WPandWoo – WordPress & WooCommerce News Hub

Blog

  • Elementor Pro flaw is being exploited — patch to 4.2.2 today

    Update Elementor Pro now. A critical flaw is being actively exploited in the wild, and the majority of installations are still unpatched.

    What the bug is

    Tracked as CVE-2026-32475 with a CVSS score of 9.8, the issue is an arbitrary file upload in the function that handles form submissions. That is about as bad as it gets: it leads to remote code execution.

    Who is affected

    • All Elementor Pro versions up to and including 4.2.1.
    • Patched in 4.2.2, released 19 August 2026.
    • Roughly two thirds of Elementor’s ~10 million installations were still running a vulnerable version as of 4 September.

    The free plugin is not affected

    This is a Pro-only vulnerability — it sits in form submission handling, which the free plugin does not ship. If you only run Elementor free, you are not exposed to this particular CVE. Check your version anyway.

    What to do

    Update to 4.2.2 or later today. If you cannot update immediately, disable Elementor Pro forms and audit wp-content/uploads for unexpected PHP files.

    Source: SecurityWeek.

  • WordPress 7.1 ships interactive states styling, Tabs and Playlist blocks

    WordPress 7.1 landed on 19 August 2026, and it is best understood as a “finish what we started” release: the styling and media work that slipped out of 7.0, plus a round of admin polish and two genuinely new blocks.

    Interactive states, without writing CSS

    The headline feature is interactive states styling. You can now set :hover, :focus and :active styles directly from the interface, on buttons and other elements, without dropping into custom CSS. For anyone who has been maintaining a stylesheet purely to colour a button hover, this removes a whole category of theme cruft.

    Per-device responsive styling

    Switch the editor to tablet or mobile view and any style change you make now applies to that viewport only. Responsive design finally behaves the way most people already assumed it did.

    Two new core blocks

    • Tabs — native tabbed content, no plugin required.
    • Playlist — audio playlists with waveform visualisation.

    Editor and collaboration

    The image editor has been rebuilt. Notes gains suggestion mode and emoji reactions, which makes asynchronous review considerably less painful. The command palette has been reorganised, the admin bar now persists across editors, and you can share a link to a specific revision.

    Should you update?

    Test on staging first, as always — particularly if your theme ships custom hover CSS that may now collide with the new interactive states UI.

    Sources: Roadmap to 7.1 — Make WordPress Core, WPBeginner.

  • Two more RCE bugs: All-in-One WP Migration and Forminator

    Two more remote code execution bugs worth your afternoon, both in plugins with very large install bases.

    All-in-One WP Migration — CVE-2026-19949

    A second-order SQL injection in the archive restore functionality, CVSS 8.8, exposing more than 3 million sites to remote code execution. ServMask shipped a fix in version 7.110 on 20 August 2026.

    Backup and migration plugins are a particularly attractive target: they run with high privileges and routinely handle attacker-supplied archives. If you keep one installed permanently for occasional migrations, consider deactivating it between jobs.

    Forminator Forms — CVE-2026-15748

    An arbitrary file upload in handle_file_upload, CVSS 9.8. Insufficient file type validation allows unauthenticated attackers to upload executable files.

    The pattern

    All three of this month’s critical WordPress CVEs — including the Elementor Pro one — are file upload or input validation failures in code that accepts submissions from the public internet. If a plugin takes uploads from unauthenticated visitors, it deserves a much closer look than the rest of your stack.

    Sources: SecurityWeek on All-in-One WP Migration, SecurityWeek on Forminator.

  • WooCommerce 11.1: variation galleries for every store, Store API up to 42% faster

    WooCommerce 11.1 arrived on 1 September 2026, and the standout change is one that quietly retires a plugin a lot of stores have been carrying for years.

    Variation galleries, for every store

    Variation galleries are now enabled for all stores by default. That means WooCommerce Additional Variation Images is being retired — you no longer need a separate extension to attach an image gallery to each product variation. If you have that plugin installed, plan its removal.

    The Store API got substantially faster

    Store API and REST requests are 30–42% faster in this release, with specific performance work on variable products and block registration. On a large catalogue with heavy variation use, that is a difference you can actually feel in the cart and checkout blocks.

    Also in 11.1

    • Product collection grid alignment improvements.
    • More accurate refund details in API endpoints.
    • Product CSV import improvements.
    • Experimental support for videos in product galleries.

    Coming from 11.0?

    WooCommerce 11.0 shipped on 4 August with 551 PRs — one of the largest releases in recent memory — focused on guest checkout, performance and backlog clearing, plus a batch of experimental developer features. If you skipped it, read both sets of release notes before updating production.

    Sources: WooCommerce 11.1 release notes, WooCommerce 11.0 release notes.

  • Gutenberg 22.7 lays the groundwork for AI publishing

    Gutenberg 22.7 is not an AI release in the marketing sense — there is no chat box bolted onto the editor. It is something more consequential: the plumbing that later AI features will run on.

    What actually shipped

    22.7 streamlines the editing workflow and aligns the block editor with AI adoption planned for WordPress 7.x. Notably, it introduces content guidelines aimed at standardising editorial voice across both AI and human contributors — an editorial governance feature as much as a technical one.

    The foundations were laid in 6.9

    WordPress 6.9 shipped the actual AI infrastructure: the Abilities API, MCP support, and a PHP AI Client SDK. That combination is what lets a model discover what a site can do and then do it, rather than screen-scraping wp-admin.

    Why it matters for builders

    If you build plugins, the Abilities API is the part to read first. Registering your plugin’s capabilities makes them addressable by any MCP-speaking client — which increasingly includes the editor itself. The plugins that describe themselves well will be the ones AI tooling can actually drive.

    Sources: Search Engine Journal, WordPress Developer Blog — AI.

  • Plugin Security Roundup – April 2026

    Several important plugin updates were released in early April 2026. Here’s what you need to patch immediately.

    Critical Updates

    • WooCommerce Subscriptions 8.6.0 – Security patches included
    • Yoast SEO – XSS vulnerability fixed
    • Wordfence Security – New firewall rules

    How to Stay Secure

    1. Enable auto-updates for trusted plugins
    2. Use a security plugin (Wordfence, Sucuri)
    3. Regular backups – daily if possible
    4. Monitor via vulnerability alerts
    5. Use strong passwords and 2FA

    Security Audit for Your Site?

    If you’re unsure about your site’s security posture, a professional audit can identify vulnerabilities before they’re exploited. Contact us for a security review.