Issue #283 | August 11, 2026 | Reading time: 27 mins
Hello!
This week on The WP Week Newsletter, we cover a developer’s claim of a backdoor in the WP Forms Lite plugin, the WordPress 7.0.3 security release, how plugins can change what appears on the Add New screen, WordCamp Switzerland being postponed, along with new projects and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
🗣️TALK OF THE TOWN
He says that WPForms Lite 2.0.0, released three weeks ago and running on more than 5 million sites, added a backdoor through SetupWizard/Bridge.php. According to Waaijer, the code opens WPForms’ app on its servers and provides it with a one-hour login token for an administrator’s site during setup, allowing the app to install and activate plugins and enable the sending of form submissions to WPForms’ servers without asking or displaying a warning. He says the mechanism can install 13 WordPress.org plugins, as well as WPForms addons and WPForms Pro from WPForms’ own servers. Waaijer also claims the post’s authorship context includes Awesome Motive employing and having hired members of the WordPress Plugins Team. He also points to Awesome Motive employing and having hired members of the WordPress Plugins Team.
Community members have questioned whether “backdoor” is the appropriate term for the functionality. Marinus Klasen called the description “a bit far fetched,” while Marc Kranat argued that it does not fit the conventional definition because a logged-in administrator must trigger the setup wizard. Katie Keith also questioned the characterization and said the functionality should be tested to establish how the server-side setup process actually works. At the same time, Iman Zaker said the more important question was whether administrators clearly consent to the behavior, while Duane Storey questioned whether installing external resources this way could violate WordPress.org requirements.
The discussion also reached the #pluginreview Slack channel, where Drubonil raised questions about whether the reported functionality could install plugins or external ZIP files from a remote server and whether such behavior is permitted in the WordPress.org repository. The Plugins Team member Francisco Torres pointed to the repository guidelines covering executable code delivered through third-party systems, noting that some externally loaded and management-service functionality is permitted, but said the team had not yet analyzed the specific case and could not determine whether it qualified as a backdoor or violated the guidelines without reviewing it.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
The update addresses a range of security issues, including XSS, privilege escalation, SSRF, information disclosure, and an email confirmation bypass. The fixes were reported by several security researchers and organizations, including pwn.ai, Anthropic, and Aikido Security, and have been backported to supported WordPress branches.
- Upcoming changes in WordPress 7.1: The upcoming version will introduce a new public metadata flag for Abilities, giving developers a single way to indicate that an ability is intended for external clients such as the REST API, MCP adapters, and AI agents. It will also expand block styling with support for pseudo states initially for the Button and Navigation Link blocks and also introduce custom style states, initially for Navigation Links, and also responsive style states for blocks. Besides these, WP 7.1 will also extend wp_get_abilities() with a standard way to filter registered abilities, change the notify_post_author filter so that its return value now fully determines whether a post-author notification is sent, along with various editor changes too. The Field Guide is also now available.
- WordPress 7.1 changes admin post list table markup which could break plugins: The update resolves an 11-year-old Core ticket #32892 (opened by Web accessibility specialist and WordPress core committer Andrea Fercia) by moving the row header from the checkbox column to the post title, allowing screen readers to identify each row by the post’s title instead of a checkbox. The change affects post list tables across the WordPress admin, including screens that use the standard list table component.
- What’s new in Gutenberg 23.7: The release focuses mainly on editor improvements and bug fixes, including fixes for block positioning, Pullquote line heights, responsive previews, and writing-flow behavior. The release also improves the Gallery block’s dynamic mode by renaming “Convert to images” to “Detach” and adding an explanatory modal.
- WordPress education initiatives expanded their global reach in July: WordPress Campus Connect added new campuses across Bangladesh, Japan, Spain, and Uganda, while WordPress Credits saw its partner institutions grow from 28 to 38 across 16 countries, alongside increases in mentors, students, and graduates. The program also launched pilot projects in Latin America, began developing a developer-focused track, and prepared for its presence at WordCamp US, while Student Clubs continued supporting contribution-focused learning.
