AdultZone

Archives

Gutenberg Times: WordPress 7.1 RC, 7.0.3 Security Release, Block Runner, New Playground UI and more — Weekend Edition 372

Hi there, It was another busy release week: the WordPress 7.0.3 security update, WordPress 7.1 RC 1, and Gutenberg 23.7 all landed. More on each below — but before you keep reading, update all your sites to 7.0.3 now. This newsletter can wait… If you are traveling to Phoenix: safe travels, and pack a sweater — the AC will be cranked up high in every building! This year, I will see you on the WCUS Livestream. Have a great weekend! Yours, Birgit Developing Gutenberg and WordPress WordPress 7.0.3 shipped as a security release fixing twelve vulnerabilities, so update your sites right away if automatic background updates aren’t already handling it for you. Release lead John Blackbourn lists the fixes, including a pre-auth XSS on the login screen that could lead to PHP code execution, several contributor-level stored XSS issues, and a multisite privilege escalation. Backports reach all supported branches down to 4.7, and 7.1 RC2 carries the fixes too. To appreciate the huge effort by the security team to get this release out, consider the numbers: until earlier this year, there were 20 to 30 reports per month; now that number has jumped to 450 per month. Both security updates, 7.0.2 and 7.0.3, were backported not only to the two officially supported versions, 6.9 and 7.0, but all the way back to version 4.7. That’s two dozen major versions that needed updating. See also Rae Morey’s story in The Repository: WordPress 7.0.3 Patches 12 Vulnerabilities as Bug Bounty Reports Climb to 450 a Month. August 19 is the scheduled final release date, and Benjamin Zekavica announces WordPress 7.1 Release Candidate 1 ready for your test sites. Since Beta 4, more than 145 updates landed — 57 in the Editor, 88 in Core — plus new features like the Icons API, shareable revision links, and email notifications for @mentions in Notes. Plugin and theme authors: wrap up testing and bump your “Tested up to” to 7.1. WordPress Playground lets you try it straight in the browser. Milana Cap counts more than 310 Core Trac tickets, twenty new hooks, and roughly 600 Gutenberg enhancements in the WordPress 7.1 Field Guide, your linked index of every dev note for the August 19 release. Highlights range from client-side media processing and the always-iframed post editor to the SVG Icon API, responsive block styles, and the persistent admin bar. A candid closing section covers what didn’t make it, from the Classic block’s reprieve to real-time collaboration and React 19. The post editor is always iframed in WordPress 7.1, and the escape hatch that let one apiVersion 2 block pull a whole post out of the iframe disappears. That’s the compatibility risk topping the developer’s audit list for WordPress 7.1 by release coordinator Benjamin Zekavica. He sorts each section by risk level, walks through the SVG Icon API’s strict sanitizer, responsive block styles, and the new DataViews filters, and closes with a checklist for your August 19 release. The latest episode is Gutenberg Changelog #133 – Gutenberg 23.6 Release and WordPress 7.1 The Gallery block’s ambiguous “Convert to images” button becomes “Detach,” complete with a modal explaining what happens — one of many refinements Jonathan Bossenger walks through in what’s new in Gutenberg 23.7. You’ll also find the Global Styles inheritance UI now opt-in via the Experiments page, LaTeX errors in the Math block waiting until you leave the field, and fixes for floated blocks overlapping sticky ones and Pullquote line heights in the editor. Plugins and Tools for #nocode site builders Variable product pages load roughly 9 to 12 percent faster and large stores get snappier Order screens, Brent MacKinnon reports in what’s new in WooCommerce 11.0. Analytics also grows more trustworthy: refunds now count in the period they happened, session counts exclude bots, and you can rerun incomplete historical imports. Guest customers can claim past orders when they create an account, and a Checkout Recovery beta lets you test messaging before a full rollout. Getting Site Editor changes out of the database and into version control has frustrated agency developers for years, and Brian Coords argues agents make it urgent again. His experimental agent-first approach to Create Block Theme, wp-theme-control, wraps the upcoming WP-CLI 3.0 wp block commands in bash scripts and an agent skill: a plan command lists database changes, then you dry-run, export them into your theme, and optionally clear the database copies. He’s collecting feedback ahead of his WordCamp US talk. Clients pinning comments straight onto your live pages — no logins, no email chains, no PDF round-trips — is the pitch of Ben Elwood‘s Reviso client feedback and approvals plugin. Among other page builders it’s native to the block editor, with threaded replies, status tracking, and review links that work even in maintenance mode. Version 1.5.2 switches on Suggest mode by default, so reviewers propose wording changes like tracked changes and your team applies them with one click. Bas Buis released Dynamic OSM Maps, a plugin that adds interactive maps without Google API keys or recurring fees. The lightweight block runs on OpenStreetMap and Leaflet: in the free version you enter addresses manually, while Pro connects your custom fields — coordinates, addresses, or repeaters — for unlimited markers and popups. That opens the door for directory and listing sites to render stored location data straight onto the map. Emily Rapport opens with Dutch tulip mania to frame the rush of llms.txt files and AI-visibility subscriptions, then does something rarer: shares a year of her own content work with real Search Console data. Her rewritten maintenance page climbed from position 50 to 13 and collected exactly five clicks — yet three inquiries arrived saying “I asked ChatGPT.” Her takeaway: publishing consistently across real topics beats chasing one niche, and you still can’t reliably trace an AI recommendation to a page. “Keeping up with Gutenberg – Index 2026” A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core

