WordPress News & Updates
News from WordPress News & Updates
WordPress runs a large share of the world's websites, which makes it a constant target and means its updates matter. This category covers WordPress releases and security announcements, together with the practical problems that come up again and again on real sites: scheduled posts that fail to publish because WordPress cron depends on visitor traffic, sites quietly being used in attacks on other people, and plugins and themes that fall behind on updates.
The articles explain what a change means for an ordinary site owner and what, if anything, you need to do about it, rather than repeating the release notes.
If you are choosing where to host a WordPress or WooCommerce site, our WordPress hosting and WooCommerce hosting pages explain what we provide, and our website malware monitoring and cleaning service covers what happens if a site is compromised.
What If a Plugin Could Not Read Your Whole Site?
Every WordPress plugin you install has complete access to your content, your customer data and your credentials. A new CMS from Cloudflare does it differently, with phone-style permissions enforced by the runtime. Whether it matters to you, and what to do in the meantime.
WordPress and PHP Versions: Upgrading Without Taking the Site Down
Changing PHP version on a neglected WordPress site is one of the reliable ways to take it offline. What breaks, why, and the order that avoids it.
What an Attacker Can Do With a Free Subscriber Account
A vulnerability in a WordPress e-learning plugin let anyone who could fill in the registration form run commands on the server. What PHP object injection is, why “subscriber access required” is not the limitation it sounds like, and what to check on your own site.
The Plugin That Does Not Appear in Your Plugin List
WordPress has a second plugin directory that loads automatically and cannot be switched off from the dashboard. A malware sample analysed in September hides there, edits the screens that would reveal it, hides its own administrator account, and rebuilds itself if you delete the file. What to check, and why deleting files first is the wrong move.
How One Link Can Make You Create an Attacker’s Admin Account
A flaw in the Elementor page builder let a single link, opened by a logged-in administrator, create a second administrator account for whoever sent it. What cross-site request forgery is, why this one reached the whole of the WordPress REST API, and the checks worth running.
A Critical WordPress Flaw, and the Shrinking Gap Between Patch and Attack
WordPress shipped an emergency fix for a critical flaw on 22 September, backported across twenty-five branches. Attackers were probing for it the same day. What the flaw actually is, how to tell whether your site is patched, and why a weekly update cycle is no longer fast enough.
How One Plugin Can Let an Attacker Upload a Backdoor
A live attack campaign against a WooCommerce plugin shows how file upload flaws work, why patched sites are still being hit, and the checks worth running.
Is Your WordPress Website Being Used in a DDoS Attack?
WordPress sites are recruited into attacks on other people constantly, and the owner usually notices nothing beyond the site feeling slow. How to check your logs, and the two-minute fix.
WordPress Cron Jobs: Why Your Scheduled Posts Do Not Publish
WP-Cron is not a cron job. It runs on visitor page requests, so a page cache and a CDN can silently stop your scheduled posts, backups and WooCommerce renewals. How to fix it properly, in the right order.