- WordPress Community Team will hold its first coworking session on August 13: The session will focus on the community team handbooks restructure proposal, with participants reviewing the audit work and moving it forward together. It will begin with a short kickoff, followed by focused work and a wrap-up, with the team planning to share a recap afterward.
- WordPress Plugins Team resolves issues affecting plugin releases and SVN access: The issue affected newly released plugin ZIP files, which were not being generated as expected, while some users also encountered problems accessing SVN. The Meta and Systems teams investigated the reports after plugin authors raised them on August 5, with ZIP generation fixed within the hour and an SVN fix subsequently applied and verified. The Plugins Team later confirmed that the issue had been fully resolved.
- WordPress accessibility documentation was centralized into a new knowledge base: The Accessibility Team spent the past year reorganizing, reviewing, and updating scattered accessibility resources, including refreshed theme accessibility-ready guidelines and a reorganized team handbook. The WP Accessibility Knowledge Base now brings together guidance on standards, testing, themes, content, and WordPress accessibility, with further updates planned before the documentation is moved to developer.wordpress.org.
- WordPress AI Team is discussing an AI trust ladder and structured content proposal: The latest AI contributor meeting covered an early-stage proposal for defining different levels of AI agent autonomy in WordPress Core, including how trust levels could determine which Abilities are exposed to an agent. The team also discussed an existing structured content and Abilities proposal, while Embeddings and Streaming support remain under testing and review.
- What’s new for developers (August 2026): Justin Tadlock highlights the changes coming with WordPress 7.1, scheduled for release on August 19, including responsive block styles, pseudo-state styling, the public SVG Icon API, an always-iframed post editor, updates to the Abilities API, admin design system support, and new theme tools. He also covers changes to WordPress Playground, React 19 being delayed again, and other updates developers and theme authors should test before the release.
- WooCommerce 11.0 has been released: The release brings performance improvements for stores with large catalogs and order histories, smarter guest checkout, and more reliable analytics reporting. The release also focuses on cleaning up the project backlog, with 551 PRs contributed by 89 contributors. Also, WooCommerce 11.0.1 dot release is now available.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026): There were 223 vulnerabilities disclosed in 176 plugins and 2 themes.
- Supply chain compromise in BdThemes ecosystem via Poisoned API response: It affected seven BdThemes WordPress plugins, in which attackers poisoned a remote JSON feed used for administrative promotional banners rather than modifying plugin files in the WordPress.org repository. The injected XSS could execute in logged-in administrators’ browsers, create rogue administrator accounts, install webshells, and establish backdoors, prompting the affected plugins to be temporarily closed while the WordPress Plugins team investigates.
🔧 TIP OF THE WEEK
Namespace Everything
Instead of:
function helper()
Use:
function wp_content_co_helper()
Avoids plugin conflicts.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
Marcin Dudek scanned 63,619 WordPress.org plugins and found 2,385 using hooks that can modify the results shown in the plugin installer, although most were using them for routine functions. His investigation found Meta Box and Slim SEO removing Secure Custom Fields from the Featured and Recommended tabs, while ThemeIsle’s SDK could place its own plugins ahead of WordPress.org’s featured results and displace others from the list. Dudek reported the findings to the vendors and WordPress.org’s plugin review team. The team said the behavior falls under existing rules against artificially manipulating search results and hijacking the admin dashboard.ThemeIsle changed its implementation after being contacted, while eLightUp initially defended the removal of Secure Custom Fields as an ethical decision but later agreed to remove the behavior after the Plugins Team asked it to do so.
- Announcing WP Future Conclave 2026: The Kerala WordPress Community has announced WP Future Conclave, a single-day open-source technology event taking place on September 5, 2026, at the Govt. Cyberpark Auditorium in Kozhikode, Kerala. The event will focus on WordPress and web technologies, with sessions covering AI, modern WordPress development, performance, accessibility, security, open-source sustainability, and business. Tickets will go on sale August 10, with attendance intentionally limited. The Call for Sponsors is now open.
- WordCamp US 2026 will close with a fireside chat on the state of open source: The session will feature Robert Jacobi (Chief Experience Officer for Blackwall) and Matt Mullenweg discussing the state of open source, including how WordPress is evolving alongside AI, changing user expectations, and developments across the web. The session will conclude with 30 minutes of live audience Q&A, covering questions and perspectives from attendees. The opening keynote for WordCamp US 2026 will be delivered by Bo English-Wiczling (Vice President of Global Developer Relations at PayPal).
