Super Forms under attack, an ACF Extended fix and WooCommerce 11.1

A lively week. If you use the Super Forms plugin, update it today, because attackers are actively going after it.

Elsewhere, WordPress is putting a lot more effort into security, WooCommerce 11.1 finally turned up and a surprising number of sites are still running a version of PHP that stopped getting fixes nearly four years ago.

WordPress news

More hands on WordPress security

WordPress is putting more people and more automation into security. Bug reports have shot up as AI tools make hunting for problems easier, so the security team has started a Core Security Initiative to work through reports faster and ship fixes on a steadier schedule.¹ Expect more small security releases. Keep automatic minor updates switched on and you won't need to think about them.

WordPress 7.1.1 is on the way

WordPress 7.1.1 is due on 17 September.² It's a tidy-up for bugs that crept into WordPress 7.1 when it came out on 19 August.³ If 7.1 has been misbehaving for you, your fix might already be on the list.

Gutenberg 23.9

Gutenberg 23.9 came out on 2 September.⁴ You can now add blocks straight from the block toolbar, and Global Styles shows you which blocks have their own custom styling. That's only relevant if you run the Gutenberg plugin. Everyone else gets it in WordPress 7.2.

Nearly one in five sites are still on PHP 7.4

Around 18% of WordPress sites still run PHP 7.4, which stopped getting security fixes back in November 2022. It came up at WordCamp US and there's still no date for WordPress dropping it,⁵ but WordPress recommends PHP 8.3 or newer.⁶ If you're on 7.4, ask your host to move you. It's often a single setting in your hosting panel, though I'd try it on a staging copy first.

For developers

There's a proposal to swap the Dashicons in the admin menu for SVG icons.⁷

WooCommerce

WooCommerce 11.1 is out

WooCommerce 11.1 arrived on 3 September, two days late.⁸ The team held it back to fix some mini cart problems they found in testing.⁹ Good call.

What's new

The main new feature is image galleries for product variations, built in and free. That means the paid Additional Variation Images extension is being retired. The update switches galleries on for every store, even if you'd turned the feature off before, so check your variable products still look right afterwards.

There's also an optional withdrawal form for EU customers and early support for videos in product galleries. Both are switched off by default. Checkout and API requests should be a bit quicker too.

Before you update

This release includes a database update, so take a backup first. If you have a staging site, try it there before your live shop.

For developers

Read up on the changes to order item deletion¹⁰ and block registration.¹¹ Old WooCommerce Admin feature flags now show deprecation warnings as well.¹²

Plugin security updates

Super Forms is under attack

Wordfence has blocked more than 250,000 attempts to use this bug, with a big spike in late August. Their write-up has the gory details, including the file name the attackers usually drop.¹³

Other updates worth doing

If you use any of these, I'd update this week:¹⁴

Plugin	Sites	What's wrong	Fixed in	Action
ACF Extended	100,000+	Anyone could take over an admin account	0.9.2.7	Update now
Hummingbird	70,000+	Anyone could run their own code on your server	3.21.2	Update now
JetFormBuilder	80,000+	Anyone could trigger shortcodes they shouldn't have access to	3.6.5.2	Update now
ProfilePress	100,000+	Could be tricked into installing plugins without a login	4.17.2	Update
Really Simple Security	3M+	Its two-factor login could be skipped	9.8.1	Update
wpDiscuz	60,000+	Anyone could pull data out of your database	7.6.66	Update
LiteSpeed Cache	7M+	Could make your server fetch things it shouldn't	7.9.1	Update

If you use Really Simple Security for two-factor logins, don't leave that one sitting. It's the whole reason you installed it.

Harmful code bugs in big plugins

A bunch of big plugins also fixed bugs that let someone sneak harmful code onto your pages without logging in. That code runs when you next view the page as an admin, which is how a lot of account takeovers start. If you use any of these, update:

• EWWW Image Optimizer (1M+ sites), fixed in 8.7.7
• W3 Total Cache (900,000+), fixed in 2.10.6
• Breadcrumb NavXT (800,000+), fixed in 7.5.2
• Ninja Forms (600,000+), fixed after 3.15.1
• WP Statistics (600,000+), fixed after 14.16.11
• Under Construction (600,000+), fixed after 5.82
• Broken Link Checker (500,000+), fixed after 2.4.13
• SureForms (500,000+), fixed after 2.12.2

Smaller fixes, and a few with no fix yet

Rank Math (1.0.277.1), Jetpack (16.1.3), All in One SEO and WooCommerce also patched some smaller problems. They're low risk, so there's no rush, and your usual updates will cover them.

SEOWriting, MapGeo and Login With Ajax have lower-risk bugs with no fix yet. If you're not really using them, now's a good time to delete them.

If you want the full list, Wordfence's weekly report for 24 to 30 August covers the week before.¹⁵

What I'd do this week

• Using Super Forms? Update to 6.3.314 or later and check wp-content/uploads for any odd .php files. If you find some, my hacked site guide walks you through the clean-up.
• Update ACF Extended, Hummingbird, JetFormBuilder, ProfilePress, Really Simple Security, wpDiscuz and LiteSpeed Cache if you have them.
• Back up before WooCommerce 11.1. If anything goes wrong, here's how to fix a site that broke after an update.
• Check your PHP version in Tools › Site Health › Info › Server. If it starts with a 7, have a word with your host.