A smart, opinionated publication about WordPress for site owners. Plain English, every weekend.https://wpwithin.com/enhello@wpwithin.com (WPWithin)hello@wpwithin.com (WPWithin)https://wpwithin.com/articles/weekly-17/https://wpwithin.com/articles/weekly-17/Five plugins shipped critical fixes this week. Two older flaws are under attack, and Rank Math paused a feature that created credentials without consent.Fri, 04 Sep 2026 00:00:00 GMTweekly-roundupSecurityGovernanceBlock EditorBusinessAIhttps://wpwithin.com/articles/wordpress-dashicons-svg-icons-admin/https://wpwithin.com/articles/wordpress-dashicons-svg-icons-admin/WordPress is replacing Dashicons with SVG icons in your admin bar and menu, fixing screen reader announcements and high-contrast display glitches.Fri, 04 Sep 2026 00:00:00 GMTaccessibilityhttps://wpwithin.com/articles/super-forms-file-upload-active-exploitation/https://wpwithin.com/articles/super-forms-file-upload-active-exploitation/Attackers have exploited a critical Super Forms plugin flaw since July, and Wordfence has blocked over 250,000 attempts. Update to 6.3.314 now.Thu, 03 Sep 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/elementor-pro-active-exploitation-190000-attempts/https://wpwithin.com/articles/elementor-pro-active-exploitation-190000-attempts/Wordfence has blocked over 190,000 exploit attempts against the critical Elementor Pro file upload flaw. Update to 4.2.2 now if you haven't already.Wed, 02 Sep 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/gutenberg-23-9-inserter-style-overrides/https://wpwithin.com/articles/gutenberg-23-9-inserter-style-overrides/Gutenberg 23.9 adds an inserter shortcut to the block toolbar and dot indicators that flag blocks with custom style overrides.Wed, 02 Sep 2026 00:00:00 GMTblock-editorhttps://wpwithin.com/articles/wordpress-narrows-vulnerability-disclosure-scope/https://wpwithin.com/articles/wordpress-narrows-vulnerability-disclosure-scope/WordPress narrowed what counts as a valid bug bounty report after low-severity submissions became unmanageable. Core and Gutenberg rules are unchanged.Wed, 02 Sep 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/all-in-one-wp-migration-sql-injection-vulnerability/https://wpwithin.com/articles/all-in-one-wp-migration-sql-injection-vulnerability/A SQL injection flaw in All-in-One WP Migration and Backup, used on 5 million sites, can lead to a full takeover during a backup restore. Update to 7.110.Tue, 01 Sep 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/gravity-forms-arbitrary-file-upload-vulnerability/https://wpwithin.com/articles/gravity-forms-arbitrary-file-upload-vulnerability/A critical flaw in Gravity Forms lets attackers upload malicious files without logging in, if a form allows multiple file uploads. Update to 3.0.3 now.Tue, 01 Sep 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/rank-math-support-agent-paused/https://wpwithin.com/articles/rank-math-support-agent-paused/Rank Math paused its Support Agent feature after users said it created login credentials without clear consent. It returns once consent flow is rebuilt.Tue, 01 Sep 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-core-security-initiative/https://wpwithin.com/articles/wordpress-core-security-initiative/WordPress is scaling its security team after bug reports jumped 15x, driven largely by AI-assisted research. Here's the new Core Security Initiative.Tue, 01 Sep 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/rank-math-support-agent-application-password-consent/https://wpwithin.com/articles/rank-math-support-agent-application-password-consent/Rank Math 1.0.277 reportedly creates an admin-level Application Password when you open Help and Support, without asking first. Revoke it now.Sun, 30 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/givewp-object-injection-rce-vulnerability/https://wpwithin.com/articles/givewp-object-injection-rce-vulnerability/A CVSS 10 flaw in GiveWP lets attackers take over donation sites without logging in. Update to version 