- WordCamp Switzerland 2026 has been postponed: The event originally scheduled for 11th-12th September will now take place on 5- 6th March 2027. The venue remains unchanged.
- Anne McCarthy joins The PHP Foundation Board: McCarthy (Architect and Open Source Director for Automattic) joins the board as a platinum sponsor representative, bringing 15 years of technical and open-source experience, including 12 years at Automattic focused on the WordPress community.
- Jeff Starr removes Prismatic from the plugin repository: Prismatic lets users display code snippets using Prism.js, Highlight.js, or plain code escaping. Starr said maintaining the plugin had become very labor-intensive and that he needed to focus his time and energy on paid work. The plugin has now been moved to GitHub.
- Matt Cromwell analyzed 3,354 one- and five-star reviews across popular WordPress.org plugins to identify what most often drives customer frustration and satisfaction: The findings show that reliability, monetization, and support dominate one-star complaints, while ease of use, dependability, and strong support are the leading reasons users leave five-star reviews, with missing features accounting for just 2.5% of one-star reviews.
- Kinsta adds built-in Bot Protection to manage automated traffic: The feature offers four protection levels, Cloudflare bot scores, verified bot exclusions, AI crawler blocking, custom exceptions, bulk controls, and traffic analytics, with settings that can be applied per environment through MyKinsta. It is included with all plans at no extra cost.
- JnK Plugins found rank-tracking bots behind 62% of its Search Console impressions: In an analysis of three consecutive, non-overlapping weeks of Google Search Console data from a newly launched WordPress site, JnK Plugins found that rank-tracking bots accounted for 61.8%, 31.3%, and 17.2% of classifiable query impressions. The analysis identifies bot-generated queries through CSV fragments and other signals, examines how these impressions can distort impressions, average position, and CTR.
- Mercantile theme gets mixed reactions in a community poll: A poll by James Kemp on the new Mercantile theme drew 209 votes, with 31.1% saying they were not fans and 29.2% voting “Awesome! I love it”. Another 26.8% said they were unfamiliar with the theme, while 12.9% remained undecided.
- ACF 6.8.7 security release is now available: The release includes several security fixes for ACF and ACF PRO, including server-side validation for ACF Image and Gallery fields, protection for the path attribute of registered ACF Blocks, changes to the acf_encrypt() and acf_decrypt() helpers, restrictions on ACF form save handlers, WordPress read permissions for Post Object, Page Link, and Relationship field AJAX searches, and changes to User field REST API responses.
- Infinite Uploads has released a new image optimization feature: It now optimizes images at delivery, converting them to AVIF or WebP and resizing oversized images, with the optimized result cached on its CDN, while leaving original files unchanged and without storing extra copies. The feature applies to existing and new images, offers adjustable optimization settings and exclusions.
- GeneratePress is building a complete FSE toolset: The upcoming GenerateBlocks Pro 2.8 and GeneratePress Premium 3.0 updates add Global Styles, Design Tokens, and a new Template Engine, with query building and front-end filtering planned later this year.
- Modular DS expands vulnerability scanning and makes security alerts easier to prioritize: The update adds MySQL/MariaDB database scanning and severity scores for PHP vulnerabilities, while also improving how vulnerability data refreshes after fixes. Security notifications are now grouped across affected sites, with an option to receive only high-severity alerts, plus a new Patch & Protect connection warning.
- WPVibe adds GeneratePress and GP Premium Elements support: The update lets AI agents create custom headers and footers, announcement bars, and full-width landing pages while handling GeneratePress-specific settings and GenerateBlocks markup. It also includes three tested prompts for these tasks and verifies changes on the rendered site to catch configuration issues that can otherwise cause Elements to fail silently.
- Divi 5 adds Post Filter and Tooltip modules: The Post Filter module lets users search, filter, and reorder looped content through forms that can query post content, taxonomies, and custom fields. The new Tooltip module can be added inside other modules and offers controls for its content, style, and position, with support for nesting other modules and using tooltips in loops.
