This week in WordPress

10 Oct 2026 WordPress 7.1.3 security release, Ninja Forms attacks and WooCommerce 11.2 Active attacks WordPress 7.1.3 fixes seven security bugs. Most sites will update themselves WooCommerce 11.2 is out. Go straight to 11.2.1, which fixes two checkout bugs Attackers are using an old Ninja Forms bug to plant hidden admin accounts 3 Oct 2026 WooCommerce sets a PHP 8.1 date, EmDash 1.0 and an UpdraftPlus fix Plugin vulnerabilities WooCommerce 11.6 will need PHP 8.1 or newer when it lands in February 2027 Cloudflare's EmDash 1.0 offers sandboxed plugins as a WordPress alternative UpdraftPlus, All in One SEO and Ultimate Member fixed security bugs 26 Sep 2026 WordPress core bug under attack, plus Elementor and WPForms fixes Active attacks Attackers are using a WordPress bug that 7.1.2 fixes. Update today WooCommerce 11.1.2 is a security update that also fixes a product page crash Elementor 4.3.2 fixes a bug that let one click create an admin account 19 Sep 2026 WordPress 7.1.1 fixes 11 security bugs, plus a new default theme Core security release WordPress 7.1.1 fixes 11 security bugs. Update your sites today WordPress 7.2 arrives in December with a sudo mode for risky actions WooCommerce 11.1.1 is a small security update 12 Sep 2026 Safer plugin updates, a strange week at Automattic and an Events Calendar fix Plugin vulnerabilities WordPress.org now blocks risky plugin updates before they reach your site Automattic's board put Matt Mullenweg on leave. He was back 33 hours later WooCommerce plans to need PHP 8.1 or newer from January 2027 5 Sep 2026 Elementor Pro under attack, WooCommerce 11.1 lands and a Gravity Forms fix Active attacks Nearly one in five WordPress sites are still running PHP 7.4 WooCommerce 11.1 arrived two days late, with free variation image galleries Elementor Pro is under attack. Make sure you are on 4.2.2 or later 29 Aug 2026 AI bug hunters, a WordPress security push and a ManageWP login bypass Plugin and theme fixes AI tools are finding WordPress security bugs faster than ever WordPress may finally get a safe place to keep API keys WooCommerce 11.1 is due on Tuesday 1 September