#287 – WP 7.1.1, Attackers Actively Targeting Vulnerabilities, Community Members Say Goodbye To WP, LoopConf Returns

Issue #287 | September 9, 2026 | Reading time: 23 mins

Hello!

This week on The WP Week Newsletter, we cover the opening of the WordPress 7.1 release retrospective, several plugin vulnerabilities being actively targeted, LoopConf returning for 2027, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HostPapa and HireZoot

Modern WordPress Membership Plugin

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out →

Web hosting for growing businesses

24/7 human support Check it out →

Easy-peasy Recruitment Plugin

Create a career page and start recruiting talents in a few minutes Check it out →

🗣️TALK OF THE TOWN

WordPress 7.1.1 release schedule

WordPress 7.1.1 is planned as a bug-fix-only maintenance release, with several bug scrubs scheduled before RC1 on September 10 and the general release on September 17.

📰 WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

A WCUS 2026 conversation explored WordPress’s relationship with PHP

The discussion covered backwards compatibility, PHP version adoption, tooling, WASM, and closer collaboration with the PHP community. One key concern was that many in the PHP community don’t consider WordPress developers to be “PHP developers,” partly because WordPress’s long backwards compatibility commitments are seen as holding PHP back. The group also explored opportunities for WordPress to become more involved in PHP development, improve compatibility testing, encourage hosts and plugin developers to adopt newer PHP versions, revisit WASM, and contribute more directly to PHP Core.

WordPress 7.1 release retrospective: The WordPress 7.1 “Mary Lou” release cycle is now open for retrospective feedback, with contributors and observers invited to share thoughts on the processes, squad, and overall release cycle. Feedback is open until September 30, 2026, with a follow-up summary to be published afterward.
WP Accessibility documentation has been updated with new resources and clearer guidance: Rian Rietveld provided an update on the WP Accessibility documentation, covering new and updated documentation, an explanation of the accessibility-ready program, a sitemap for users with links to documentation and topics in the WP Accessibility Knowledge Base, and plans for September.
The WordPress Facilitator Training Program has completed its first five months: Destiny Kanno shared how the program has progressed since launching in April, including its first online and in-person pilots, feedback that shaped the program, Pooja Derashri taking over as lead, the courses and facilitation guides now available to facilitators, and plans for more workshops and campuses.
Runnable code examples are now live in the WordPress Code Reference: WordPress 7.1 introduces its first two runnable code examples, powered by WordPress Playground, allowing supported snippets to run directly in the browser, with more examples planned for WordPress 7.2.
Dashicons could be replaced in the admin bar and sidebar: The proposed change would use WordPress icons instead, addressing how icon fonts are handled by screen readers, user colour overrides, and font-loading failures, while feedback is being requested on the icon choices and mappings.
WooCommerce 11.1.0 is available now: It introduced performance improvements, native variation image galleries, and experimental video support for product galleries. The release also added an optional order withdrawal form for EU customers, cleaned up admin order details for virtual products, and included several developer-focused changes affecting block registration, editor assets, order item deletion, and WooCommerce Admin feature flags.
All-in-One WP Migration patches high-severity SQL injection vulnerability: The flaw allows unauthenticated attackers to plant malicious SQL that can be executed when a site administrator restores an archive. The vulnerability affects versions up to 7.109 and can be used to expose the plugin’s secret key and ultimately achieve remote code execution, potentially leading to a complete site takeover. A patched version, 7.110, has been released to address it.
Wordfence Argus finds unauthenticated arbitrary file upload vulnerability in Gravity Forms: The vulnerability makes it possible for unauthenticated threat actors to write files with attacker-selected extensions to a public temporary upload directory. This can lead to remote code execution. Users are advised to update to latest version immediately.
Attackers actively exploiting critical vulnerability in Super Forms plugin: A critical vulnerability affecting versions up to 6.3.313, allowed unauthenticated attackers to upload arbitrary files, including executable PHP files, potentially leading to remote code execution and complete site compromise. The issue was patched in version 6.3.314, but attackers began actively exploiting it shortly after disclosure, with the Wordfence Firewall blocking more than 250,000 exploit attempts. Users are urged to update immediately and check their sites for signs of compromise.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026): There were 246 vulnerabilities disclosed in 174 plugins and 5 themes.
Jetpack has released a critical security update addressing a vulnerability in its Import feature that has existed since version 12.0: Patched versions have been released across all affected branches, with most sites automatically updated to a secure version. The release also fixes two other security issues, and Jetpack says there is currently no evidence that the vulnerability has been exploited in the wild.
WordPress.com has added content guidelines for AI tools: The feature lets site administrators define guidelines for site purpose, audience, writing style, images, and individual blocks, which compatible AI tools use when generating content.
Automattic Transparency Report for January–June 2026: The report highlights the challenges of balancing user expression against content reports and legal demands, finding that government agencies had targeted thousands of WordPress.com and Tumblr sites, while only one of 123 EU illegal-content notices received by WordPress.com resulted in action solely because the content was illegal in a specific country.
Automattic has asked for a five-week deadline extension: The motion cites unsettled pleadings, pending motions to dismiss, and a compressed schedule requiring at least 18 expert depositions and two fact depositions within 20 business days. The proposed extension would not change the October 19, 2027 trial date.

