Podcast: Play in new window | Download | Embed
Good morning, good afternoon, good evening. I’m your host, John Overall. Welcome to Episode 24 of Plugin Pulse: WP Plugins A to Z Unplugged. The last two weeks have been a heavy stretch of releases. PHP dropped a critical security update that fixes two unauthenticated remote code execution flaws in the engine itself, and then WordPress followed with 7.1.4, a short-cycle security release that patches twenty-two different issues, including a race condition in the core upgrade process that can lead to remote code execution while an update is running. We’ve got the lowdown on both, plus the usual dashboard briefing. And stay tuned later in the show — we’ve got some big news about the future of WP Plugins A to Z.
Remember you can Join me Live on Show-days, every second Friday at 12 pm PDT by going to https://wppluginsatoz.com/live and clicking the link to this shows Google Meet Link which goes live at showtime.
If you’re listening to me on YouTube, remember to like and hit the bell to subscribe and get a reminder of when I am here.
You can also join me Sundays at 7PST on Tavern Talk at the Rogues Oasis — where the fire crackles, the ale flows, and straight talk cuts through the night like a rogue’s blade at the Devil’s Crossroad.
We’re back, friends — raw, unfiltered conversations rooted in the wild trails of Vancouver Island and the timeless fight for self-reliance. From homesteading grit and pantry wisdom to the inner wilderness of faith, soul, and everyday storms, we pull up a stool with real talk that arms you for the days ahead.
Live to tape every Sunday ay 7pm PDT
Pull up a chair, grab your mug, and join the fellowship. The door’s open — let’s talk truth.
The Weeks Discussions:
1. Another week gone and another security update from WordPress https://wordpress.org/news/2026/10/wordpress-7-1-4/ add some info context from this. Also add some context from this https://x.com/WPSecurityNinja/status/2115718140650754171
Official release
WordPress 7.1.4 shipped on 28 October 2026 as a short-cycle security release (Aaron Jorbin, with Nik Tsekouras). Next major is still 7.2, targeted for 8 December.
It fixes 22 vulnerabilities. Official line is the usual: update immediately. Auto-updates handle it for sites that have them. Backports are going out for every branch still eligible for security fixes, all the way down to 4.7 (e.g. 7.0.8 has all 22; older branches have fewer). Only the latest version is actively supported — 4.6 and earlier get nothing.
The one that matters most (the upgrade-window RCE)
The standout is an unauthenticated race condition / TOCTOU in the core upgrade process that can lead to remote code execution during the brief window while an update is running. Reported by Umut Bayram (Picus Security).
How it worked (pre-7.1.4):
-
Full-package core updates unpack into wp-content/upgrade/ with a predictable folder name.
-
A cleanup step deleted the index.php that normally blocks directory listing.
-
For a few seconds the staged copy (including wp-admin/setup-config.php) was web-reachable.
-
An attacker who hit the exact window could interact with that staged installer and progress toward code execution (no account required).
The vulnerability dates back to roughly WordPress 2.8 and reappears on every full-package update, including automatic background ones. Patchstack rates attack complexity high and calls it impractical to exploit in practice because of the tiny window. Wordfence lists it as CVSS 8.1 (High). Scanners started probing almost immediately after release — Wordfence reported tens of thousands of attempts in the first day (one figure cited 18,500+ in 21 hours, another higher). No widespread confirmed successful compromises are being reported.
The fix: randomize the extraction folder name (16 extra characters), recreate and keep index.php, and additional hardening so a staged wp-config.php doesn’t get copied out.
WP Security Ninja’s post (29 Oct) zeroes in on exactly this: “One fix in WordPress 7.1.4 matters during the update. A weakness in the upgrade process can lead to remote code execution. Update, then confirm you landed on 7.1.4.”
The rest of the 22
Most of the others require a logged-in account, usually Contributor+ (the lowest role that can write posts). Heavy concentration in the Interactivity API (multiple stored XSS and a stored DoS), plus:
-
Stored XSS via crafted block markup / whitespace in block delimiters
-
Stored XSS in Privacy Data Removal Requests (Anthropic)
-
Stored XSS in Customizer selective refresh, Categories block, Playlist/Image blocks, Comments pagination blocks
-
Information disclosure of unpublished Customizer changesets to unauthenticated visitors
-
Permissions issue letting certain custom roles that can moderate comments read/edit/delete Notes on posts they can’t edit
-
Hardening of unescaped usernames on multisite Network Users screens (also Anthropic)
-
Update to bundled root certificates because of the eMudhra CA revocation (Chrome pulled trust on 27 Oct)
Anthropic appears in the credits again (fourth straight release cycle).
