Checkout Files Upload for WooCommerce lets anyone upload PHP
Checkout Files Upload for WooCommerce accepts PHP files from visitors with no account. Check the accepted file types setting and update to 2.4.1.
What is happening
News
The vulnerabilities, new versions and changes that affect WordPress sites, and what to do right away.
Contact Form 7 flaw lets anyone upload files without login
Contact Form 7 6.2 to 6.2.3 lets someone with no account upload a file to the server through a form's file field. Check your version and update to 6.2.4.1.
What does the HTTP2Shell flaw mean for WordPress sites?
HTTP2Shell is a critical flaw in Brotli that reaches WordPress through the server. See who has to fix it, how to check your site and what to ask your host.
Rank Math SEO patches a flaw that let code run on the server
A flaw in Rank Math SEO up to 1.0.276 lets any account from Contributor up run its own code on the server. Check your version and your users, then update.
WooPayments releases a subscriptions fix for all versions
WooCommerce fixed a flaw in WooPayments' subscriptions code on every branch from 9.0 up. Check the version on your store and staging, then update to the fix.
CISA confirms attacks on a WordPress core upgrade flaw
A flaw in the WordPress core update process is now being attacked. Block the wp-content/upgrade folder and update to 7.1.4 or the fix for your branch.
Three flaws in ACF Extended, update to version 0.9.2.8
Three flaws in ACF Extended and ACF Extended PRO let a visitor with no account take over a site through a form. Check your version and update to 0.9.2.8.
GTM Server Side leaks customer orders, update to 2.1.48
A flaw in Stape's GTM Server Side plugin lets a stranger see other customers' orders, with their name, address and phone. Check your version and update.
Kirki flaw lets subscribers take over admin accounts
A flaw in the Kirki plugin lets any logged-in user, even a subscriber, take over an administrator account. Check your version and update to 6.4.0.
LiteSpeed Cache 7.9.2 fixes two flaws in page optimisation
Two flaws in LiteSpeed Cache let a visitor with no account plant a script through a comment. Check your version and settings, then update to 7.9.2 or later.
Prime Mover backup plugin has a critical 9.8 vulnerability
A Prime Mover flaw lets anyone plant an attack in a comment that fires when the site is exported. Check your version and update the plugin to 2.2.2 or later.
PHP2Shell, how to check and patch your WordPress site
PHP2Shell is the name for two critical flaws in PHP itself. See which versions are fixed, check your WordPress site and find out what to ask your host.
PHP critical security release on 21 October, check your site
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws. Check which PHP version your site runs and ask your host whether the fix is installed.
Stolen UpdraftPlus keys let attackers plant backdoors
Attackers are using UpdraftCentral keys stolen from TeamUpdraft to install a backdoor plugin on UpdraftPlus sites. Check your site, update and delete the key.
WordPress 7.2 Beta 1 brings a Secrets API and a faster admin
WordPress 7.2 Beta 1 came out on 20 October. See what it brings for site owners and how to test the beta on a copy of your site before 8 December.
WooCommerce payment plugins accept forged payment notices
More than ten payment plugins, most for WooCommerce, accept a forged notice that an order has been paid. Update your gateway and check orders against your bank.
Rank Math PRO 3.0.123 downloads shipped with a backdoor
Some copies of Rank Math PRO 3.0.123 downloaded on 15 and 16 October carry a backdoor. Check your version and the signs of infection, then move to 3.0.124.
Abandoned Cart Pro flaw lets attackers log in as an admin
A flaw in Abandoned Cart Pro for WooCommerce lets anyone log in as an administrator through a forged recovery link. Check your version and update to 10.8.1.
New Avada flaw exposes customer billing details to anyone
A flaw in Avada Builder lets a logged-out visitor read the admin's email and your customers' billing details. Check your version and update to 3.16.2 or later.
WordPress moves a step closer to real-time co-editing
Real-time co-editing is not planned for WordPress 7.2. See how far it has come, what it will ask of your server and how to try it on a staging copy.
Ghostscript flaw puts sites that accept PDF uploads at risk
A Ghostscript flaw lets a crafted PDF run code on the server. See whether your site makes PDF previews and ask whoever runs the server for the fixed package.
Avada flaw lets logged-out visitors delete trashed content
A flaw in Avada Builder lets a logged-out visitor permanently delete content from the trash through a form. Check your version and update to 3.16.2 or later.
Attackers target Bricksforge sites, update the plugin now
A flaw in Bricksforge lets anyone upload a file and run PHP code without a login. Attacks began on 7 October 2026. Check the version and PHP files in uploads.
Let's Encrypt moves to 64-day certificates in February 2027
From 10 February 2027 Let's Encrypt certificates last 64 days by default. See who has to do something and how to check the certificate of your site.
What does WooCommerce 11.2 change in store security?
WooCommerce 11.2 of 7 October 2026 tightens emails, downloads and shop manager rights. See what changes, what to check and how to update your store.
Hidden admin attack hits Ninja Forms and WPC Product Bundles
A campaign through Ninja Forms and WPC Product Bundles creates a hidden WordPress admin. See which versions are affected, what to check and how to update.
WordPress 7.1.3 release fixes seven security problems
WordPress 7.1.3 of 6 October 2026 fixes seven security problems and four bugs. See what the update contains, check your version and update your site.
WooCommerce will require PHP 8.1 or newer from version 11.6
WooCommerce 11.6, planned for February 2027, will require PHP 8.1 or newer. See your version in WooCommerce > Status and plan the PHP change in good time.
PHP 8.2 gets no fixes after 31 December, check your site
PHP 8.2 gets security fixes only until 31 December 2026. Check in Site Health which version your site runs and plan the move to 8.3 or newer.
WordPress 7.1.2 closes a critical flaw, update your site now
WordPress 7.1.2 closes a critical flaw (CVE-2026-87902) in all versions from 4.7 to 7.1.1. Find the fixed version for your branch and update your site today.
Chrome 154 now warns before opening a site without HTTPS
From 22 September Chrome 154 asks visitors before opening a public site without HTTPS. Check your site's certificate and redirect with one command.
2 critical flaws in The Events Calendar, update to 6.17.4.1
Two flaws in The Events Calendar allow code execution without an account on the site. Check the version under Plugins and update the plugin to 6.17.4.1 today.