🔧 TIP OF THE WEEK

Use wp_get_attachment_image() Instead of Building <img> Manually

Instead of:

<img src="<?php echo esc_url($image['url']); ?>"    alt="<?php echo esc_attr($image['alt']); ?>">

Prefer:

echo wp_get_attachment_image( $image[‘ID’], ‘large’);

WordPress can automatically generate:

srcset
sizes
width/height
loading attributes
decoding attributes

This is especially useful with ACF Image fields.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

LoopConf is returning in 2027 with a new attendee-funded approach

After losing its lead sponsor six weeks before the 2026 event and issuing full refunds, LoopConf is rebuilding as a 100% attendee-funded, attendee-focused event. It returns to Grand Rapids, Michigan, on June 16–17, 2027, with tickets going on sale September 8.

The Definitive Guide to Choosing an Enterprise WordPress Agency by Human Made: A guide for assessing enterprise WordPress agencies beyond their pitches, covering the capabilities, delivery practices, and long-term factors that can shape a successful partnership, along with warning signs, key evaluation questions, and a practical scorecard for comparing potential partners.
Jeanherline Santiago has been named the 2026 Kim Parsell Memorial Scholarship recipient: She has translated strings for the Polyglots team and volunteered and organized at WordCamps around the world, while remaining active in the global WordPress community through organizing, volunteering, and contributing at WordCamp events.
A hacked customer account was used to obtain paid plugin licenses: Danny van Kooten reported that someone behind WP Theme Bazar used a hacked account belonging to one of his customers, along with the customer’s payment method, to purchase several 25-site licenses and obtain the files for a paid plugin. The account owner was alerted by email notifications and contacted the team.
After nearly ten years of teaching WordPress and web design, Dave Foy is moving on to a new chapter: He is wrapping up his WordPress and web design education business to take a job teaching primary-school children to play in bands, while offering his remaining courses as downloadable archive editions in one final sale.
Suganthan Mohanadasan, co-founder of Snippet Digital and Keyword Insights, says goodbye to WordPress: He said he had moved his last site over and was officially done with WordPress after more than ten years.
Rodolfo Melogli wants to improve the “General” tab for his WooCommerce plugins: He is looking for design inspiration from other plugin developers because the tab currently lists the names, descriptions, and links of his installed plugins, each with its own sub-tab.
Updating a WordPress plugin readme now triggers a new release prompt: Steve Burge reported that updating a plugin’s readme file, such as changing the “Tested up to” value, makes the repository act as though a new release is about to be created, although nothing actually happens.
Imran Siddiq said he is done staying silent about his views: He reflected on the criticism he received over his views on Elementor, Bricks, WordCamps, and his experiences at WCEU and WCUS, saying he no longer wants to stay silent or be overly cautious about sharing his opinions.
Aditya Kane has relaunched his website: The site is in soft launch and includes a newsletter with two short emails a month about the WordPress world he is navigating. He is also asking visitors to report anything broken or point out anything worth following that he may have missed.
Equalize Digital’s X account has been suspended: Equalize Digital is a WordPress-focused company known for the Accessibility Checker plugin. Their COO Chris Hinds’s account too has been suspended.
Vibe Coding Survey by 20i: A survey of 600 non-developers by 20i found that AI coding tools are primarily being used to improve productivity, with many users having little or no previous coding experience. However, fewer than a third have their AI-generated code reviewed by a professional developer; 83.8% have encountered issues with it, and 20.5% say it has contributed to a security breach, while only 26% of organisations have a formal policy for AI-assisted coding.
Archive Pages Pro has been released publicly as DLX Plugins closes: Ronald Huereca has made Archive Pages Pro publicly available as part of the closure of DLX Plugins and its plan to open-source most of its paid plugins before the October 1, 2026 shutdown.
Introducing Divi AI Agents: Divi AI Agents have been introduced for Divi 5, providing a natural-language interface that can build and edit layouts, handle repetitive tasks, manage parts of WordPress, use website context and reusable commands, and access more than 220 skills for working with Divi and WordPress.
Elementor v4.3 beta release now available: It introduces official MCP support, allowing Claude, Codex, Cursor, and other compatible AI tools to connect directly to Elementor and build or edit native, editable Elementor structures. The release also expands Atomic Loops with filtering and alternate templates, adds global Default Styles, and more.
Accessibility Checker 1.49.0 is now available: The update introduces a new simplified Summary block and shortcode for manually placing simplified summaries in content, along with fixes for the translation-loading notice, Unicode-aware regex for ambiguous text, and more.
MemberPress introduces a shared Question Bank for building smarter quizzes: The new Question Bank lets users create, tag, and reuse questions across multiple quizzes from one shared library, with randomized question sets, centralized editing, retake options, and more.
FluentCRM 3.2.0 brings WhatsApp into your customer messaging workflow: The release adds WhatsApp campaigns, automations, and one-to-one conversations through Twilio or Meta Cloud API, alongside faster campaign sending, improved contact management, better email-building tools, FluentCart coupon automation, and so on.
Novamira Pro 1.9.0 is here: It adds Blocksy specialization, allowing AI to work with Blocksy sites by setting global design options, modifying individual page layouts, and building headers and footers. With Blocksy Companion, it can manage extensions, while Companion Pro adds support for creating Content Blocks such as hooks, popups, and custom templates.
Meta Box now supports WooCommerce HPOS: The new update now allows Meta Box fields to be stored in WooCommerce’s dedicated order tables instead of WordPress’s post and postmeta tables.
New milestone for WPConsent: The plugin now has over 200,000 active installations.
Logtivity will focus on activity logs and become part of PublishPress: Starting in September, Logtivity will focus entirely on activity logging for WordPress in the AI era, including identifying who or what makes changes and making activity data available to AI tools through MCP. The Logtivity name and branding will also be retired as the platform moves under the PublishPress brand, with the transition aimed for before the end of 2026.