Broader context
This is the seventh core security release since mid-July and the fourth since 7.1 launched. The Repository notes the project has patched more than 50 vulnerabilities in that span, with releases every couple of weeks. HackerOne volume remains elevated (2,306 reports in the prior 90 days versus the long-term 20–30 per month baseline). Ties directly into the Core Security Initiative / report-flood discussion from earlier episodes.
Security vendors (Wordfence, Patchstack, Imunify360, etc.) pushed rules and mitigations quickly. Practical advice circulating: update, then verify the version actually landed; deny web access to wp-content/upgrade/ at the server level as defense-in-depth; review who has Contributor-level access.
2. And this coming on the heels of the PHP update last week https://www.php.net/archive/2026.php#2026-10-21-5 the lowdown on it all. what it means for you as a developer and site manager. If you run your own servers
PHP2Shell (the PHP security release of 21 October 2026)
This landed a week before WordPress 7.1.4. Two separate layers, both critical, neither replaces the other.
What shipped
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These fix two critical vulnerabilities (collectively called PHP2Shell):
-
CVE-2026-109618 — RCE via OOM (out-of-memory) corruption. Hitting memory_limit at the wrong moment can interrupt request initialization; cleanup then treats partially-initialized internal data as valid.
-
CVE-2026-109619 — RCE via stale global state. Request-owned internal state can survive after its memory is freed; a later request on the same worker can use that stale state before normal initialization resets it.
Both are rated CVSS v4.0 9.2 (Critical). Both allow unauthenticated remote code execution. They live in the PHP engine itself (memory handling and fatal-error paths), not in any application. Vulnerable code goes back roughly to PHP 5.4.
Risk is highest on Apache mod_php (an unauthenticated request can trigger the attack before any application code runs). Also affects PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. CLI is not in scope.
Who is affected and what to install
|
Branch
|
Fixed version
|
Notes
|
|---|---|---|
|
8.5
|
8.5.12
|
Active support
|
|
8.4
|
8.4.27
|
Active support
|
|
8.3
|
8.3.36
|
Security fixes only
|
|
8.2
|
8.2.35
|
Security fixes only — EOL 31 December 2026
|
|
8.1 and older
|
No official release
|
Minimal source backports provided for 7.4 / 8.0 / 8.1; rely on distro/LTS vendor or upgrade
|
PHP’s own line: “There are no complete mitigations, updating is the only safe choice.” Temporary reductions in exposure exist (set memory_limit=-1 in a way apps can’t override, lower post_max_size, disable session.upload_progress.enabled, etc.), but they are incomplete.
Timeline and real-world status
Details leaked on 20 October (CVE IDs circulating with a wrong release date and inflated CVSS). PHP accelerated the release by a day. Exploitation attempts were observed before the coordinated release (Amazon honeypots saw activity on 17 October; Cloudflare reported early attacks on the 21st). CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 26 October.
Wordfence (as of 28 October) reported tens of thousands of related requests across the sites it protects but no confirmed WordPress compromises attributed to these bugs. Researchers (Wiz and others) demonstrated RCE against vanilla WordPress/Drupal/Joomla container images in lab conditions. The practical takeaway remains: the bug is below the application, so WordPress updates, plugins and in-application WAFs do not stop it.
What it means if you run your own servers
-
Update the PHP binary/packages to one of the fixed versions above and restart the PHP workers (FPM pool, Apache, etc.). The running process keeps the old code until you do.
-
Check every place PHP is installed (web pools, CLI, Docker images, staging, cron environments). An old container or a leftover 8.1 pool is still vulnerable.
-
PHP 8.2’s last security release is this one. Plan the move to 8.3 or later before 31 December.
-
On 8.1 and older you are dependent on your distribution or an LTS vendor for a backport; otherwise you are unsupported.
-
After updating, confirm the version with php -v (or the Site Health → Info → Server screen in WordPress) and that the worker processes actually restarted.
-
Server-level controls (request size limits, WAF rules in front of PHP, denying directory listing, etc.) buy time but are not a substitute for the patch.
WordPress Drama:
No real drama if you do not count the recent security releases for PHP and WP core
This Shows Featured Promotion
Every show I will be promoting a premium plugin or service I think might be useful for everyone. There is no affiliate links to them unless mentioned. This is just to bring more attention to underknown premium plugins or services that I believe can be of benefit.
This week the Feature is:
Toggle WP
The Lowdown:
How ToggleWP Helps
-
On-Brand AI Upsells: Deploy a high-end AI writing assistant directly in the client dashboard, allowing you to charge a premium for “AI-Enhanced” maintenance tiers.