- FluentBoards 2.0 brings a redesigned interface: The update introduces dark mode, a refreshed dashboard and navigation, a new full-screen task view, quieter layouts across Kanban, Table, List, Calendar, and Gantt views, reorganized settings, expanded reporting, and a new profile overview. Existing boards, tasks, subtasks, comments, folders, and pinned boards remain unchanged, while the redesigned interface creates room for future features.
- SureForms 2.12.3 adds partial entry notifications and a security fix: The update adds an Entries shortcut to the Instant Form admin bar and allows email notifications when visitors save an in-progress form. It also improves WPML compatibility, patches a security vulnerability with hardening improvements, and fixes issues affecting entry search, database updates, form styling, Cloudflare Turnstile, payment history styles, field alignment, FluentCRM, and lost password emails.
- Novamira Pro 1.8.0 adds Weglot specialization: The new specialization lets AI configure the Weglot connection, set the original and translation languages, customize the language switcher, and control which pages are translated and their URLs.
🚀 NEW PROJECTS
| “After 8 years of WordPress development, the moment I still hate most is clicking “update” on a client’s live site.” Martin about creating Revertix. |
- Revertix: A new backup, staging, and migration plugin developed by Martin Valchev.
- Loupe Search: Developed by Per Søderlind, the plugin improves WordPress core search by maintaining its own index for fast lookups, supporting typo tolerance, phrase matching, basic exclusion operators, and per–post-type customization.
- InstaStudio: Developed by Vikas Singhal, it uses plain HTML files as the source of truth for pages, with a plugin rendering them as live WordPress pages. Built around InstaWP and AI coding agents, it supports an end-to-end workflow for building, visually editing, collecting feedback, resolving changes, and deploying sites without a page builder, block editor, or build step.
- Pheasantly: The plugin by Karol K allows users to set a recurring weekly publishing cadence and then schedule posts into the next open slot without calculating dates manually.
- Kujo: An AI-native programming language and toolchain by Robert DeVore built to make agent-driven software development clear, controlled, and verifiable.
- Bit CRM: An AI-based WordPress CRM plugin that lets users manage leads, contacts, companies, deals, products, and invoices from within WordPress. It also integrates with WooCommerce, syncing store data with contacts, deals, and invoices.
- SearchUs: A new search plugin by FunnelWon that provides relevance-ranked search across pages, posts, WooCommerce products, PDFs, and media. It offers features such as cloud indexing, customizable ranking, synonyms, and more.
- Ollie Pro has introduced Carousel Designer: The new feature lets users build carousels and sliders using blocks directly in the WordPress block editor. It supports premade carousel patterns, Smart Sync for applying design changes across slides, customizable navigation, autoplay and continuous scrolling, dynamic post carousels, responsive settings, and built-in accessibility features.
- YayReviews: A WooCommerce review management plugin that helps stores collect customer feedback through automated email review requests, with customizable templates and support for photo and video uploads. It also offers custom rating types, import tools for reviews from other platforms, and more.
- Uncanny Page Builder: An AI-first WordPress page builder powered by Uncanny Agent. Users can describe a page or provide a screenshot, and the agent builds and refines the layout, content, and styling using clean HTML and CSS. It also supports live content elements, brand styling, and draft-based editing without proprietary markup or lock-in.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- In this episode of Seriously, Bud?, host Bud Kraus talks with WordPress educator and YouTube creator Imran Siddiq about his journey in the WordPress space, his approach to teaching technical topics, and his work helping others learn WordPress. The conversation also touches on his web design business, YouTube channel, and upcoming WordCamp US trip.
- Jonathan and Luke speak with former WordPress executive director Josepha Haden Chomphosy on this episode of Crossword, about ecosystem thinking, long-term planning, and balancing competing interests. She also shares the three things she believes WordPress users will always want: security, speed, and ease of use.
- On this episode of WP Tavern Jukebox, Priscilla Collado Ramirez discusses why WordPress can feel overwhelming for beginners and how educators can make the learning process more approachable.