4.16.7.2 immediately.Sat, 29 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/openstation-desktop-mode-wp-admin-plugin/https://wpwithin.com/articles/openstation-desktop-mode-wp-admin-plugin/OpenStation lets you open wp-admin pages as draggable windows, like a desktop operating system. It's opt-in per user and fully reversible on deactivation.Sat, 29 Aug 2026 00:00:00 GMTpluginshttps://wpwithin.com/articles/pods-developer-emergency-patch-response/https://wpwithin.com/articles/pods-developer-emergency-patch-response/Pods shipped patches across six plugin versions after a critical flaw let attackers become admin. Its solo developer took the week off his job to fix it.Sat, 29 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/woocommerce-analytics-reduce-returns/https://wpwithin.com/articles/woocommerce-analytics-reduce-returns/Nearly 1 in 5 online orders gets returned. WooCommerce Analytics can show you why, and AutomateWoo can flag repeat offenders before they cost you more.Sat, 29 Aug 2026 00:00:00 GMTcommercehttps://wpwithin.com/articles/weekly-16/https://wpwithin.com/articles/weekly-16/A CVSS 10 flaw in GiveWP lets attackers hijack donation sites without logging in. Five more critical plugin and theme bugs demanded updates this week.Fri, 28 Aug 2026 00:00:00 GMTweekly-roundupSecurityPerformancePlatformAIhttps://wpwithin.com/articles/wp-rocket-wordpress-7-1-post-mortem/https://wpwithin.com/articles/wp-rocket-wordpress-7-1-post-mortem/WP Rocket's post-mortem on last week's WordPress 7.1 outage reveals a bug report sat unassigned for six weeks. About 10% of its sites went down.Fri, 28 Aug 2026 00:00:00 GMTperformancehttps://wpwithin.com/articles/wpmu-dev-dashboard-auth-bypass-vulnerability/https://wpwithin.com/articles/wpmu-dev-dashboard-auth-bypass-vulnerability/A critical flaw in WPMU DEV Dashboard lets unauthenticated attackers become your site admin if Hub Single Sign-On is enabled. Update to 5.0.2 now.Fri, 28 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/avada-theme-fusion-builder-rce-vulnerability/https://wpwithin.com/articles/avada-theme-fusion-builder-rce-vulnerability/A critical, unauthenticated flaw in the Avada theme and its Fusion Builder plugin lets attackers take over your site. Update to 7.16.1 now.Wed, 26 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-secrets-api-proposal/https://wpwithin.com/articles/wordpress-secrets-api-proposal/WordPress plans a Secrets API so plugins stop storing your API keys as plain text. It targets version 7.2, with the settings screen following in 7.3.Wed, 26 Aug 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/translatepress-account-takeover-vulnerability/https://wpwithin.com/articles/translatepress-account-takeover-vulnerability/An unauthenticated flaw in TranslatePress can hand attackers your admin's password reset link. It only triggers if a secondary language is active. Update now.Tue, 25 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-playground-legacy-versions/https://wpwithin.com/articles/wordpress-playground-legacy-versions/WordPress Playground can now boot any version back to 0.7 from 2003, right in your browser. Test old plugins or check compatibility before an upgrade.Tue, 25 Aug 2026 00:00:00 GMTplaygroundhttps://wpwithin.com/articles/wordpress-accessibility-lab-plugin-prototype/https://wpwithin.com/articles/wordpress-accessibility-lab-plugin-prototype/WordPress's Accessibility Team previews a plugin that flags skipped heading levels and inaccessible blocks in real time. Not installable yet.Mon, 24 Aug 2026 00:00:00 GMTaccessibilityhttps://wpwithin.com/articles/miniorange-saml-sso-auth-bypass-vulnerability/https://wpwithin.com/articles/miniorange-saml-sso-auth-bypass-vulnerability/Two critical flaws in the miniOrange SAML SSO plugin let attackers log in as your admin. Paid editions were missed by update checkers. Patch now.Sat, 22 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/pods-plugin-privilege-escalation-vulnerability/https://wpwithin.com/articles/pods-plugin-privilege-escalation-vulnerability/A