-
Zero-Cost Fulfillment (BYOK): Use your own API key to provide advanced content tools with no monthly markup, keeping 100% of the profit from your client subscriptions.
-
Done-With-You Content: Reduce the time spent drafting blogs or social snippets for clients by 80%, increasing your hourly effective rate.
-
Feature Lock-In: Create a “sticky” workspace that makes it nearly impossible for clients to leave your care for a budget host that lacks these tools.
The Maintenance-Focused Freelancer
How ToggleWP Helps
-
Plugin Control: Hide essential plugins from client admins (so they can’t accidentally deactivate your security or backup plugins, or enable auto updates)
-
Plugin Activation / Deactivation Notifications: Get instant alerts when clients make plugin changes
-
SEO Warnings: Visual warnings prevent “oops” moments like blocking indexing on a production site
-
Staging Site Warning: Remind clients not to update live site content while you are working on staging with notices on the login screen / after login
-
Reminders: Track renewal dates for domains, annual subscriptions or premium licenses with email notifications before expiry
The Boutique Hosting Provider
How ToggleWP Helps
-
Login Monitoring: Track admin logins with IP/country detection, spot suspicious access patterns across your portfolio
-
Admin Notifications: Automated email system sends you monthly last login reports and instant alerts for unusual logins
-
Session Management: Force logout inactive sessions, limit admin user sessions to 1 hour
-
Media Management: Clients can organise their media uploads with custom categories and tags, allowing easy filtering from the Insert Media screen
-
Reminders: Track renewal dates for domains, annual subscriptions or premium licenses with email notifications before expiry
WordPress News and Items:
wp checkout summit 2027 https://x.com/rmelogli/status/2110300545860694232
Checkout Summit 2027 is happening again, organized by Rodolfo Melogli of Business Bloomer as the independent, in-person conference specifically for WooCommerce makers. Dates are April 28 through May 1, 2027 at the Saracen Sands Hotel & Congress Centre in Palermo, Sicily. This year’s focus is practical marketing and sales strategies that actually work for WooCommerce products, plugins, services, and agencies, drawing on real case studies rather than theory. It stays small and focused (around 150 people, single track, roughly 12 talks plus workshops and networking), deliberately without livestreams or recordings so people can speak more openly. Early-bird tickets are currently on sale, and Rodolfo recently opened hotel booking directly in the attendee dashboard so ticket holders can pick rooms with photos and live availability (starting around €80 per night including breakfast).
The call for speakers is open, with an honorarium of up to €1,000 for selected talks. Rodolfo has already published a public wishlist of people he’d like to hear from on stage (folks who have grown real WooCommerce products or agencies) while inviting anyone else with proven experience to pitch. It’s not affiliated with Automattic or WooCommerce itself, though the platform was a major sponsor of the 2026 edition. For plugin and product people who want the room full of other people building and selling in the same space, it’s one of the few dedicated IRL options on the calendar.
WordPress Best Practices:
Coding Tips:
A robots.txt file sits at the root of a site and gives compliant crawlers instructions about which paths they may request. The guide covers the basic syntax: comments start with #, sitemaps are declared with absolute URLs, User-agent (case-insensitive) selects the crawler or uses * for everyone else, and Disallow / Allow (case-sensitive relative paths) control access. Everything is allowed by default; an explicit Allow creates an exception to a broader Disallow. Common uses include keeping generated pages (search results, sessions), duplicate URLs, and private areas out of crawlers. It also shows a practical pattern for opting out of AI training while still remaining eligible for AI search results: block the major training agents (Google-Extended, GPTBot, ClaudeBot, Meta-ExternalAgent, MistralAI-Training) with Disallow: /.
The same page is careful about the limits. robots.txt only affects crawling efficiency for well-behaved bots; a page can still be indexed if other sites link to it, and malicious or non-compliant crawlers simply ignore the file (or use it as a map of what you tried to hide). For stronger per-page control the guide points to the robots meta tag (<meta name=”robots”>) or the X-Robots-Tag HTTP header. It also lists common search-engine, AI, and open-source crawlers and notes that some (including Grok and certain Chinese models) are not transparent about their identity. In short, robots.txt is a useful, widely respected request system, not an access-control or de-indexing mechanism.
Tip of The Day:
Satirical game on the realities of running a plugin business [FREE]
Link straight to the Game https://pressword.games/games/install-clicker/
Warning it’s mildly addictive…
Upcoming Interviews and Available times:
Reminder that we have no more interviews coming up but you can check out the past ones here https://wppluginsatoz.com/book-an-interview-on-wp-plugins-a-to-z-podcast/
Upcoming Interviews: None
Available interview dates: None.
