WordPress shipped two security releases in the space of five days this week, and attackers started probing the second one within hours of the patch going out. A closer look at last week’s fix also revealed a more serious attack chain than first described, while a plugin bug, a hosting-level library flaw, and a piece of self-healing malware rounded out a busy security week. Away from the patches, WooCommerce revived a shelved theme and WordPress published its roadmap to December.
Security: Two Core Releases, and the Second One Under Attack
WordPress.org shipped 7.1.1 on September 17 with 11 security fixes, including two reported by Anthropic: an authenticated path traversal in the REST Templates Controller and a bug that let Contributor-level users overwrite posts they shouldn’t touch. Most of the release closed ways a low-privilege user or a site visitor could do more than intended, including a stored cross-site scripting flaw reachable through a comment with no login at all.
One of those 11 fixes turned out to be more serious than its release notes suggested. Researcher Paulos Yibelo named the chain Click2Shell: the admin dashboard’s theme-install feature sanitized a theme slug on the server but used the raw, unfiltered version in its own JavaScript. That mismatch let an attacker craft a link that, if an administrator clicked it, triggered a theme install the admin never intended, opening a path to running code on the server. WordPress fixed it by making the dashboard check for the real page element instead of trusting the raw slug.
Five days later, WordPress.org shipped 7.1.2, a single critical fix for a flaw that let an unauthenticated attacker trick WordPress into loading the wrong PHP file entirely, via path-traversal characters in a URL parameter. It affects every release back to WordPress 4.7, close to a decade of versions, and carries a 9.2 CVSS severity score. The worst-case outcome needs a theme with a “page-” prefixed folder and a PHP setting called register_argc_argv turned on, a combination that’s on by default in the official WordPress Docker image and in cPanel hosting running PHP below 8.5.
The gap between patch and exploit closed fast. Security firm Patchstack says it saw reconnaissance traffic less than six hours after the fix shipped, and by the next day attackers had moved from testing to actually writing files onto unpatched servers. WordPress.org has backported the fix to every supported branch, 7.1.2, 7.0.6, 6.9.9, 6.8.10, and 4.7.37, so if you haven’t updated yet, do it now regardless of which major version you’re on.
Security: Plugin, Server, and Malware Risks
Tutor LMS, an e-learning plugin on more than 100,000 sites, had a PHP object injection flaw that any Subscriber-level account, the lowest access tier in WordPress, could use to take over the server. Wordfence found it on August 23 and Themeum fixed it in version 4.0.8. Since Tutor LMS sites typically leave registration open for students, anyone who can reach the site could sign up and attempt the exploit, so this is worth updating even if nothing looks wrong yet.
Not every risk this week lived in a plugin. libheif, the library many servers use to open HEIC photos from iPhones, had a critical buffer overflow rated 9.8 out of 10. It sits below WordPress entirely, in software your host or operating system installs, and Wordfence found the official WordPress Docker image was among the vulnerable configurations. There’s no plugin update here: ask your host whether they’ve moved past version 1.23.2.
Wordfence also detailed a self-healing piece of malware it found while cleaning up an infected site in June. It hid as a “must-use” plugin, a plugin type that runs automatically and never appears on the normal Plugins screen, and rebuilt itself if removed. Its most unusual feature was using the Ethereum blockchain to store its control-server instructions, a technique called Etherhiding that makes the attacker’s command channel hard for any single host or registrar to shut down. If you’ve never checked your wp-content/mu-plugins folder, this is a good week to do it.
Business: A Revived Theme, and What’s Next for WordPress
WooCommerce brought back Purple, the block theme it shelved 14 months ago, for public beta testing. It’s built on WooCommerce’s improved block library rather than a standalone framework, and features that once required paid Storefront extensions, like product galleries and advanced headers, now ship built in. It’s already the default for new stores on WordPress.com’s Commerce plan, though it isn’t in the WordPress.org theme directory yet. Test it on staging before touching a live store.
WordPress.org also published its roadmap to version 7.2, targeting early December. Three security features stand out: a Secrets API giving plugins a proper way to store credentials, a re-authentication step called Sudo mode before sensitive admin actions, and hardening for Application Passwords. None of it is guaranteed to ship as described, but it’s a useful preview of where core is heading before it reaches your site through an update.
End of article