critical flaw in the Pods plugin lets attackers become your site admin without logging in. Update to version 3.3.9.1 now if you run Pods.Fri, 21 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/weekly-15/https://wpwithin.com/articles/weekly-15/Three unauthenticated plugin flaws hit Elementor Pro, Forminator, and User Profile Builder this week. WordPress 7.1 also launched with responsive styling.Fri, 21 Aug 2026 00:00:00 GMTweekly-roundupSecurityWordPress CoreAIBlock EditorBusinesshttps://wpwithin.com/articles/wp-rocket-wordpress-7-1-fatal-error/https://wpwithin.com/articles/wp-rocket-wordpress-7-1-fatal-error/WP Rocket sites crashed after WordPress 7.1 launched, taking down over a third of one host's fleet. Update to WP Rocket 3.23.2.2 to fix it.Fri, 21 Aug 2026 00:00:00 GMTperformancehttps://wpwithin.com/articles/elementor-pro-file-upload-rce-vulnerability/https://wpwithin.com/articles/elementor-pro-file-upload-rce-vulnerability/An unauthenticated flaw in Elementor Pro lets attackers upload malicious files and take over your site. Update to version 4.2.2 now.Thu, 20 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-7-1-mary-lou-release/https://wpwithin.com/articles/wordpress-7-1-mary-lou-release/WordPress 7.1 is here with responsive design controls, a persistent admin bar, and a rebuilt image editor. Update now to get the new tools.Thu, 20 Aug 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/gutenberg-23-8-shareable-revisions/https://wpwithin.com/articles/gutenberg-23-8-shareable-revisions/Gutenberg 23.8 lets editors link straight to one exact revision, emails you when someone mentions you in a note, and makes List View 40x faster.Wed, 19 Aug 2026 00:00:00 GMTblock-editorhttps://wpwithin.com/articles/wordpress-ai-plugin-1-3-0-translation-slugs/https://wpwithin.com/articles/wordpress-ai-plugin-1-3-0-translation-slugs/WordPress's AI plugin 1.3.0 adds in-editor content translation and slug suggestions. A key naming change also affects custom Abilities setups.Wed, 19 Aug 2026 00:00:00 GMTwordpress-aihttps://wpwithin.com/articles/forminator-forms-file-upload-vulnerability/https://wpwithin.com/articles/forminator-forms-file-upload-vulnerability/A critical flaw in Forminator Forms lets attackers upload malicious files and take over your site without logging in. Update to 1.56.2 now.Tue, 18 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/user-profile-builder-auth-bypass/https://wpwithin.com/articles/user-profile-builder-auth-bypass/A critical flaw in User Profile Builder can let attackers log in as your site admin. Update to version 3.16.5 now if Automatic Log In is enabled.Sat, 15 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/weekly-14/https://wpwithin.com/articles/weekly-14/WordPress 7.0.4 patches an Imagick RCE flaw, its third security release in weeks. Two plugin backdoors hit official update channels this week too.Fri, 14 Aug 2026 00:00:00 GMTweekly-roundupSecurityAccessibilityBusinesshttps://wpwithin.com/articles/wordpress-plugin-reviews-reliability-study/https://wpwithin.com/articles/wordpress-plugin-reviews-reliability-study/A study of 3,400 WordPress.org plugin reviews found reliability failures drive 42% of 1-star ratings. Missing features caused just 2.5%.Fri, 14 Aug 2026 00:00:00 GMTpluginshttps://wpwithin.com/articles/wordpress-official-browser-extension/https://wpwithin.com/articles/wordpress-official-browser-extension/WordPress.org released an official browser extension for Chrome and Safari that hides your admin bar, adds shortcuts, and previews pages on mobile.Thu, 13 Aug 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/wordpress-7-0-4-security-release/https://wpwithin.com/articles/wordpress-7-0-4-security-release/WordPress 7.0.4 fixes a flaw where a disguised image upload lets an Author-level account run code on your server. Update now.Wed, 12 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-accessibility-ready-theme-review-dispute/https://wpwithin.com/articles/wordpress-accessibility-ready-theme-review-dispute/Matt