AI bug hunters, a WordPress security push and a ManageWP login bypass

A week where AI was the story, in a good way for once. Security researchers are using it to find WordPress bugs that would have taken a person weeks to spot, and WordPress has launched a plan to cope with the flood of reports.

The knock-on effect is a long list of plugin updates. If you use ManageWP, Kirki, TranslatePress, GiveWP or the Avada theme, update today.

AI is finding WordPress bugs faster than ever

On 28 August the WordPress security team announced the Core Security Initiative.¹ The reason is simple. Security reports have shot up over the past year, because AI makes it far easier to comb through code looking for problems. The team says that's a good problem to have, but it needs to scale up to deal with it.

The plan has three parts. A more automated security release process, so fixes ship reliably and on a schedule. More people working through the backlog of reports. And using AI themselves to find problems before attackers do.

The day before, Wordfence showed what that looks like in practice. Its AI research tool, Argus, found a six-step chain of bugs in the Avada theme that let anyone run code on a site, and proved it worked in about two hours.² Wordfence reckons a skilled person might have needed a month, and says more findings like it are on the way.³

For site owners, this means more security updates, arriving more often. Attackers have the same tools, so the time between a fix coming out and someone trying to use the bug is only going to get shorter. Automatic updates for minor WordPress releases should already be on. If you manage plugin updates by hand, it's worth checking in more often than you used to.

WordPress news

A safe place for API keys

At the moment, every plugin that needs an API key (for your email service, payment provider or an AI tool) saves it in your database as plain text. A new proposal for WordPress 7.2 would give WordPress a proper, encrypted place to keep them.⁴

It matters more than it used to. A leaked AI service key can run up a real bill, and right now there's no easy way to even see which keys are stored on a site. The plan is to release it as a plugin for testing first, add it to WordPress 7.2, then follow up with a settings screen in 7.3.

For developers

The Secrets API would add wp_set_secret(), wp_get_secret() and friends, with WP-CLI support in the same release. Worth a read if your plugin stores credentials.

Around the community

WordPress backs open AI models

WordPress has signed an open letter asking US lawmakers not to restrict AI models that anyone can download, inspect and run themselves.⁵ It's a very open source position, and a fair one.

A Meetup.com replacement for WordPress groups

Community organisers are building an open-source alternative to Meetup.com for local WordPress groups, based on the GatherPress plugin and running on events.wordpress.org. It's ready for early testing, and anyone with a WordPress.org account can try joining a group and RSVPing.⁶

The Hosting Team now asks for AI disclosure

Anything submitted to WordPress's Hosting Team that was made or edited with AI now has to say so.⁷ It's a small team, but it's the kind of rule other teams may well copy.

WooCommerce

WooCommerce 11.1 is due on Tuesday

WooCommerce 11.1 is scheduled for 1 September.⁸ It's a big release, so take a backup first and, if you can, try it on a staging copy. There's no prize for updating on day one.

A withdrawal form for EU customers

11.1 adds an optional form that lets customers ask to withdraw from an order within 14 days, which EU rules require for most online sales.⁹ It's off by default. Once you switch it on under WooCommerce › Settings › Advanced › Features, the form lives at /my-account/withdraw-order, but it isn't linked from anywhere, so you'll need to add a link yourself (your footer or order emails are good spots). WooCommerce is clear that it helps with the rules but doesn't guarantee you're compliant.

For developers

WooCommerce 11.2 changes the hooks that fire when products are saved and reordered, to speed up big catalogues.¹⁰ Check any custom code that listens for set_object_terms or the old reordering hooks.

Plugin security updates

Update these today

GiveWP is the one I'd worry about most. Patchstack says a site with one published donation form and one payment method switched on is enough to be exposed, which describes most charity sites using it.¹¹ WPMU DEV Dashboard is a paid plugin that updates from WPMU DEV rather than WordPress.org, so check it's actually on 5.0.2.¹² TranslatePress's worst bug needs a fairly specific setup, but the fixes are all in 3.3.4, so just update.¹³

Avada theme

If your site uses the Avada theme, which has sold over a million copies, update both the theme and its Fusion Builder plugin. Everything up to Avada 7.16 and Fusion Builder 3.16 let anyone run code on your server without logging in. ThemeFusion released the fix on 25 August.² Avada updates come from ThemeFusion rather than WordPress.org, so check your theme's registration is active or updates may not show up.

Harmful code bugs in big plugins

These plugins fixed bugs that let someone sneak harmful code onto your pages without logging in, which can lead to account takeovers when an admin views the page:¹⁴

• LiteSpeed Cache (7M+ sites), fixed after 7.8.1
• WP Fastest Cache (1M+), fixed in 1.5.1
• Formidable Forms (300,000+), fixed after 6.33.1
• Optimole (200,000+), fixed after 4.2.10

Smaller fixes

The Events Calendar (6.17.3), Smush (4.3.2), Ultimate Member, Rank Math (1.0.277), UpdraftPlus (1.26.7) and SiteGround's Security Optimizer all patched lower-risk problems. Your usual updates will cover them.

If you want the full list, Wordfence's latest weekly report covers 17 to 23 August.¹⁵

What I'd do this week

• Update today if you use ManageWP Worker, Kirki, TranslatePress, WPMU DEV Dashboard, GiveWP or Tutor LMS.
• Using Avada? Update the theme and Fusion Builder, and make sure your licence is active so the update comes through.
• Don't rush WooCommerce 11.1 on Tuesday. Back up first and give it a few days if you can. If an update does break something, here's how to fix a site after a bad update.
• Selling in the EU? Have a look at the new withdrawal form once you're on 11.1.