Two unauthenticated vulnerabilities gave attackers full site control this week, one of them already under active exploitation. WordPress core shipped another security release on top of that, while free passkey login arrived for anyone running Wordfence. On the design side, WordPress said goodbye to its Twenty-Something theme names and Gutenberg’s Gallery block got a real grid layout.

Security: Two Unauthenticated Flaws, and 11 More Patches in Core

The Events Calendar, a plugin running on more than 600,000 sites, had two critical flaws chained together that let an attacker take over a site with no login at all. Both routes ran through comments on event pages, exploitable even from a pending, unapproved comment. Wordfence found the chains on August 21 and 22, and the fix landed in version 6.17.5. If you run this plugin, update now, and turn off event page comments if you don’t need them.

A second plugin, WooCommerce Wholesale Lead Capture, has a critical file upload flaw that Wordfence says is under active attack, with more than 100,000 exploit attempts already blocked by its firewall. The bug lets an unauthenticated attacker plant a PHP backdoor and take over the server. It’s patched in version 2.0.3.2, on roughly 6,000 sites, so check your version now if you run it.

WordPress core also had a scheduled patch day. WordPress 7.1.1, released September 17, fixes 11 security issues alongside 17 core bugs and 19 block editor issues. The most notable is a stored cross-site scripting flaw in the wpautop() function that lets a logged-out visitor inject a script through a comment, the lowest authentication bar of anything in the release. None of the 11 fixes are as severe as July’s pre-authentication RCE, but sites with automatic background updates should already be covered. Everyone else should update now.

Not all the security news this week was about attacks. Wordfence 9 added passkey login for free, letting WordPress and WooCommerce users sign in with a fingerprint, face scan, or password manager instead of typing a password. Passkeys are tied to the specific device and site that created them, so they can’t be phished the way a typed password can. It’s worth turning on for administrator and editor accounts first, since those carry the most risk if compromised.

Gutenberg 24.0 replaced the Gallery block’s old flex layout with a proper grid, letting you set column count and image cropping separately for each screen size. Post titles also joined the visual revision system for the first time, so editors can see exactly when and how a title changed. If your site leans on the Gallery block, the per-breakpoint controls are worth a look next time you update.

WordPress is also retiring a 16-year-old naming habit. Since Twenty Ten, every new default theme has carried the year it shipped. That ends with Ipsum, a deliberately minimal, blank-canvas theme proposed for WordPress 7.2 in December. Future default themes will get their own names and ship only when the design calls for a change, not on a fixed yearly schedule. Ipsum is open for testing now on GitHub if you want a say before 7.2 locks in.

WooCommerce made a similar theme move. Purple, the block theme it withdrew from testing 14 months ago, is back in beta as of September 15, now built on WooCommerce’s improved block library rather than a standalone framework. It already ships as the default for new stores on WordPress.com’s Commerce plan, and the team plans to publish it to the WordPress.org theme directory and WooCommerce Marketplace after this round of testing.

End of article