Matt: Toni on Verge

Toni Schneider, Automattic’s founding CEO, board member, and now CEO of Bluesky, has a great conversation with Nilay Patel on The Verge’s Decoder podcast (YouTube, Pocket Casts). Automattic invested in Bluesky back in 2023, and I’m very excited to see what they figure out in open social protocols.

WordPress.org blog: WordPress 7.0.3 release

WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support automatic background updates will begin updating shortly. For more information, please visit the WordPress 7.0.3 HelpHub site. Security updates included in this release The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release: Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec) Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team Enumeration of post slugs reported by HDWSec Disclosure of notes in comment feeds reported by Elio Gubser Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic Bypass of the email address confirmation flow reported by 0ways A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters Backports As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready. WordPress 7.1 RC2 has also been released, containing all applicable fixes. CVE and GHSA references Details of the login screen XSS vulnerability can be found in the advisory: CVE-2026-64638 / GHSA-52p2-r8wf-jcrf. Thank you to these WordPress contributors This release was led by John Blackbourn. In addition to the security researchers mentioned above, WordPress 7.0.3 and its backports would not have been possible without the significant contributions of the following people:Aaron D. Campbell, Aaron Jorbin, Adam Silverstein, adrianmoldovanwp, Aki Hamano, Alex Concha, Andrew Duthie, Andrew Serong, annezazu, Barry, Bernie Reiter, Daniel, Daniel Richards, David Biňovec, Dennis Snell, Ehtisham Siddiqui, Erwan Le Rousseau, Fabian Kaegy, fiocavallari, George Mamadashvili, gubser, Isabel Brison, Jarda Snajdr, Jb Audras, Jeremy Felt, Joe Dolson, Joe Hoyle, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Khokan Sardar, Lance Willett, lucasbustamante, lucatume, Marco Ciampini, Marin Atanasov, Mohammad Jangda, Mukesh Panchal, Paul Kevan, Peter Wilson, ramonopoly, SergeyBiryukov, vortfu, Weston Ruter Join us for the launch of WordPress 7.1 at WordCamp US 2026, August 16–19.

Matt: Our Core Division

Inspired by Automatticians James Kemp and Dave Smith, I’ve been thinking a lot about how much of our discord in the design of WordPress stems from the differences of our two big tribes: Bloggers and Builders. Many of the OG developers of WordPress, including myself, tend more towards the blogging side. Writers, photographers, podcasters, journalists, the people for whom a reverse chronological stream on the homepage is the most obvious thing in the world. We link out a lot, love comments, social features and think a lot about the editor as a writing environment. Builders are the site shapers, webmasters, the agencies, the companies, the content managers that think in a more page-first rather than post-first way. Tagging? Blogroll? Date-based permalinks? Who needs them. Give me custom fields, rich templates, a site editor, to craft beautiful sturdy pages that will stand the test of time. A store with a catalog of items where what changes is the inventory and ratings, not the content. The Builders right now dominate our core development discourse, which makes sense. They hold a lot of the economic share with merchants and rich websites. They’re also more loyal. The Bloggers love their WordPress as the place they truly own and call home, but Bloggers have an account on every channel where there’s an audience, they syndicate out with an ephemerality mindset, because that reader/listener/follower connection is the spark that keeps their flame alive. A Builder would never be a digital sharecropper on someone else’s domain. Dave Smith has been doing some very interesting explorations of a simpler site editor, and you hear his Builder bias around 3:20 in how obvious a static homepage as default seems to him. The good news is we can coexist as we have at least since WordPress 1.5. We just need to give a little more love to the Blogger side, there’s so much cool stuff we could do in the Fediverse with RSS, ActivityPub, ATProto, blogrolls (link manager is still in wp-admin!), pingbacks…