Podcast: Play in new window | Download | Embed
The Weeks Discussions:
Welcome back to Plugin Pulse.
WordPress Drama:
Matt stuffs both feet in and doubles down again
WordPress 7.1 shipped at WordCamp US. Some WP Rocket sites went white-screen. That part is a plugin compatibility miss, and WP Rocket owns it.
Then Matt posted “Did your rocket explode? Get a Jetpack.” The official WordPress account quoted WP Rocket’s “don’t update yet” advisory, said it wasn’t a 7.1 bug, told people to consider dropping WP Rocket, and used the same thread to warn the internet about trademark and GitHub accounts. That is the part that made this a State of WordPress story instead of a support ticket.
WordPress 7.1 dropped August 19, 2026. Within hours, hosts started seeing PHP fatals on WP Rocket sites.
The smoking gun is boring and specific:
August 21, Matt on his personal account:
“Did your rocket explode? Get a @Jetpack.”
August 22, official @WordPress — which Matt controls — quoted WP Rocket’s “don’t update to 7.1 until we ship a fix” post:
“Ouch, telling people not to update… this wasn’t a bug in 7.1. Perhaps consider your usage of @wp_rocket. This is also part of the risk of using plugins outside the official plugin directory, which has many alternatives that seemed fine on the 7.1 release day.”
WordPress 7.1 shipped at WordCamp US on August 19 and a slice of WP Rocket sites went down on a PHP 8 type error in the plugin’s Cloudflare compatibility file. The crash was sneaky: WP Rocket plus 7.1 often survived until a third plugin such as Elementor Pro walked in, and the bad code path ran even on sites that never used Cloudflare. A public GitHub report on July 6 had already named the file, the error, and a one-line fix. WP Rocket did not ship 3.23.2.2 until August 20, after telling users not to update core. Their later post-mortem put about 27 percent of their sites at risk and about 10 percent actually hit, and they owned the missed ticket.
That is the plugin failure. The State of WordPress failure is what came next. Matt posted “Did your rocket explode? Get a Jetpack.” The official WordPress account then quote-tweeted WP Rocket’s pause-the-update advisory, said this was not a 7.1 bug, told people to reconsider WP Rocket and shop the directory instead, and used the same thread for a trademark warning. Core ticket 65919 undercuts the cleanest version of that line: 7.1 changed hook callback IDs from strings to integers, and a fix is slated for 7.1.1. The community heard an echo of the WP Engine era — project account as attack dog and sales desk — while a quieter ticket, 65920, started work on automated plugin compatibility testing for 7.2.
WordPress News and Items:
POD next up for issues and fixed
https://www.reddit.com/r/WPDrama/comments/1vxzn13/another_critical_security_vulnerability_this_time/
r/WPDrama framed this the way that subreddit always does: another week, another critical in a plugin a lot of people treat as infrastructure. This time it is Pods, the free custom content types and fields plugin on 100,000-plus sites. Wordfence logged it as CVE-2026-19598, CVSS 9.8. Researcher Nhien Pham reported it through the Wordfence bounty on August 10 and collected $3,900. Unauthenticated request, privilege escalation, attacker can reach admin-level Pods functions and overwrite any user’s password, including the site owner. That is full takeover language, not a scary headline on a stored XSS. Wordfence later said it was already seeing tens of thousands of exploit attempts against the hole in a single day.
The technical root is an old Gutenberg compatibility shortcut that aged into a security hole. When the Block Editor arrived, Pods added a path so a meta-box error would log and keep going instead of killing the page. That same “just log it and continue” path could be hit by any request, so the plugin’s admin AJAX router kept running after login checks, nonces, and capability gates had already failed. Scott Kingsley Clark’s fix was small — always stop, don’t keep going — but the blast radius was not. He patched the current line as 3.3.9.1 and backported across five older majors: 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, and 2.8.23.4. The 3.3.9.1 drop was not one CVE. It shipped 16 security fixes from five researchers; the backports carried 13 each. He also pointed an AI scanner at the rest of the codebase and fixed what it found.
