E164: Backdoor Plugin Update Caught, WPManageNinja Updates Tampered, Premium Plugin Open Sourced

This week on The WP Week Podcast, we cover WordPress Accessibility Day 2026, the upcoming WordPress 7.2 release and its new testing schedule, updates to the Presence API, and Gutenberg 24.1’s expanded design tools. We also look at WordPress.org’s move from HelpScout to FreeScout and WooCommerce moving its experimental Dual API into a dedicated plugin. In the community, we discuss WordCamp Asia 2027’s call for Wapuu designs, a new WooCommerce store defect study, GoDaddy receiving a takeover offer from Gen Digital, and a record 1,021 new WordPress plugin submissions in a single week. We also explore the growing challenges of maintaining AI-generated plugins and the latest AI-agent integrations for WordPress. Plus, we highlight new projects including WP Update Guard, Modular DS’s MCP server, Infinite Uploads’ AI-agent support, OpenStation, and more. Sponsored by: ProfilePress – Create membership sites and sell subscriptions on WordPress. HireZoot – Create a career page and start recruiting talent in minutes. AccessMate – Scan, understand, and fix accessibility issues without the complexity.

This week on The WP Week Podcast, we cover Automattic’s new board following the failed attempt to place Matt Mullenweg on leave, along with the release of WordPress 7.1.2, which addresses a critical unauthenticated path traversal vulnerability. We also discuss WordPress moving toward livestreamed release events, new Core release automation tools, Gutenberg’s migration from Jest to Vitest, and WordPress Playground’s new email inspection tools. On the security front, we look at critical vulnerabilities affecting Elementor and WooCommerce, a stealthy malware campaign using persistence techniques, and Wordfence’s latest report covering 358 vulnerabilities across 243 plugins and 4 themes. We also explore WordCamp Asia 2027’s plans for Contributor Day, the surge in new WordPress plugin submissions, Anne McCarthy’s fundraiser supporting Stimpunks, and several new AI-focused projects, including WP Update Guard, Delta, WPPilot, and Make My Site Agent-Ready. Sponsored by: ProfilePress – Create membership sites and sell subscriptions on WordPress. HostPapa – Web hosting for growing businesses with 24/7 human support. HireZoot – Create a career page and start recruiting talent in minutes.

This week on The WP Week Podcast, we cover Matt Mullenweg’s return as Automattic CEO amid a major board shake-up, the release of WordPress 7.1.1 with 11 security fixes, and the roadmap for WordPress 7.2, including the new Ipsum default theme. We also look at WordPress Playground’s new Terminal and Dev Tools, the proposed accessibility-ready approval process, the AI-Powered WordPress course, and WooCommerce’s first official block theme, Purple, now open for testing. On the security front, we cover critical vulnerabilities in Tutor LMS and libheif, along with Wordfence’s latest report covering 260 vulnerabilities across 207 plugins. Plus, we explore new AI-focused projects, Elementor’s MCP beta, Wordfence 9’s free passkeys, Yoast SEO reaching 1 billion downloads, and plenty more from the WordPress community. Sponsored by ProfilePress, HostPapa, and HireZoot.

This week on The WP Week Podcast, we cover the dramatic leadership shake-up at Automattic, with Matt Mullenweg briefly removed as CEO before returning just days later. We also discuss WordPress.org’s new automated AI-powered security reviews for plugin releases, the WordPress 7.2 release squad, and new developments around AI agents and WordPress Playground. Plus, we dive into the latest WordPress security threats, including an actively exploited WooCommerce vulnerability and a malicious payload detected in a plugin trunk, along with the findings from the 2026 Melapress WordPress Security Survey. We also look at WooCommerce’s proposed PHP 8.1 minimum requirement, WordPress community and education initiatives, plugin businesses, and several new AI-powered projects. Sponsored by: ProfilePress – Create membership sites and sell subscriptions on WordPress. HostPapa – Web hosting for growing businesses with 24/7 human support. HireZoot – Create a career page and start recruiting talent in minutes. Tune in for the latest WordPress news, security updates, community stories, and product developments.

This week on The WP Week Podcast, we discuss the controversy surrounding WPForms Lite 2.0.0, including claims that its setup wizard introduced backdoor-like functionality and the ongoing debate over administrator consent and WordPress.org guidelines. We also cover the WordPress 7.0.3 security release, which fixes 12 vulnerabilities, a new supply-chain attack affecting several BdThemes plugins, and how plugins can manipulate the WordPress Add New screen. Plus, we look at WooCommerce 11.0, WordPress 7.1 updates, the postponement of WordCamp Switzerland, new AI-powered tools, and other important community developments. A big thank you to our sponsors: 🎯 ProfilePress – Build membership sites and sell subscriptions on WordPress. 💼 HireZoot – Create professional career pages and start hiring in minutes. Tune in for your weekly roundup of the biggest WordPress news, security alerts, product updates, and community stories.