This was one of the heaviest security weeks WPWithin has covered. Five plugins shipped critical fixes, and two older flaws are now under active attack. Rank Math’s SEO plugin also created admin-level passwords without clearly asking for consent, adding urgency to WordPress’s own push to scale how it handles security reports.

Security: Seven Critical Plugin Flaws, Including Two Under Active Attack

WPMU DEV Dashboard, installed on an estimated 350,000 sites, had a critical authentication bypass that let an attacker log in as your administrator without a password, if Hub Single Sign-On was enabled. Wordfence’s AI research tool Argus found the bug on August 19, and WPMU DEV patched it in version 5.0.2 five days later.

GiveWP, used by nonprofits on more than 100,000 sites, had a chain of three bugs that added up to a CVSS 10, the maximum possible severity score. On a default install with one published donation form and one active payment gateway, an attacker needed no account at all to take over the site. Patchstack reported that earlier fixes did not close the full chain before GiveWP closed it in version 4.16.7.2 on August 27.

Gravity Forms, running on more than 1 million sites, let an unauthenticated attacker upload a disguised PHP file through any public form with multiple file uploads turned on. Update to 3.0.3. And All-in-One WP Migration and Backup, used on more than 5 million sites, had a SQL injection flaw that sits dormant until you restore a backup archive, then extracts a secret key an attacker can use to run code on your server. Update to 7.110, and treat any backup file from an unverified source with caution until you do.

Behind the Pods plugin’s fix was a single developer’s week off his day job. Wordfence disclosed a 9.8-rated flaw on August 21 that let anyone reset any user’s password without logging in, tracing back to an old compatibility fix that let failed security checks through instead of blocking them. Pods’ solo maintainer, Scott Kingsley Clark, backported the fix across six major versions going back to 2015, bundling 16 security fixes in total. Update to 3.3.9.1 or the matching backported release for your version.

Two more flaws patched weeks ago are now under active attack. Wordfence has blocked over 190,000 exploit attempts against the critical Elementor Pro file upload flaw it disclosed in August, and more than 250,000 against a Super Forms flaw attackers have been hitting since mid-July. If you haven’t updated Elementor Pro to 4.2.2 or Super Forms to 6.3.314, do it now. Both let an attacker upload a file that runs as code on your server.

Rank Math, the SEO plugin on more than 4 million sites, shipped an update on August 26 that reportedly created an administrator-level Application Password the moment a site admin opened its Help & Support screen, before anyone could accept or decline anything. Sybre Waaijer said the feature sent that password to group.one’s servers. Rank Math later said the credentials were encrypted, read-only, and not stored on its own servers.

Five days later, Rank Math paused the feature. The company confirmed it was creating credentials without clearly telling users what was happening and said it takes responsibility for making that clearer. The Support Agent stays off until the company rebuilds the flow to ask permission before creating anything, not after. If you or another admin opened Help & Support while connected to Rank Math, check Users → Profile → Application Passwords for an entry labeled “WAP – Rank Math Support Agent” and revoke it.

The controversy landed in the middle of a broader push by WordPress to get ahead of its security workload. The project’s Core Security Initiative, announced August 28, is scaling the security team’s release process, headcount, and AI-assisted scanning after monthly HackerOne bug reports jumped from a decade-long baseline of 20 to 30 a month to 450 in July, driven largely by AI-assisted research. Days later, the team narrowed what it accepts through that program: reports needing a role only an administrator can grant, or one authenticated role doing something normally reserved for another, generally won’t qualify anymore unless they show serious impact. Core and Gutenberg keep their existing rules. This does not change your day-to-day maintenance. Keep automatic updates on and apply security releases quickly. The higher report volume could mean more frequent security releases.

Block Editor: Gutenberg 23.9

Gutenberg 23.9 adds two useful fixes for anyone who builds pages in the block editor. You can now insert a new block straight from the block toolbar instead of hunting for the inserter button, and Global Styles marks any block with custom style overrides with a dot indicator, with a filter to show only the blocks you’ve customized. That’s handy if you’re auditing a page to see where someone overrode the theme’s defaults. The release also adds independent spacing controls for flex and grid layouts and lets you build custom duotone color palettes, more than 80 changes in total.

Business: Fewer Returns and a Different Way to Work

Nearly one in five online orders gets returned, and WooCommerce’s own data can tell you why before you tighten your return policy or blame your shipping carrier. Check WooCommerce Analytics for refund patterns tied to a specific product, a sign the page needs clearer photos or measurements, versus refunds clustered on a few customers, a possible sign of policy abuse. The AutomateWoo extension can flag repeat-return customers automatically once you’ve spotted the pattern.

For a different kind of workday, OpenStation turns wp-admin into something closer to a desktop operating system: draggable windows, a dock, virtual desktops, and a command palette for jumping between tasks. It’s opt-in per user and disappears completely if you deactivate it, so agency staff or editors juggling several posts at once can try it without touching how anyone else on the team works.

AI: An Automattic Veteran Builds a Design Agent for WordPress

Andy Peatling spent 17 years at Automattic, including leading development of WordPress.com’s AI site builder, before leaving in June 2025. Fourteen months later, he’s launched Miles, an AI design agent built entirely on WordPress’s native blocks that can design a new block theme or redesign a site you already run. Peatling opened it to everyone during WordCamp US in Phoenix last month, after months of closed beta testing. It’s early and unaffiliated with WordPress core, but it points to growing interest in aiming AI agents directly at the block editor instead of working around it.

End of article