Elementor Pro under attack, WooCommerce 11.1 lands and a Gravity Forms fix

A lively week. If you use Elementor Pro, check it's up to date today. Attackers are going after a bug that was fixed on 19 August, and plenty of sites still haven't updated. Super Forms, a much smaller form plugin, is being attacked too.

Elsewhere, WooCommerce 11.1 finally turned up, and a surprising number of sites are still running a version of PHP that stopped getting fixes nearly four years ago.

WordPress news

Fewer low-value bug reports

A follow-up to last week's Core Security Initiative. WordPress's vulnerability reporting programme will generally stop accepting reports for problems that need an admin-level account to exploit (outside WordPress itself and Gutenberg).¹ With AI tools flooding the team with reports, the idea is to spend the time on bugs that could actually hurt a site.

WordPress 7.1.1 is on the way

WordPress 7.1.1 is due on 17 September.² It's a tidy-up for bugs that crept into WordPress 7.1 when it came out on 19 August.³ If 7.1 has been misbehaving for you, your fix might already be on the list.

Gutenberg 23.9

Gutenberg 23.9 came out on 2 September.⁴ You can now add blocks straight from the block toolbar, and Global Styles shows you which blocks have their own custom styling. That's only relevant if you run the Gutenberg plugin. Everyone else gets it in WordPress 7.2.

Nearly one in five sites are still on PHP 7.4

Around 18% of WordPress sites still run PHP 7.4, which stopped getting security fixes back in November 2022. It came up at WordCamp US and there's still no date for WordPress dropping it,⁵ but WordPress recommends PHP 8.3 or newer.⁶ If you're on 7.4, ask your host to move you. It's often a single setting in your hosting panel, though I'd try it on a staging copy first.

For developers

There's a proposal to swap the Dashicons in the admin menu for SVG icons.⁷

WooCommerce

WooCommerce 11.1 is out

WooCommerce 11.1 arrived on 3 September, two days late.⁸ The team held it back to fix some mini cart problems they found in testing.⁹ Good call.

What's new

The main new feature is image galleries for product variations, built in and free. That means the paid Additional Variation Images extension is being retired. The update switches galleries on for every store, even if you'd turned the feature off before, so check your variable products still look right afterwards.

There's also an optional withdrawal form for EU customers and early support for videos in product galleries. Both are switched off by default. Checkout and API requests should be a bit quicker too.

Before you update

This release includes a database update, so take a backup first. If you have a staging site, try it there before your live shop.

For developers

Read up on the changes to order item deletion¹⁰ and block registration.¹¹ Old WooCommerce Admin feature flags now show deprecation warnings as well.¹²

Plugin security updates

Elementor Pro is under attack

Wordfence has blocked more than 190,000 attempts so far, with the busiest spell between 19 and 23 August.¹³ Elementor Pro updates come from Elementor rather than WordPress.org, so if your licence has lapsed, the update may not have reached you. That's worth checking.

Super Forms is under attack too

Wordfence has blocked more than 250,000 attempts to use this bug, with a big spike in late August. Their write-up has the gory details, including the file name the attackers usually drop.¹⁴

Other updates worth doing

If you use any of these, I'd update this week:¹⁵

Gravity Forms is a paid plugin that updates from Gravity Forms itself, so check it's actually on 3.0.3 or later.¹⁶ And if you use Really Simple Security for two-factor logins, don't leave that one sitting. It's the whole reason you installed it.

Harmful code bugs in big plugins

A bunch of big plugins also fixed bugs that let someone sneak harmful code onto your pages without logging in. That code runs when you next view the page as an admin, which is how a lot of account takeovers start. If you use any of these, update:

• EWWW Image Optimizer (1M+ sites), fixed in 8.7.7
• W3 Total Cache (900,000+), fixed in 2.10.6
• Breadcrumb NavXT (800,000+), fixed in 7.5.2
• Ninja Forms (600,000+), fixed after 3.15.1
• WP Statistics (600,000+), fixed after 14.16.11
• Under Construction (600,000+), fixed after 5.82
• Broken Link Checker (500,000+), fixed after 2.4.13
• SureForms (500,000+), fixed after 2.12.2

Smaller fixes, and a few with no fix yet

Rank Math (1.0.277.1), Jetpack (16.1.3), All in One SEO and WooCommerce also patched some smaller problems. They're low risk, so there's no rush, and your usual updates will cover them.

SEOWriting, MapGeo and Login With Ajax have lower-risk bugs with no fix yet. If you're not really using them, now's a good time to delete them.

If you want the full list, Wordfence's latest weekly report covers 24 to 30 August.¹⁷

What I'd do this week

• Using Elementor Pro? Make sure it's on 4.2.2 or later, and that your licence is active so updates come through.
• Using Super Forms? Update to 6.3.314 or later and check wp-content/uploads for any odd .php files. If you find some, my hacked site guide walks you through the clean-up.
• Update Gravity Forms, ACF Extended, Hummingbird, JetFormBuilder, ProfilePress, Really Simple Security, wpDiscuz and LiteSpeed Cache if you have them.
• Back up before WooCommerce 11.1. If anything goes wrong, here's how to fix a site that broke after an update.
• Check your PHP version in Tools › Site Health › Info › Server. If it starts with a 7, have a word with your host.