Three plugins are being attacked right now: Bricksforge, Ninja Forms, and WPC Product Bundles. Update them, then check for accounts and files you did not create. WordPress also shipped a third security release in three weeks. On the AI side, the official MCP Adapter is now in the plugin directory.

Security: Three Plugins Under Attack

Attackers are exploiting a critical Bricksforge flaw that lets anyone upload and run PHP code without logging in. Patchstack first saw attacks on October 7. The flaw scores a perfect 10.0. Update to version 3.1.8.10.

Two days earlier, Patchstack reported a separate campaign hitting Ninja Forms and WPC Product Bundles. Both flaws are stored cross-site scripting bugs, meaning an attacker saves malicious script that runs when an admin views it. The script then installs a malicious plugin and creates admin accounts, including one that is hidden from your Users screen.

The lesson is the same for both. An update closes the hole but does not remove a backdoor already planted. Check your admin list, look for unfamiliar PHP files, and reset passwords if anything looks wrong.

Security: WordPress 7.1.3 Is Out

WordPress 7.1.3 arrived on October 6 with 7 security fixes and 4 bug fixes. They include stored XSS on the Comments admin page and exposed comments on private posts. Anthropic reported three of the seven.

Patchstack’s analysis of the release says it is not a drop-everything emergency, since most of the bugs need a logged-in user. Update soon anyway. Sites with automatic background updates should already be patched.

This is the third security release in about three weeks. It follows a year in which AI tools pushed bug reports from dozens to hundreds a month. Expect more frequent patches. Keep auto-updates on.

AI: The MCP Adapter Gets a Real Home

The MCP Adapter is now installable from the WordPress.org plugin directory. MCP, the Model Context Protocol, is an open standard that lets AI assistants like Claude or ChatGPT use an app’s features. The adapter connects it to WordPress’s Abilities API.

The plugin is still experimental at version 0.7.0. You do not need it unless a plugin or integration you use depends on it. If you do install it, test on staging first and check which abilities your plugins expose.

The same week, the official AI plugin released version 1.4.0. It adds opt-in Markdown feeds, a plain-text format AI tools read easily, plus a Comment Value score for moderation.

Accessibility: No Delisting After All

WordPress.org will not remove themes over the accessibility-ready tag. The tag becomes an opt-in listing that the Accessibility Team can remove from themes that fall short. Theme authors do not need to rush a re-review.

If you choose themes for accessibility, keep testing keyboard navigation, color contrast, and screen reader behavior yourself.

Plugins: Jetpack 16.3

Jetpack 16.3 adds three blocks: Latest Videos Playlist, All Playlists, and a Zoom Scheduler for booking meetings. Forms gain conditional logic, so questions can change based on earlier answers. A new Features tab replaces the Products tab, and the Jetpack plugin also expands its AI setup guidance to include ChatGPT and Codex.

End of article