This week’s security news splits in two. Two plugins need updates, and one critical flaw sits on your server where no plugin update can reach it. Gutenberg 24.2 also turns on React 19 by default, so test it before it reaches your live site.

Security: Two Plugin Fixes and One Server Flaw

Backuply has a flaw that can give an attacker admin access during a restore. Wordfence rates it 8.0 out of 10. A logged-in subscriber can plant malicious data in their profile biography, and that data rides into a database backup. When an administrator restores the backup, the plugin can run it as database commands. Update to Backuply 1.5.9 or later.

The pattern is familiar. In September we covered a similar restore-time attack in All-in-One WP Migration. Backups feel safe, but a restore trusts whatever the backup contains. Only restore backups you know are clean.

All in One SEO, used on more than 2 million sites, patched two medium-severity flaws on October 13. One lets someone without an account run shortcodes, but only if the plugin’s breadcrumbs show on your search results page. The other needs an SEO-permissioned user to open a preview panel on a booby-trapped link. Update to 5.0.2.1 or newer.

The bigger worry is a critical Ghostscript flaw, scored 9.8 out of 10. Ghostscript is the program many servers use to turn uploaded PDFs into preview images. Wordfence says a crafted PDF can run code on a vulnerable server. The fix shipped in Ghostscript 10.08.0 on September 8.

There is nothing to update in your dashboard. Ask your host whether Ghostscript is patched for CVE-2026-39919. If you run your own server or containers, update through your package manager or rebuild from a fresh base image. It is the second server-level image library flaw Wordfence has flagged recently, after libheif in September.

Block Editor: Gutenberg 24.2

Gutenberg 24.2 moves editor notes into a reserved margin beside your content. Notes are the comments editors leave on blocks. The Gallery block can now sort images by date or alphabetically, and galleries accept a duotone tint.

The change to watch is React 19, the code library that powers the editor screen. It now loads by default unless an incompatible theme or plugin is active. If your editor breaks after updating, switch it off under Gutenberg > Experiments. Try the plugin on staging, not on a live site.

Business: WooCommerce 11.2

WooCommerce 11.2 adds a date picker to the Checkout block, handy for delivery days. It also lets you import products by UPC and keeps product filters on screen while shoppers scroll.

Check the behavior changes before updating. CC and BCC copies of password reset and new account emails stop, because those messages carry login links. Shop managers can also no longer edit users who hold certain other roles.

Hosting: A Database Mode Goes Away

WordPress 7.2 will switch off the NO_BACKSLASH_ESCAPES database mode, according to the core team’s October 9 announcement. Some hosts enable it, and it can break queries in ways that are hard to trace. Most sites need to do nothing.

Accessibility: A Fix Pulled Back

WordPress reverted planned improvements to dashboard notices on October 14 after false notice counts appeared. The work now sits under “Future Release” with no date. Screen reader users still face the existing barriers when warnings and confirmations appear in the admin.

End of article