WooCommerce and WooPayments security fixes, and core attacks continue

Last week's WordPress security release is still the story. Attackers have now made more than 240,000 attempts on the bug fixed in 7.1.4, and the US cybersecurity agency has added it to its list of bugs used in real attacks. If any site you look after isn't on 7.1.4 yet, update it today.

It was a big week for shops too. WooCommerce 11.2.2 and WooPayments both had security releases, and WooCommerce explained how it's changing the way security fixes reach stores. And if your shop uses LiteSpeed Cache and you haven't updated it since mid-October, it could show some shoppers' details to strangers.

Attacks on last week's WordPress bug keep coming

240,000 attempts and a place on the official list

As a reminder, the bug lets someone take over a site in the few seconds a full WordPress update takes, by reaching a copy of the installer while it's being unpacked. Wordfence says attempts started on 28 October, the day 7.1.4 came out, and peaked on 30 October with more than 74,000 blocked in a single day.¹ Early this week CISA, the US cybersecurity agency, added it to its catalogue of bugs known to be used in attacks.²

Most of that traffic is bots hammering the same folder name on the off chance a site is mid-update, and the timing is genuinely hard to hit. A big number doesn't mean lots of hacked sites.¹ But it does mean people are trying, every day.

Updating is still the answer

Wordfence points out that updating from an older version runs the old, vulnerable update process one last time, but only for as long as the update takes. That's not a reason to wait.¹ Sites with automatic updates switched on should already be safe.

If you want to check a site, look in wp-content/upgrade for leftover files or folders, and check your plugins and admin users for anything you don't recognise. If your host gives you access logs, requests for PHP files in that folder (especially setup-config.php) are a red flag.¹ If you do find something, my guide to cleaning up a hacked WordPress site is the place to start.

Brotli: the attack works on WordPress, on the right server

Last week I said nobody had published a way to turn the Brotli bug into a break-in on a WordPress server. Wordfence has now done exactly that in its lab. Using the public attack code, it ran its own code on a test WordPress site without logging in, through WordPress's pingback feature. Once it updated Brotli on that server, the same attack stopped working.³

There's an important catch. The attack only worked on the exact server setup it was written for. On a server with a slightly different PHP version it failed, and in one case it just crashed PHP. So it's not a one-size-fits-all attack yet, but Wordfence thinks attackers could adapt it for common hosting setups. As of 2 November it hadn't found any public report of a real site being broken into this way.³

The advice hasn't changed: updating WordPress, plugins or themes doesn't fix this. Your host has to update Brotli on the server and restart anything that was using the old copy.³ If you asked last week and got a vague answer, ask again.

WordPress news

WordPress 7.2 beta 4 lets you choose which translations to update

WordPress 7.2 beta 4 came out on Tuesday. The change most people will notice is on the Updates screen, which now lists each available translation update separately so you can pick which ones to install, just like plugins and themes.⁴ The final release is still due on 8 December. As always, test betas on a staging copy, not your live site.

Every site is getting a /random/ address

WordPress 7.2 adds a new address, /random/, that sends visitors to a random published post. It also works with categories, tags and authors, so /random/category/news/ picks a random post from that category. It's on by default for posts but not pages.⁵

It's not harmless for every site, though. Each visit makes WordPress pick a post with a random database query, and the redirect is sent with headers that stop it being cached, so your page cache can't soak up repeat visits.⁶ On a site with thousands of posts that query gets slow, and anyone (or any bot) can hit the address over and over. Custom post types with their own archive are included by default too, which on a WooCommerce shop is likely to mean products.⁵ And it makes it easy for visitors to stumble on old posts you'd quietly stopped linking to.

You can change the word "random" under Settings › Permalinks, and a developer can switch the whole thing off with a single line of code.⁵ If you already have a page at /random/, your page wins.⁶ It's a fun touch for a blog. For a big site or a shop, I'd try it on a staging copy when 7.2 arrives and consider switching it off.

For developers

In 7.2 the admin menu and toolbar icons are now SVGs rather than the Dashicons font, so admin colour schemes and any CSS that restyles or hides core icons through ::before may need updating.⁷ Gutenberg 24.4 RC1 is out, and the official AI plugin 1.5.0 adds text-to-speech and MCP access experiments.⁸⁹

Around the community

Wordfence prices go up on 3 December

Wordfence Premium goes up to $199 a year per site from 3 December, with Care at $890 and Response at $1,900. Customers on older Premium pricing will see a 40% rise. You can renew up to a year before your licence expires at the current price, and discounts for buying several licences stay.¹⁰ Wordfence says the money is going into AI-assisted research to keep up with attackers who are using AI tools themselves.

