Backuply and Klarna security fixes, a Ghostscript warning and 7.2 beta

A quieter week, with no new attacks on WordPress plugins that I've seen reported. If you skipped last week's updates, last week's issue is still the place to start.

This week's to-do list is mostly plugin updates. Shops using Klarna should update first, because its plugin was showing customer details to anyone who asked. And there's a server-level bug in Ghostscript, which WordPress can use to make PDF thumbnails, so it's worth a quick message to your host.

WordPress news

WordPress 7.2 beta 1 arrives on Tuesday

The first beta of WordPress 7.2 is due on Tuesday 20 October, with the final release on 8 December.¹ Don't put a beta on a live site. If you look after a site with a lot of custom code, try it on a staging copy over the next few weeks so there are no surprises in December.

Gutenberg 24.2 moves notes into the margin

Gutenberg 24.2 came out on 14 October.² Notes, the comments you can leave on blocks while editing, now sit in a margin beside your content, so you no longer have to close the settings sidebar to see them. Adding a category, tag or post to a navigation menu now takes one search. That only matters if you run the Gutenberg plugin. Everyone else gets these changes in 7.2.

For developers

Gutenberg 24.2 turns on React 19 by default, and feedback is wanted.² There's also a guide to the three sync engines being considered for real-time collaboration.³

Around the community

An admin accessibility fix has been pulled from 7.2

Changes that made the dashboard's admin notices more accessible have been taken back out of WordPress 7.2. The revert, committed on 14 October, says the change was premature because of the number of unusual notices plugins show in the dashboard.⁴

How it happened is what people are talking about. The Repository reports that Matt Mullenweg asked for the revert on the Trac ticket and removed the WordPress.org roles of Andrea Fercia, a core committer who has worked on WordPress accessibility for more than a decade.⁵ Whatever you think of the code, losing that much accessibility experience is a real loss for the project.

Eric Binnion

Eric Binnion, who spent 12 years at Automattic working across Jetpack, WordPress.com and WooCommerce, has died.⁶ For the next 30 days Automattic's servers are sending an extra "X-Remembering" header in his name.⁷

WooCommerce

Klarna for WooCommerce was leaking customer details

If your shop takes payments through Klarna for WooCommerce (about 20,000 sites), update to 4.13.4 now. Older versions printed an order's details into the "pay for order" page without checking who was asking, so anyone could work through your order numbers and collect customers' names, email addresses, phone numbers and postal addresses.⁸ The fix came out on 12 October.

Two paid WooCommerce extensions also had serious bugs. Abandoned Cart Pro for WooCommerce (10.8.0 and older) let anyone who'd received one of its cart reminder emails log in as any customer who had ever left a cart, admins included, and Email Customizer for WooCommerce Pro (3.9.5 and older) let any logged-in customer run code on the server.⁹ If you use either, check the vendor's site for an update.

Plugin security updates

I haven't seen reports of new attacks this week. If you use any of these, update:⁹

Backuply's bug only bites when you restore, and the fix is in the restore process, so update before you restore anything.¹⁰ My Calendar and MailOptin are the ones I'd do first, because both let a stranger take over the site without logging in.

Complianz (7.5.6), on more than a million sites, fixed three security bugs, the most serious of which only matters if you also use the YotuWP video plugin. Elementor fixed a bug that let contributors read other people's private and draft posts, and the current version (4.3.5) has the fix. Modula Image Gallery was showing the passwords for protected galleries to anyone who knew where to look, so update it to 3.0.13. Theme My Login fixed a serious bug that only affects multisite networks, so update it to 7.3.1. If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.

Ask your host about Ghostscript

Ghostscript is a program on many web servers that turns PDFs into images. WordPress uses it, through ImageMagick, to make a thumbnail when a PDF is added to the Media Library. Wordfence found a critical bug in it that can let a booby-trapped PDF run code on the server, and published the details on 12 October.¹¹

There's no plugin to update. The fix is Ghostscript 10.08.0, or a patched package from your server's operating system, so it's your host's job. Most sites aren't at much risk, because WordPress doesn't let anonymous visitors put files in the Media Library. The ones to check are sites with forms or plugins that add visitors' uploads to it. Send your host a quick message asking whether Ghostscript is patched on your server.

For the long tail, Wordfence's report for 5 to 11 October counted 655 new vulnerabilities across 406 plugins and 100 themes, up from 501 the week before.¹²

What I'd do this week

• Using Klarna for WooCommerce? Update to 4.13.4 today.
• Update My Calendar, MailOptin, User Profile Builder and Form Maker if you use them, then the rest of the table.
• Using Backuply? Update to 1.5.9 before you next restore a backup.
• Ask your host whether Ghostscript is patched, especially if visitors can upload PDFs to your site.
• Look after a site with custom code? Set up a staging copy ready for 7.2 beta on Tuesday. If an update does break something, here's how to fix a site after a bad update.