survey, the first independent, anonymous look at sentiment across the WordPress ecosystem. Of the 431 respondents, 73.8% said they feel more negative about the WordPress project than they did two years ago, and 73.3% reported experiencing or witnessing problems with project leadership or governance, the highest of any issue the survey measured. Despite that, respondents broadly agreed on what they value: security, web standards, open source values, and the WordPress software itself topped the list across every group surveyed, including the most disengaged.

End of article