Safer plugin updates, a strange week at Automattic and an Events Calendar fix

Good news this week, and some very odd news. The good: WordPress.org now checks every plugin update before it goes out. The odd: Automattic's board removed its CEO, and he was back in charge a day and a half later.

There's also a long list of plugin updates, including a serious one for The Events Calendar, and a WooCommerce wholesale add-on that's being actively attacked.

Plugin updates are now checked before they ship

This is the most useful thing WordPress.org has done for site owners in years.

Since June, every plugin and theme update on WordPress.org has sat in a six-hour waiting room before being offered to sites. On 9 September the Plugins Team explained what happens in that window.¹ Each update is checked by several AI models and Jetpack Scan, and anything that looks high risk is now blocked automatically.

It's already caught something real. In July, someone slipped a backdoor into a plugin used on around 20,000 sites. The check flagged it before the update went out, so nobody got it.

It won't catch everything, and it doesn't cover paid plugins that update from their own servers. But until now, nothing checked an update between the developer pressing publish and it landing on millions of sites. Matt Mullenweg's take was short: "It's a really big deal."² I agree.

A strange week at Automattic

Automattic is the company behind WordPress.com, WooCommerce and Jetpack, and it pays for a big chunk of WordPress development.

On 9 September its board put CEO Matt Mullenweg on leave and named the finance chief, Mark Davies, as interim CEO.³ About 33 hours later, Mullenweg told staff he was back in control.⁴ According to TechCrunch's sources, Davies, the company's top lawyer and the board members involved have all since left.⁵ Nobody has said publicly why the board did it.

None of this changes anything for your site today. I'll be keeping an eye on it though, because Mullenweg is also leading the next WordPress release.

WordPress news

WordPress 7.1.1 fixes some nasty 7.1 bugs

WordPress 7.1.1 is in testing and due on 17 September.⁶ It fixes bugs that came in with 7.1, and three stood out to me:

• On multisite networks, deleting a user could skip the "who should get their posts?" step and delete their content. Until 7.1.1 is out, be careful removing users on a multisite running 7.1.
• Some plugins crashed because of a small change in how WordPress stores hooks.
• The built-in sitemap showed a "page not found" error on sites with no posts.

The WordPress 7.2 team

The team for WordPress 7.2 has been announced, with Matt Mullenweg leading the release.⁷

WooCommerce

WooCommerce wants PHP 8.1 or newer

WooCommerce wants to require PHP 8.1 or newer from version 11.5, due in January 2027, and it's asking for feedback.⁸ About 9% of stores are still on PHP 7.4 or 8.0. Those stores wouldn't break. They just wouldn't be offered new versions until their PHP is upgraded. If that's you, get it sorted well before January.

Subscriptions 9.2.0 changes

WooCommerce Subscriptions 9.2.0 changes a couple of things store owners will notice.⁹ Proration now works for physical products, and gifting is set per product instead of for the whole store. Stores that had gifting on for everything are moved over automatically. Older "remove item" and "resubscribe" links in customer emails stop working after the update, so don't be surprised by the odd confused customer.

Plugin security updates

Wholesale Lead Capture is under attack

Wordfence's alert has the full details.¹⁰

The Events Calendar

The Events Calendar, which runs on more than 600,000 sites, fixed two separate bugs that could let a stranger take over your site. One lets them run their own code on your server. The other resets an admin's password. Both need comments switched on for event pages, which has its own setting in the plugin, so plenty of sites were never exposed. Update to 6.17.4.1 or later anyway. Wordfence has the full write-up if you want the detail.¹¹

Other updates worth doing

If you use any of these, update this week:¹²

Plugin	Sites	What's wrong	Fixed in	Action
Tutor LMS	100,000+	Any logged-in user, even a basic subscriber, could run code on your server	4.0.8	Update now
SureCart	80,000+	A logged-in customer could take over someone else's account	4.6.3	Update
Everest Forms	90,000+	Anyone could feed it harmful data without logging in	3.6.1	Update
Site Reviews	60,000+	Anyone could feed it harmful data without logging in	8.3.0	Update
Event Tickets	90,000+	Anyone could change your Stripe payment settings	After 5.27.4	Update
Unlimited Elements	300,000+	Anyone could get at your database or add harmful code to pages	After 2.0.17	Update
WooCommerce	7M+	Anyone could knock your store offline	11.1.0	Update
Kirki	500,000+	Anyone could sneak harmful code onto your pages	6.3.0	Update
Hide My WP Ghost	100,000+	Could make your server fetch things it shouldn't	7.0.10	Update
Jetpack	3M+	Anyone could sneak harmful code onto your pages (16.1 to 16.1.2 only)	16.1.3	Update

Two to do first. Most course sites let anyone sign up, so the Tutor LMS bug is open to pretty much anybody. And if you sell tickets through Event Tickets with Stripe, update, then check your Stripe connection still points at your own account.

Smaller fixes

Site Kit by Google (1.187.0) fixed a smaller issue too. Really Simple Security had another two-factor login bug reported, but last week's 9.8.1 update already covers it.

If you want the full list, Wordfence's report for 31 August to 6 September counted 295 new vulnerabilities in a single week.¹³ That's a normal week now, which is why the update checks at the top of this post matter so much.

What I'd do this week

• Update The Events Calendar to 6.17.4.1 or later, and Tutor LMS to 4.0.8 or later.
• Selling tickets with Event Tickets and Stripe? Update, then check your Stripe settings.
• Get WooCommerce onto 11.1 if you haven't already. Back up first, as it includes a database update.
• Running a multisite on 7.1? Hold off deleting users until 7.1.1 is out on 17 September.
• On PHP 7.4 or 8.0 with WooCommerce? Talk to your host now rather than in January. If an update does break something, here's how to fix a site after a bad update.