The Pods team has released a security update and back ported it also to prior releases. They recommend updating ASAP.

From the release notes: “An authenticated Author+ remote code execution issue via malicious file upload on sites that use Imagick and Ghostscript reported by the team at pwn.ai”

This one in plugins from BdThemes. It is a different delivery mechanism. Plugin zips were not infected, instead the payload was delivered via an information page on site admin panel.

Patchstack shares their observations about the wp2shell attacks. Attacks began 90 minutes after 7.0.2 was released. The way the vulnerabilities were exploited changed to by-pass early firewall rules that were rolled out.

WordPress security is always a sensitive topic. We recently got the WP 7.0.2 release and here’s an article that explains the exploits in more detail.

WordPress 7.0.2 is starting to roll out. The on-site information says it is a security release, but the release notes and option to manually download are not available yet.

Atlant Security is a new, free, and comprehensive security plugin for WordPress. I was impressed by the extensive feature set and made a video. I do a walk-though so you can see what it offers.

WP Org plugin updates being delayed up to 24 hours for AI security scanning.