The Repository piece is the part worth lingering on for the show. Clark had to push emergency updates through WordPress.org’s Protect the Shire release hold, did not clock the Plugins Team’s first reply closely enough, and some patched branches sat in the queue while the clock ran. He said the code change did not scare him. What scared him was what else might be hiding, and what a few bugs like this would do to a maintainer with no spare bench. Quote he gave them: the lack of resources at Pods is nothing compared to the lack of resources most plugin developers have. Then he shipped, shut the laptop, and checked out for the night. Show note for listeners: if Pods is on the site, do not assume auto-update saved you — confirm you are on 3.3.9.1 or the matching backport for your branch. The drama subreddit will move on. The leftover 2.8 installs will not.
WordPress Best Practices:
Dont get married to one SMPT provider
Katie Keith at Barn2 woke up to Mailgun killing the whole account over a compromised API key, with no notice. That cut off Easy Digital Downloads delivery emails so customers who had already paid could not get the files. She asked the timeline a straight question: dump Mailgun for Postmark, or something else, and it has to cover transactional and marketing because Barn2 runs EDD receipts on one WordPress site and FluentCRM on another. Mailgun turned the account back on later that morning. The emergency ended. The “do we still trust this vendor with business-critical mail” question did not. ThemeGrill’s Rabin said Mailgun had permanently banned them after a compromise and would not talk. Alan Fuller pushed the other side: if the leaked key had account-wide write scope, shutting everything down is ugly but rational, and you should be sending off a sacrificial domain so the main one does not get burned.
The thread then split into two camps. Camp one: pick a boring specialist and split the stack. Postmark got the most “just works, high deliverability” votes — David Risley, ThriveDesk’s Parvez (millions of sends), Andy Griffiths — and Postmark itself slid into the replies. The knock on Postmark came from Dylan Pierce: bounce rules took him down, and he does not trust their trust-and-safety policies. He wishes he had gone Amazon SES from day one. Cloudflare Email got a look from Scott Buscemi and Parvez, then got boxed as beta, daily-capped, and transactional only. Mailpace got the same “cheap and reliable, receipts only” label; Axel Kee pointed marketing+transactional people at Bento instead. Camp two: one tool that does both. Brevo had real plugin-shop energy — Robin Pietersen and Daan van den Bergh both run transactional and marketing on it, Daan citing a dedicated IP and GDPR. Resend was the loud modern pick from product people: Andy Peatling, Mike McAlister, Aaron Lumsden, plus Matt Cromwell kicking the tires on Resend and Loop.so. Mailtrap offered a free migration month. Sequenzy, OneSignal, and SendGrid got drive-bys. Sidd said Brevo had pulled the same account-kill move Mailgun did.
The comment that actually belongs in the show is Jeffrey Behnke’s: stop marrying one ESP. He runs SendGrid, Mailgun, Resend, and Postmark behind a failover so a disabled account is an annoyance, not a storefront outage. That maps to Katie’s own setup. Two WordPress sites already. Two jobs — license delivery versus newsletters — that should never share a kill switch. Pros of the thread: Postmark and Resend for “mail that must arrive,” Brevo if you want one vendor and a dedicated IP, SES if you want to own the risk. Cons: Mailgun and sometimes Brevo will freeze you to protect their network; Postmark is not a marketing platform and its bounce policy has bitten people; Cloudflare and Mailpace do not replace FluentCRM. The consensus was not “use this logo.” It was “never let a leaked API key and one vendor’s abuse desk decide whether your customers get the product they paid for.”
Security Stuff:
Nice tip for Monitoring your sites
Pavel Ciorici over at WPZOOM dropped a useful one: if you want a site activity log and you do not want Simple History or Stream sitting on the dashboard like a second CMS, grab User History from the directory. It is free, it lives at wpzoom-user-history, and it watches the stuff you actually argue about later — content edits and deletes, logins, uploads, user and profile changes, settings, even WP-CLI wiping an auto draft. Filters by user, group, and event, optional IP logging if you need the paper trail, default retention around 30 days so the table does not grow forever. Same plugin also lets you lock an account, kick the session, change a username, and keep certain roles out of wp-admin. It is not a full SIEM and it will not page you at 2 a.m. It is the lightweight “who touched this page” log a lot of small sites never install until they wish they had.
Last minute entry
Give WP insure its updated
