Two plugin companies were breached this week, and attackers used the access to reach customer sites. Separately, two critical PHP flaws need a server-level fix that WordPress cannot deliver. WordPress 7.2 also entered beta.

Security: Breaches at Rank Math and UpdraftPlus

On October 17, we reported that some Rank Math SEO PRO 3.0.123 downloads contained malware. Rank Math’s security advisory says the bad copy was available for about 11 hours, from October 15 to 16. The company says several hundred customers were affected.

Updating to 3.0.124 is not enough. Rank Math says the malware may have left admin accounts, fake files, and scheduled tasks behind. If you installed 3.0.123 in that window, restore a clean backup and change every credential the site could reach.

The second breach is bigger. On October 19, we covered stolen UpdraftCentral keys being used to install backdoors. A key is the secret that proves a command comes from the UpdraftCentral dashboard. On October 22, TeamUpdraft shipped a fix.

UpdraftPlus 1.26.13 and 2.26.13 revoke the stolen keys. Update, change your TeamUpdraft password, delete your UpdraftCentral key, and check each site for unknown admins and plugins. TeamUpdraft says customer names, billing addresses, and hashed passwords may have been accessed.

Both cases share one lesson. A trusted vendor’s systems were the way in, not a bug in your site. If cleanup fails or malware returns, the problem may sit on the server.

PHP is the other security story. On October 21, we reported two critical PHP flaws that can let attackers run code on your server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. WordPress.org says no WordPress update is needed or planned.

Ask your host whether it has patched. Many major hosts used firewall rules first, then rolled out the new PHP versions over about a day.

WordPress Core: 7.2 Beta 1

WordPress 7.2 Beta 1 is ready for testing on a staging site. The final release is scheduled for December 8. It extends responsive controls to Gallery blocks, adds text shadows, and loads admin screens faster.

Two items from the earlier 7.2 roadmap are missing. Suggestion mode for Notes and the Table of Contents block moved to 7.3. Suggestion mode would let editors propose changes for a writer to accept or reject. The Secrets API, a standard place for plugins to store credentials, did make it into the beta.

A smaller item: the Feature Notifications project is active again after a three-year pause. Core contributor Jonathan Bossenger has set a December 1 target for version 0.3.0. The plugin aims to give plugins one shared place to show admin notices.

AI: MCP Heads Toward Core

Two weeks after the MCP Adapter reached the plugin directory, WordPress’s AI team says it has approval from Matt Mullenweg to build MCP into core. MCP is the standard that lets AI assistants use a site’s features. The team’s weekly summary describes it as a possible 7.3 target, with no release commitment.

How MCP arrives is still open. Options include bundling the adapter plugin, enabling it through existing core interfaces, or building specific parts into core. Mullenweg asked the team to do everything it can to avoid new vulnerabilities. The adapter we covered earlier this month was described then as experimental.

Early data also suggests agents are not choosing WordPress. A new open source project, WordPress Agent Benchmarks, tested seven AI agents on 28 website requests. For the 19 requests WordPress would suit, none of the 193 sites they built used it. In a separate test, agents completed none of the tasks on an existing site through the MCP Adapter.

Accessibility: A Fix Pulled Back

WordPress reverted planned improvements to dashboard notices after false notice counts appeared. Screen reader users still face the existing barriers when warnings and confirmations appear in the admin.

End of article