- Webhosting.today spoke with Patchstack’s Senior Product Marketing Manager Lana Rafaela and Hostinger’s Web Hosting Product Manager Arnas Donauskas about Hostinger’s default npm vulnerability scanning for Node.js applications. Since launching in July, the feature has flagged vulnerable dependencies on more than 10,000 customer websites.
- Matt Cromwell explained how he uses Cursor to create and refine reusable agent skills for marketing work. He outlined a three-tier approach based on skill complexity, explains how he tests skills using multiple agents, and shared his tool for turning recurring tasks into structured Cursor skills.
- Volodymyr C argues for using small, purpose-built WordPress plugins when a site needs a specific function rather than relying on large all-in-one solutions. He covers the maintenance benefits of fewer dependencies, simpler debugging, limited scope, safe behavior, clean removal, and clearer ownership of business logic, while also noting when a larger plugin remains the better choice.
- Maciek Palmowski reflects on how moving beyond the WordPress ecosystem changed the way he thinks about CMS platforms and their communities. That experience led him to organize CMS Conf 2026 in Gdynia, bringing WordPress, Drupal, TYPO3, and other CMS communities together.
- Paul Charlton of WPTuts on whether AI could replace WordPress, while discussing the challenges of maintaining AI-built sites over time. He looks at updates, security, changing APIs and payment gateways, and the difficulties of managing large numbers of AI-generated websites.
- Vito Peleg describes rebuilding his company’s WordPress marketing site in three days using Claude and Atarim’s MCP, without a page builder.
- Joel Olawanle from Kinsta examined how AI crawlers are changing traditional web-crawling behavior, with bots increasingly generating high-volume requests that can strain WordPress sites.
- Junko Nukaga visited Penang to scout the venue for WordCamp Asia 2027 and shares practical travel advice for attendees coming from Japan. Her guide covers flight routes, entry requirements, accommodation, local transportation, cashless payments, and more.
- Lawrence Ladomery argues that WooCommerce merchants do not necessarily need to move to a SaaS commerce platform as they grow. Responding to WP Engine’s partnership with BigCommerce, he says WooCommerce can scale with infrastructure built for high-traffic commerce, and highlights Urumi AI as an alternative designed to provide that scalability while retaining WooCommerce’s open-source flexibility.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- The easiest way to move from Wix to WordPress.com with ChatGPT: From WordPress.com
- How to build a WordPress contact form without a plugin: From Miriam Schwab
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp US, Phoenix on August 16 -19 2026: The tickets are now available, and the schedule has also been published.
- WordCamp Philippines 2026 on August 28-29: The call for sponsors is now open. The tickets are also now available, and Contributor Day registrations are also now open.
- WordCamp Jinja 2026 on September 19th-20th: The call for speakers, and sponsors is open. The tickets are now available.
- LoopConf 2026 on Sept 23-24: The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The call for sponsors and Wapuu Design is now open.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors is open. Also, interested folks can apply to be a part of the Translation Team.
- WordPress Day for AI Faro 2026 on October 24: The call for speakers and sponsors is open.
- WP Suomi 2026 on October 16: The call for sponsors is now open.
- Cloudflare Connect 2026 on Oct 19 – 21: Registration is now open.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and volunteers is now open. The Contributor Day tickets are now available.
- CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
- CMS Conf 2026 on 12-14 November: The tickets are now available.
- WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors and speakers is now open, and this year’s theme is WordPress and AI. The call for media partners is now open.
- WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
- WordCamp Europe 2027 on 27 – 29 May: The event is in the early planning stages.
- WordCamp Asia 2027 on April 9 – 11: The event is in the early planning stages.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer – Get up to 75% off + 3 extra months on the 2-year plan
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
WordPress 7.1 introduces a small but important accessibility improvement that changes the HTML structure of admin post list…
WordPress 7.0.3 has been released, addressing 12 security vulnerabilities across the platform, including a flaw that could allow…
WPManageNinja has disclosed a security incident in which an old server that remained connected to its plugin update…
WordPress Credits, announced at WordCamp Europe 2025, has published its first comprehensive analysis of student feedback since the…
Team WP-CONTENT.CO
Issue #284 | August 11, 2026 | Reading time: 27 mins
This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
Built with Newsletter Glue.