Mullenweg says a WordPress theme accessibility overhaul is permanently delayed, leaving theme authors unclear on a September delisting deadlineTue, 11 Aug 2026 00:00:00 GMTaccessibilityhttps://wpwithin.com/articles/bdthemes-elementor-plugins-supply-chain-backdoor/https://wpwithin.com/articles/bdthemes-elementor-plugins-supply-chain-backdoor/Attackers hijacked a promotional banner feed in seven BdThemes Elementor plugins to plant rogue admin accounts and hidden backdoors. Check your site now.Sun, 09 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/weekly-13/https://wpwithin.com/articles/weekly-13/WordPress 7.0.3 patches 12 flaws, one leading to remote code execution. A backdoored update hit Fluent Forms and Ninja Tables Pro for five hours.Fri, 07 Aug 2026 00:00:00 GMTweekly-roundupSecurityBlock EditorCommerceBusinesshttps://wpwithin.com/articles/wordpress-7-0-3-security-release/https://wpwithin.com/articles/wordpress-7-0-3-security-release/WordPress 7.0.3 fixes 12 security flaws, including a login screen bug that can lead to remote code execution. Update your site now.Fri, 07 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-hackerone-450-reports-ai-security/https://wpwithin.com/articles/wordpress-hackerone-450-reports-ai-security/WordPress security reports jumped from about 30 a month to 450 in July, as AI tools like Anthropic and pwn.ai now find and prove exploitable bugs.Fri, 07 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wpmanageninja-fluent-forms-ninja-tables-backdoor/https://wpwithin.com/articles/wpmanageninja-fluent-forms-ninja-tables-backdoor/A forgotten server let attackers backdoor Fluent Forms Pro and Ninja Tables Pro updates for five hours. Check your site if you updated on July 31.Fri, 07 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/patchstack-protect-the-shire-hold-times/https://wpwithin.com/articles/patchstack-protect-the-shire-hold-times/Patchstack found WordPress.org holds critical security patches for the same delay as cosmetic updates, leaving known flaws exposed for hours longer.Wed, 05 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/woocommerce-11-0-release/https://wpwithin.com/articles/woocommerce-11-0-release/WooCommerce 11.0 speeds up product pages and checkout, fixes refund reporting by month, and lets guest buyers link past orders to a new account.Wed, 05 Aug 2026 00:00:00 GMTcommercehttps://wpwithin.com/articles/wordpress-71-button-hover-focus-states/https://wpwithin.com/articles/wordpress-71-button-hover-focus-states/WordPress 7.1 lets you set hover and focus colors on Button and Navigation Link blocks from Global Styles, no custom CSS needed.Wed, 05 Aug 2026 00:00:00 GMTblock-editorhttps://wpwithin.com/articles/wordpress-71-rc1-release-candidate/https://wpwithin.com/articles/wordpress-71-rc1-release-candidate/WordPress 7.1 Release Candidate 1 is out, with the final release locked for August 19. Test it on a staging site before it reaches your dashboard.Wed, 05 Aug 2026 00:00:00 GMTwordpress-updateshttps://wpwithin.com/articles/woocommerce-social-login-apple-jwt-auth-bypass/https://wpwithin.com/articles/woocommerce-social-login-apple-jwt-auth-bypass/A critical flaw in WooCommerce Social Login lets attackers log in as any user, including admins, by faking an Apple sign-in token. Update to 2.8.8 now.Tue, 04 Aug 2026 00:00:00 GMTsecurityhttps://wpwithin.com/articles/wordpress-71-admin-tooltips-toggletips/https://wpwithin.com/articles/wordpress-71-admin-tooltips-toggletips/WordPress 7.1 adds hover tooltips and an info button to icon-only admin controls, plus an explainer for the login screen's Remember Me checkbox.Mon, 03 Aug 2026 00:00:00 GMTaccessibilityhttps://wpwithin.com/articles/weekly-12/https://wpwithin.com/articles/weekly-12/A plugin backdoor never reached a single WordPress site, but WP2Shell attacks have topped 11 million attempts. WordPress 7.1 nears its August 19 release.Fri, 31 Jul 2026 00:00:00 GMTweekly-roundupSecurityBlock EditorCommerceCommunity