WordPress 7.1.3 security release, Ninja Forms attacks and WooCommerce 11.2

Two jobs this week. Check your sites have picked up WordPress 7.1.3, which fixes seven security bugs. And if you use Ninja Forms, get it onto 3.15.5, because attackers are using a bug in older versions to plant hidden admin accounts.

WooCommerce 11.2 also arrived, followed two days later by 11.2.1 to fix a couple of checkout problems. Shop owners should skip straight to the second one.

WordPress 7.1.3 fixes seven security bugs

WordPress 7.1.3 came out on Tuesday 6 October with seven security fixes and four bug fixes.¹ Two weeks ago I called 7.1.2 a drop-everything update. This one isn't. Patchstack went through the code and its advice is to update as soon as you can without treating it as an emergency, and I agree.²

Two of the seven can be started by a stranger. A comment waiting for approval could carry code that runs if the person moderating it clicks a link inside it, which affects sites on 7.1.0 to 7.1.2. And anyone could read the comments on private or unpublished posts through the comment feed. The other five need a logged-in contributor or author, an admin running an export, or a plugin that behaves in a particular way.

Most sites will have updated on their own, and older versions got the fixes too (7.0.7, 6.9.10, 6.8.11 and so on).³ Have a look at Dashboard › Updates to be sure. While you're in there, check who has an account on your site. Several of these bugs depend on what contributors and authors can reach, so old accounts are worth removing.

WordPress wants help paying for all these bug reports

Three of the seven were reported by Anthropic, and a fourth by Trail of Bits working with OpenAI.¹ That fits what I wrote about in August, when AI tools started finding WordPress bugs at a rate nobody had seen before. The Repository reports that WordPress's bug bounty programme received 2,004 reports in the last 90 days and paid out more than $90,000.⁴

Automattic has paid every one of those bounties since 2017. On Monday, WordPress's executive director Mary Hubbard emailed more than 30 of the biggest hosting, plugin and security companies, GoDaddy, Newfold Digital and Hostinger among them, asking them to help fund the security programme.⁵ That seems fair to me. Plenty of companies make a good living from WordPress, and one of them footing the whole security bill was never going to last.

WordPress news

WordPress 7.2 has its dates

WordPress 7.2 is due on 8 December, with the first beta on 20 October.⁶ There's nothing to do yet. If you look after a site with a lot of custom code, the beta is the time to start testing on a staging copy.

Jetpack 16.3 adds conditional logic to forms

Jetpack 16.3 lets a form show or hide a field depending on an earlier answer, and it's on every plan, the free one included.⁷ There's also a new Features tab in My Jetpack with an on/off switch for each feature, so it's easier to see what Jetpack is doing on your site.

The official AI connector is now in the plugin directory

The MCP Adapter, the WordPress project's own plugin for letting AI assistants such as Claude and ChatGPT work with a site, is now on WordPress.org.⁸ It's plumbing for developers and other plugins to build on, with no interface of its own. I wouldn't install it unless something you use asks for it.

For developers

WordPress 7.2 rebuilds wp_kses() on the HTML API, with a wp_kses_force_legacy_parser filter as a temporary opt-out, so test anything that leans on its quirks.⁹ It also switches off the NO_BACKSLASH_ESCAPES SQL mode when it connects to the database.¹⁰

Around the community

Automattic has applied for .wordpress

Automattic has applied to run .wordpress as a web address ending, like .com or .uk, in the first round of applications ICANN has held since 2012.¹¹ Only Automattic and its affiliates would be able to register names under it, so don't plan on yourshop.wordpress.

WooCommerce

WooCommerce 11.2 is out, and 11.2.1 fixes its checkout bugs

WooCommerce 11.2 arrived on 7 October with security fixes and a database update.¹² Two days later, 11.2.1 fixed two checkout problems that 11.2.0 introduced.¹³ On stores that remove address fields from the classic checkout, customers could be stopped with "Please enter an address to continue", tax could go uncharged or shipping options could vanish. The checkout block also rejected valid postcodes from Argentina and a few other countries.

So go straight to 11.2.1. Back up first, and place a test order afterwards. If checkout misbehaves, my WooCommerce checkout guide covers the usual causes.

Two changes in 11.2 could catch you out. Password reset, new account and email confirmation emails can no longer be copied to another address with Cc or Bcc, and any addresses you'd saved for those are ignored. And if you use PublishPress Future, update it to 4.10.4 or newer before you update WooCommerce, because older versions can crash a site on 11.2.¹²

Plugin security updates

Old Ninja Forms and WPC Product Bundles bugs are being used in attacks

Patchstack spotted the campaign on 4 October.¹⁴ The attacker fills in a form, or places an order on a shop running WPC Product Bundles for WooCommerce (about 30,000 sites), with code hidden in one of the fields. Nothing happens until an administrator opens that submission or order in the dashboard. Then the code uses their login to install a fake plugin called "WP Smart Thumbnails" and create new admin accounts, one of which is hidden from the Users screen.

Both bugs were fixed in September, in Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7. Both plugins have had more security fixes since, so update to the latest versions (3.15.5 and 8.7.4). Patchstack has only seen a small number of attempts so far, but it expects the same trick to turn up in other plugins.

If either plugin was out of date this week, look through your plugin list for WP Smart Thumbnails. Deleting it isn't enough, because the hidden admin account and a secret login link live in a folder the dashboard doesn't show (wp-content/mu-plugins). Ask your host or developer to check it, and see my hacked site guide.

Bricksforge is under attack too

Patchstack saw the first attempts on 7 October.¹⁵

This week's other fixes

If you use any of these, update:¹⁶

WPForms 2.0.2.2 fixes a small bug that only matters in an unusual setup, but it's on more than 5 million sites, so update anyway. Kirki (6.3.2) and Post SMTP (4.0.2) fixed bugs that only bite in particular setups. And if your site runs the Avada theme, 7.16.2 fixes six security issues, including one that let anyone set off WordPress's housekeeping jobs and permanently empty the bin.¹⁷

A lot of this week's smaller fixes are for the same sort of bug the attackers above are using, where code is slipped in through a comment or a form field. Relevanssi, Real Cookie Banner, Presto Player and LazyLoad all patched one, and the current version of each has the fix. If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.

For the long tail, Wordfence's report for 28 September to 4 October counted 501 new vulnerabilities across 367 plugins and 9 themes, up from 319 the week before.¹⁸

What I'd do this week

• Check you're on WordPress 7.1.3 under Dashboard › Updates.
• Using Ninja Forms or WPC Product Bundles? Update before you open any new submissions or orders, then check your plugin list for WP Smart Thumbnails.
• Running a shop? Back up, update to WooCommerce 11.2.1 and place a test order. If you use PublishPress Future, update that first.
• Update anything in the table you use, starting with LatePoint and PPOM.
• Tidy up old user accounts. If you find an admin you don't recognise, start with my hacked site guide.