Nexcess now sells Kadence, LearnDash, The Events Calendar and Give as one bundle

Nexcess has stopped selling Kadence, LearnDash, The Events Calendar and Give separately. They now come as a bundle from $350 a year for one site, and existing customers move to it when they renew. The first renewals start on 16 November with 30 days' notice, and existing Kadence customers and some licence types are exempt.¹¹ If you use any of these, keep an eye out for that renewal email.

Business and legal news in brief

Automattic and Matt Mullenweg have asked the court to send the two WP Engine customers suing them to individual arbitration, which would end the case as a class action.¹² And Awesome Motive, the company behind WPForms and OptinMonster, has bought the email marketing platform Drip and its popup tool Sleeknote.¹³ Neither changes anything you need to do today.

WooCommerce

WooCommerce 11.2.2 is a security release

WooCommerce 11.2.2 came out on Wednesday with several security fixes, and WooCommerce recommends updating as soon as possible. It tightens up the cart and checkout, API key logins, the product CSV importer and some admin connection settings, and it also fixes PayPal Standard not recalculating shipping and tax when the address changes.¹⁴

It includes a database update, so WooCommerce may ask you to run it after updating. Take a backup first. Developers should know that Store API checkout now stops with an error if an extension's code fails while the order is being saved, instead of carrying on with a half-saved order.¹⁴

WooPayments has a security fix too

WooPayments had a security update on Tuesday for the subscriptions features built into it. The latest version is 11.2.1, and there are fixed versions for older release lines too, such as 11.1.1 and 10.9.1. WooCommerce asks you to check the version under Plugins › Installed Plugins even if updates are automatic.¹⁵

Paid extensions can now install security fixes themselves

WooCommerce published a long post on Friday about its security work. Reports about Woo products have gone up roughly nine times in a year, and its own AI-assisted scanning is now finding more problems than outside researchers. Serious fixes will now come in their own small patch releases, separate from new features. 11.2.2 was the first, and 11.3.1 will follow next week's 11.3.0.¹⁶

The useful part for shop owners: from WooCommerce 11.2, WooCommerce.com can mark a paid extension's security release as required. If your store is connected to WooCommerce.com with an active subscription, it installs that update on its own, usually within a day, even with automatic updates turned off.¹⁶ I think that's a good change, and a good reason to keep your store connected.

Plugin security updates

I haven't seen reports of attacks on any of these, but if you use them, update:¹⁷

The LiteSpeed Cache fix came out on 20 October, in the version I recommended a fortnight ago, but the details were only published this week. With its default settings, it could cache a shopper's cart and checkout details and serve them to the next visitor.¹⁷ Popup Builder, Ninja Forms and SureCart also fixed their bugs in October, so plenty of sites will have these already.

Bugs in other popular plugins needed an account or an unusual setup, but they're worth updating too: Duplicator 5.1.0, CookieYes 3.5.8, EWWW Image Optimizer 8.9.1, MC4WP: Mailchimp for WordPress 4.15.0 (which stops visitors signing email addresses up to your other Mailchimp lists), TranslatePress 3.3.9, Optimole 4.2.18 and GiveWP 4.19.1.1.¹⁷

One older one: the premium theme builder YOOtheme Pro fixed a bug that let anyone run code on a site in version 5.0.53 on 21 October, and Wordfence added a firewall rule for it last week.¹⁸¹⁹ If you use YOOtheme Pro, check you're on 5.0.53 or later. If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.

For the long tail, Wordfence's report for 26 October to 1 November counted 549 new vulnerabilities across 351 plugins and 4 themes.¹⁹

What I'd do this week

• Check every site is on WordPress 7.1.4 under Dashboard › Updates, or the security release for its version, and look in wp-content/upgrade for anything left behind.
• Update WooCommerce to 11.2.2 and WooPayments to 11.2.1 (or the fixed version for your release line). Take a backup first, then run the database update if WooCommerce asks. If anything breaks, here's how to fix a site after a bad update.
• Update LiteSpeed Cache, ACF and Ninja Forms, then any login, booking or shop plugins from the table you use.
• Ask your host again about Brotli if you haven't had a clear "yes, it's patched".
• If you pay for Wordfence Premium, check when your licence renews, since prices go up on 3 December.