Tips Tuesday – WordPress Security, Issues, and Updates
Tips this week include:
- New WP Core Security Initiative
- Better plugin audits coming
- WP 7.1 fatal flaws
- ACF and WP 7.1 issues
- Okay to update to WP 7.1
- WP 7.1.1 release date announced
WordPress Tips
New WP Core Security Initiative
I’m thrilled to see this!!!
WP is making a big effort to radically scale up the way they respond to the huge increase in security vulnerabilities found by creating a new Core Security Initiative.
They are taking what they call an ABC approach:
- A better release process – improved end-to-end testing
- Breaking the backlog – bringing in more folks to handle the tickets and reports of issues
- Crush vulnerabilities with AI – it’s faster with finding and helping correct issues
They are coordinating this across the in-house WP team, volunteers, and vendors.
This is one time that more cooks in the kitchen is a good thing and I am hopeful they will be able to find more problems before they can be exploited in the wild.
I’m also hopeful that it will make releases safer too instead of finding so many issues within days of a release and having to rush out new code.
Better Plugin Audits
And these upscaled efforts are not limited to just the WP core code.
Due to the increase in AI finding vulnerable code faster, WP has gotten super serious about doing deeper scans on the free plugins and themes in its repositories.
And that has revealed much more than hackable code.
It has also shown how some plugins make admin-level changes on our sites without consent.
You may recall that I recently reported on how WPForms is now adding 3 other plugins and giving 1 hour of admin access to your site. That was verified by one of their competitors.
But, the new WP scanning is revealing other admin-level access things that are somewhat similar.
They required RankMath to either pull or ask permission for their Support Agent that’s inside the plugin. It can create Application Passwords on the fly and share them with the plugin’s support – all without your consent.
RankMath chose to pull the “feature”.
WP 7.1 Fatal Flaws
There have been a few catastrophes with WP 7.1 updates, like this one with WP Rocket.
But, at least they owned up to the fact that they did see the crash reports, they just could not reproduce them and moved on.
Only about 10% of their user base was affected. But for those folks, a whole site crashing was a VERY big deal!!!
ACF and WP 7.1 Issues
If you use Advanced Custom Fields, you’ll want to see the comments on a recent Tips Tuesday that was left by one of my webmaster members.
Okay to Update
I believe it is now safe for us to update to WP 7.1. I sent word to my site audit clients and webmasters last week and so far, so good.
WP 7.1.1 Release Date Announced
WP 7.1 is working for most folks now, but there were a few minor bugs that needed some extra attention. And the WP core group jumped right on them.
The next minor release of 7.1.1 will roll out on September 17.
This should be an auto update for you.
