An update on automatic security reviews for plugins on the WP plugin directory.

The WordPress security team received 773 reports of security vulnerabilities in August, up from around 20-30 a month last year. The team starts to put some new limitations on what they will accepts via the HackerOne disclosure program.

If I was reading this correctly, the payload is planted using a ping-back. I wonder how many of these types of holes there are?

It looks like more vulnerabilities were found after the team patched Pods earlier in the mont

Konstantin Ryabitsev from the Linux Kernel team reports on their fight with AI bots. The current situation doesn’t seem sustainable.

Surprisingly there is nothing on the plugin page on WP org about Rank Math creating unauthorized admin access. I would expect that Rank Math would be suspended, at least until fixed, if not for longer. Roger Montti’s report helps to get the word out about this bad behavior.

These are both security releases to patch access control issues in the Design Library endpoints which were reachable without authentication.

The WPManage team is now digitally signing their plugins to close loops in possible supply chain attacks. They have also had an independent security audit by Patchstack for FluentForms. I appreciate seeing developers being proactive about security.

If you haven’t updated your Elementor Pro site to version 4.2.2 or greater then best to do so now. The vulnerability allows for a remote code execution, but requires Elementor Pro (not free) and a form widget with a file upload field. Details in the report.