🚀 NEW PROJECTS

“Behind every security statistic is a story from someone who experienced a real incident.”

Melapress about creating Wall of Security Stories.

Wall of Security Stories by Melapress: It is a collection of first-hand accounts where web professionals share their experiences with real security incidents, including the disruption, financial and time costs, recovery efforts, and lessons that followed.
AccessMate: A new accessibility plugin that scans pages against WCAG and Section 508 standards, identifies issues, and provides scores and guided fixes from the WordPress dashboard. It also includes optional AI-powered fixes, alt text, and explanations using your own API key, along with a visitor accessibility toolbar.
Show.fm: A new podcasting platform now in closed beta that brings podcast management into one place, covering guest booking, show notes, automations, hosting, collaboration, and social media content. It is built by Nathan Wrigley and Dan Maby, with tools designed to reduce the work involved between recording and publishing an episode.
xSpeed Cache: A new performance and caching plugin built by WPDeveloper that combines caching, optimization, database cleanup, CDN support, and other performance tools in one plugin. It also includes an MCP server for connecting AI assistants to benchmark and optimize WordPress sites.
Protuno: A new product from POSIMYTH Innovations designed to help agencies look after multiple WordPress sites. It offers a free read-only site audit, additional checks for connected sites, predefined playbooks for specific tasks, permission controls, verified backups, rollback measures, and run histories. Its Super Agents are designed to run scheduled playbooks, but are not yet live.
CartRules One Brand in Cart for WooCommerce: Developed by Rodolfo Melogli, the plugin ensures customers can only buy products from one brand at a time.
WordCamp World: A free, browser-based adventure game from The WP World that lets players explore a fictional WordCamp, meet people, collect items and stickers, discover hidden spaces, and take part in activities inspired by real WordCamp events.
Plogins Withdraw: The plugin by Mariusz Szatkowski adds full or partial EU right-of-withdrawal requests for WooCommerce orders, with an admin log and email notifications.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

