WordPress core bug under attack, plus Elementor and WPForms fixes

One job comes before everything else this week: make sure your sites are on WordPress 7.1.2. It fixes a serious bug in WordPress itself, and attackers were trying it on sites the same day it came out.

Elsewhere, Elementor had to fix a nasty bug in a two-day-old release, and a judge brought WP Engine's antitrust case against Automattic back to life.

Attackers are already using the bug fixed in 7.1.2

WordPress 7.1.2 landed on 22 September with one fix, for a critical bug in every version back to 4.7.¹ Anyone, without logging in, could trick WordPress into loading a PHP file from elsewhere on the server. On some setups, that's enough to take over the site.

Two things have to line up for that.² Your theme needs a top-level folder whose name starts with "page-", and the advisory names Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as examples. And the server needs a PHP setup that comes as standard with cPanel on PHP versions before 8.5, which covers a lot of shared hosting.

Patchstack saw the first attempts on release day, and within hours some attackers were using the bug to write their own files onto servers.³ A ready-made scanning tool is now doing the rounds, and on Friday CISA, the US government's cyber security agency, added the bug to its list of ones known to be under attack.⁴ Honestly, it's the first WordPress core bug in years that I'd call a drop-everything update.

The fix has been backported to older versions too (7.0.6, 6.9.9, 6.8.10 and so on), and most sites install these by themselves. Don't lean on a free firewall plugin, because Wordfence's rule for this only reaches free users on 22 October.⁵

If a site sat on an older version for part of the week and uses one of those themes, ask your host to check the server's temporary folders for PHP files nobody recognises. That's where attackers have been leaving them.³ If anything turns up, follow my guide to cleaning up a hacked site.

WordPress news

WordPress now leads the Open Website Alliance

Mary Hubbard now represents the WordPress Foundation as president of the Open Website Alliance, the open source group WordPress shares with Drupal, Joomla and TYPO3.⁶ The role rotates between members, who first worked together on a response to the EU's Cyber Resilience Act.

For developers

There's now an MCP server for WordPress Trac, so AI assistants can read tickets and changesets.⁷

Around the community

A judge has revived WP Engine's antitrust claims

The judge in WP Engine's lawsuit against Automattic and Matt Mullenweg threw out its antitrust claims a year ago, and on 24 September she reversed that.⁸ WP Engine can now argue that Automattic used its control of WordPress.org to squeeze competitors, including over hosting and custom field plugins like ACF. Most of the trademark counterclaims against WP Engine survive too.⁹

Nothing changes for your site, but this case has a long way to run.

Automattic has a new board

Just over two weeks after Automattic's board tried to put Matt Mullenweg on leave, there's a new board. TechCrunch reports three departures and four new members, including the novelist Hugh Howey.¹⁰ Mullenweg controls 84% of the voting shares, which is how he could rebuild it so quickly.

Google's translate widget loses support on 1 October

Google's Website Translator widget, the old "Select Language" dropdown, won't be supported from 1 October.¹¹ Google announced it in a note on an old blog post at the start of September, so it's easy to have missed. It may keep working for a while, but if you use it, I'd plan a replacement now.

WooCommerce

WooCommerce 11.1.2 is another security update

11.1.2 arrived on 22 September, four days after 11.1.1.¹² It tightens security around email-based product reviews and fixes a bug that could break product pages with variations on some themes. There's no database update.

WooCommerce 11.2 is due the week of 6 October

The beta is out.¹³ My favourite change is a small one: the product importer can now match existing products by barcode (GTIN, UPC, EAN or ISBN) when there's no ID or SKU.

Two things to watch. Stacked coupons with sequential discounts will apply in the order the customer entered them, which can shift totals. And the Cart and Checkout blocks get a fixed-width order summary, so check any custom styling there. There's a database update, so back up first.

Plugin security updates

Elementor fixed a one-click takeover bug

In Elementor 4.3.0 and 4.3.1, released on 22 and 23 September, a logged-in administrator who clicked a specially crafted link could unknowingly create a new admin account for whoever sent it.¹⁴ The link could come by email, in a chat or in a comment.

4.3.2 fixed it on 24 September. Nobody has reported attacks, but Elementor runs on more than 10 million sites, so if yours updated on 22 or 23 September, check it's now on 4.3.2.

Other updates worth doing

If you use any of these, update this week:¹⁵

Gravity Forms, Forminator and Ultimate Member were disclosed on 17 and 18 September, just too late for last week. Gravity Forms updates from its own server rather than WordPress.org, so check it's on 3.1.2, the latest.¹⁶ If WPForms shares a Stripe account with anything else, update it first.¹⁷ And any visitor can reach the HUSKY bug, so don't leave that one.

Meta Box AIO, a paid bundle, had a bug that could let anyone make themselves an administrator. Update to 3.12.0 or later.¹⁸ AMP for WP (1.1.17), FileOrganizer (1.2.1), Profile Builder (4.0.3), WPC Product Bundles (8.6.7) and Zero Spam (5.7.11) also fixed bugs that let anyone plant harmful code for an admin to trip over. If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.

No fix yet for Request a Quote for WooCommerce

Addify's Request a Quote for WooCommerce, a paid extension on about 5,000 stores, has a bug that lets anyone upload files that can run code, if a quote rule uses its multi-page popup form.¹⁹ Wordfence disclosed it on Friday, and the latest version (2.9.2) is still affected. If you use that popup, switch it off or deactivate the plugin until Addify ships a fix.

Malware that hides from your dashboard

Wordfence published a teardown of malware it keeps finding in clean-ups.²⁰ It hides itself from the Plugins screen and adds an admin account that it hides from the Users screen too. Then it records admin passwords and copies WooCommerce orders and payment keys. Delete it and it puts itself back.

So a clean-looking dashboard doesn't prove a clean site. If you suspect a hack, start with my hacked site guide, and if a shop is affected, ask your payment provider about replacing your keys.

For the long tail, Wordfence's report for 14 to 20 September counted 358 new vulnerabilities across 243 plugins and 4 themes.²¹

What I'd do this week

• Update WordPress to 7.1.2 (or your version's security release) today, then check Dashboard › Updates to make sure it happened.
• Ask your host for a quick check if a site ran an older version this week with one of the themes above. If they find anything odd, follow the hacked site guide.
• Update Elementor to 4.3.2, then your form plugins. WPForms, Gravity Forms, Ninja Forms and Forminator all had serious fixes.
• Update WooCommerce to 11.1.2, and try 11.2 on a staging site before 6 October. If an update breaks something, here's how to fix a site after a bad update.
• Using Addify's Request a Quote? Switch off its popup quote form until there's a fix.
• Using Google's translate dropdown? Plan a replacement.