We are also no longer accepting plugins for review.
Other Shows and places to get WP Info & Training
The WP Builds Podcast
WP Roads
WP-Tonic
Worlds Worst Web Developer
WP Mayor
wp Minute
The WP Week newsletter
Kitchensink WP
Final Fairwell
Okay, at this point I need to talk about what’s happening with WP Plugins A to Z the longest running WordPress Podcast. We’ve reached the final countdown. The show has been magnificent over the years. I started it back in 2009, just after the birth of my youngest son. My oldest was just over two, and you can hear his little evil cackling laugh at the end of every show from the beginning.
After all these years and iterations, I started by myself. For several years I had a co-host, Marcus Couch, and we were fantastic. Life changes forced us to go our own ways. Because it was my property, I took it and continued on a new path for a few years. I brought on an additional guest, Laura, and she lasted about a year or two. Then I went for a few more years by myself until we finally found our footing when my daughter Amber came on the show about four or five years ago. Unfortunately, life changes are in the way again. She had to leave the show this past summer due to health reasons, and that has put an additional burden on me to keep it going. The magic is no longer there. It’s becoming more of a slog, and unfortunately it just can’t be done anymore.
I am going to continue the show out to the end of the year. We’ve got four shows left after this one — two each month in November and December — with the final one released on Christmas morning. That will not be a live show; it will be pre-recorded. I’ll see if I can grab a couple of voices from times past to showcase what’s been done, and we’ll make it a good finale so everyone can close out the end of an era.
The WP Plugins website and the rest of it will remain. Sometime in the near future there will be a store in place for the purchase and downloading of plugins that never quite make it to the repo, for whatever reasons — because they’re not allowed, or because they don’t like them. That would include any plugins I’ve been writing that I want to release there, outside my GitHub. There’s lots that’s going to happen in that aspect. WP Plugins will be around, and we’ll continue on X sharing news and information. The WP Plugins A to Z team will remain in the WordPress community, occasionally poking fun at the bear. But this platform here, as far as I go, we’re shutting it down.
I’m not stopping podcasting. You’ll find me in another realm. I’ve started a new podcast, the Tavern Talk Podcast, which is a godcast, and you’ll find it very relevant if you’ve got other things going on in this world. You can find that over at The Rogues Oasis, a site for people looking to make really good food for themselves, find quality local products if you happen to live on Vancouver Island and in BC, and lots of other great stuff.
I’ll be making an announcement like this on every episode to the end of the year. Thank you everyone for 17 years of listening. And for those who joined in the last few years, thank you very much. It’s been a pleasure, and it helped give me the energy to move this forward and bring it to where it’s at now.
With that being said, we’re going to close out this show. Thank you very much. We pretty much covered everything. Have yourselves a good day, and I’ll see you next show.
Show Summary
Episode 24 Summary TLDR –
WordPress 7.1.4 landed on 28 October as another short-cycle security release, fixing twenty-two vulnerabilities and pushing backports all the way to 4.7. Most of them require a Contributor-level account or higher and cluster around stored XSS in the Interactivity API, blocks, the Customizer, and privacy tools. The one that stands out is an unauthenticated race condition in the upgrade process itself: for a few seconds while a full-package update unpacks into a predictable folder under wp-content/upgrade, an attacker who hits the window can reach a staged installer. Wordfence rated it high severity and saw tens of thousands of probes right after release. The fix randomizes the folder name and hardens the process; the practical advice from WP Security Ninja and others is simple — update, then confirm you actually landed on 7.1.4.
That release came a week after PHP’s own emergency drop on 21 October. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 close two critical unauthenticated RCE bugs in the engine (collectively called PHP2Shell) that sit underneath every WordPress site. Updating WordPress does not patch them, and security plugins that load inside WordPress cannot intercept them. If you run your own servers the checklist is straightforward: move to one of the fixed PHP versions, restart the workers, and verify. PHP 8.2 reaches end of life at the end of the year, and older branches rely on vendor backports.
Finally, after seventeen years the show is winding down. Amber’s health forced her off the air earlier this summer, the magic has faded, and the remaining episodes will run through the end of 2026, with the final pre-recorded show on Christmas morning. The site, the X presence, and a future store for non-repo plugins will continue; the podcast itself will not. John is moving on to other projects, including Tavern Talk, and will keep noting the farewell on the remaining episodes.
Also check out Tavern Talk at the Oasis podcast and support WP Plugins A to Z show here.
See you in the dashboard… if you can still find it under all those menus. 🚀🐉