Louise Towler joined Bud Kraus on Seriously, Bud? to discuss her unconventional journey into web development and WordPress, from a background in mathematics and scientific software to building an agency with long-term client retainers.
Aaron D Campbell conversed with Nathan Wrigley on WP Tavern Jukebox to discuss how AI is reshaping WordPress security, from faster and more complex attacks to AI-assisted defence, alongside supply chain threats, plugin security, and much more.
In this episode of the Melapress Show, Francisco Torres, of the WordPress Plugins Team, joined Robert Abela to explain how plugins are reviewed before reaching the WordPress.org repository, how the team handles security issues, ownership verification, and so on.
Matthew Telfer of 20i interviewed Barn2 co-founder and CEO Katie Keith about the company’s journey from a WordPress agency to an international software business, leading a remote team, and more.
On this episode of WP Product Talk, Imran Siddiq of Web Squadron joins co-hosts Matt Cromwell and Zack Katz to discuss what makes an effective website for a WordPress plugin or theme, covering product messaging, demos, Free vs. Pro offerings, transparency, and turning visitors into customers.
Lewis Menelaws covered the rise of WordPress and the events surrounding its conflict with WP Engine, including the disputes, lawsuits, mass resignations, and court intervention, while drawing parallels with similar conflicts in open source.
Brian Coords reflects on conversations at WordCamp US 2026 about how agencies and AI agents work with WordPress block themes, highlighting workflow and governance challenges and arguing that a clearer component system could help simplify the growing number of overlapping options.
Anne McCarthy is looking ahead to WordPress 7.2 and exploring how its various responsive tools can be brought together into a more coherent and connected experience, building on existing features for fluid typography and spacing, block visibility, and responsive styling.
Miriam Schwab shared insights from her WordCamp US talk on whether WordPress is ready for the agentic web, arguing that while core has the necessary infrastructure, the wider plugin ecosystem has been slow to build on it.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

WordPress PHP-only block registration: From CSS-Tricks
How to build a complete WordPress site with Elementor MCP and AI: From Ferdy Korpershoek
WooCommerce Add to Cart slow? Anatomy of the request no cache can save: From Shift64

📆 SAVE THE DATES

Do not miss a WordPress event ever again

WordCamp Kathmandu 2026 on Sep 18-19: The call for sponsors is now open. The tickets are also now available.
WordCamp Belgrade 2026 on Sep 18-19: The tickets are now available.
WordCamp Jinja 2026 on September 19th-20th: The call for sponsors is open. The tickets are now available.
WordCamp Rajasthan 2026 on 3–4 October: The call for sponsors is now open. The tickets are now available.
WordPress Accessibility Day 2026 on October 7th-8th: Interested folks can apply to be part of the Translation Team, and the schedule is now out. Sponsor applications are now open.
WordPress Day for AI Faro 2026 on October 24: The call for sponsors is open, and tickets are available.
WP Suomi 2026 on October 16: The call for sponsors is now open, and the tickets are now available.
Cloudflare Connect 2026 on Oct 19 – 21: Registration is now open.
WordCamp Canada 2026 on November 5-6: The call for sponsors is now open. The Contributor Day tickets are now available and the schedule has been published.
CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
CMS Conf 2026 on 12-14 November: The tickets are now available.
WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors and speakers is now open, and this year’s theme is WordPress and AI. The tickets are now available.
Enqueue 2026 on Dec 09: The early bird tickets are now available, and the call for speakers is now open.
WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
WordCamp Delhi 2026 on 12-13 Dec: The call for sponsors is now open, and the Conference Day Tentative Schedule is now available.
WordCamp Europe 2027 on 27 – 29 May: The event is in the early planning stages.
WordCamp Asia 2027 on April 9 – 11: The call for sponsors and speakers is now open.

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS

4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
15% off yearly plans at Videvo (Coupon Code – WPV15)

MORE DEALS

NordVPN Special Offer – Get up to 75% off + 3 extra months on the 2-year plan
Cloudways limited-time summer offer: 40% off on all hosting plans for 4 months plus unlimited free migrations.
Up to 50% off on BookingPress plugin
Up to 50% off on Paid Membership Pro plans.
Up to $100 OFF Essential Blocks PRO plugin.
50% off 3 months on Liquid Web’s Bare Metal server hosting
20% off for Constellation plugin
28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
33% off for the Uncanny Automator plugin.