The Exploit Needs an Administrator. You Have More Than You Think.
The flaw cannot be triggered by a visitor, a member, or an Editor. It needs an administrator, signed in, to open a link. So the length of your administrator list...
Read Article →ACF Not Working After the WordPress 7.1 Update? Here Is What Actually Changed
A page your coordinator edits every week looks different after the WordPress 7.1 update. Field groups being iframed is not what happened. The real change is that the escape hatch...
Read Article →Pantheon Removes Six PHP Versions on September 30
Pantheon retires six PHP versions on September 30. If your association site has run untouched for a few years, the risk is not the language version itself, it is the...
Read Article →Your Contact Form Plugin Shipped Four Security Releases Last Month
Forminator shipped four security releases in about four weeks, the last of them CVE-2026-18325, a stored cross-site scripting flaw Wordfence rated 7.2. The coverage has the classification wrong, and the...
Read Article →This WordPress Flaw Does Nothing Until Somebody Migrates Your Site.
A stranger leaves a trackback in September. Nothing happens until your agency exports the site for a redesign in February. Here is the chain, what is actually known about exploitation,...
Read Article →ACF 6.8.9 Changed Your Block Defaults. Nothing on Your Site Had to Change.
Nobody edited a template and nobody deployed anything, but ACF 6.8.9 changed what your blocks default to on WordPress 7.1. Here is what the release does, how to tell whether...
Read Article →Gravity Forms Was Patched on August 20. Free Wordfence Users Are Covered on September 12
A high-severity Gravity Forms vulnerability was patched on August 20. Free Wordfence users do not receive the firewall rule until September 12. Here is what that gap actually means and...
Read Article →WordPress 7.1 Landed Today. The Feature That Matters Most Is the One Nobody Is Talking About.
WordPress 7.1 brings per-viewport styling, a Table of Contents block, and the admin bar back to the editors. It also introduces a permissioned, revisioned knowledge system that is WordPress's answer...
Read Article →Seven WordPress Plugins Were Compromised Without a Single File Changing. Here Is What to Check.
Attackers poisoned a promotional data feed the plugins were built to request, so no plugin file changed and no update could have stopped it. Per Wordfence, rogue administrator accounts and...
Read Article →WordPress Shipped a Security Release on Thursday. Our Own Site Is Still Behind It.
WordPress 7.0.3 landed on 6 August with eleven security fixes, including a pre-authentication XSS on the login screen that can chain to PHP code execution. Pantheon deployed edge mitigation before...
Read Article →