The WordPress security team received 773 reports of security vulnerabilities in August, up from around 20-30 a month last year. The team starts to put some new limitations on what they will accepts via the HackerOne disclosure program.

This article from The Repository provides information about the new Accessibility Lab plugin, which will be a testing ground for accessibility changes before they are added to core.

WordPress 7.1 is available. I updated 12 sites without issue.

From the release notes: “An authenticated Author+ remote code execution issue via malicious file upload on sites that use Imagick and Ghostscript reported by the team at pwn.ai”

The field guide is a quick way to see what will be included in the upcoming release.

This is interesting, WordPress 7.1 will include a theme framework with CSS variables. It will be available for plugins to use for creating a consistent UI.

WordPress 7.1 will include browser-based media processing. The features supported are pretty extensive. This looks like it will be a nice feature that will have broad appeal.

Patchstack shares their observations about the wp2shell attacks. Attacks began 90 minutes after 7.0.2 was released. The way the vulnerabilities were exploited changed to by-pass early firewall rules that were rolled out.

WordPress security is always a sensitive topic. We recently got the WP 7.0.2 release and here’s an article that explains the exploits in more detail.