Home Blog

WordPress.org blog: WordPress 7.1.3 Maintenance and Security Release

0

This security and maintenance release features 7 security fixes and 4 bug fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • A stored XSS on the Comments administration page, exploitable via pending comments, reported by Thomas Chauchefoin at Trail of Bits
  • A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic
  • A second-Order SQL injection in WordPress WXR export, reported by Anthropic
  • A weakness allowing Author role users to sticky posts, reported by Anthropic
  • Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack
  • Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong
  • Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team

Thank you to these WordPress contributors

This release was led by Jake Spurlock.

WordPress 7.1.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Adam Silverstein, Adi Moldovan, Adrian Duffell, Alex Concha, Arkaprabha Chowdhury, Deepak Kumar, donniam, Ehtisham Siddiqui, Jake Spurlock, Jb Audras, Jeremy Felt, Joe Dolson, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Ken Gagne, Khokan Sardar, Lance Willett, lucatume, marcs0h, Peter Wilson, pkevan, RS Software, Rudy Faile, Sergey Biryukov, siliconforks, smerriman, Stephen Bernhardt, Suryakant Upadhyay, vortfu, webVerts, Weston Ruter, Yogesh Bhutkar

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Open Channels FM: Open Source Maintainers Defend Against AI Spam, Linux Data Trends and WordPress Accessibility Challenges

0

AI-driven growth presents challenges in security and accessibility and infrastructure hurdles that technology teams cannot ignore.

Open Channels FM: The Essential Human Touch in Genealogical Research

0

As artificial intelligence becomes more integrated into genealogical research, it is tempting to imagine a future where longstanding mysteries are unraveled with a few keystrokes. AI tools can now scan, transcribe, and sort through centuries of records, but the heart of successful genealogy still depends on something machines cannot replicate: the human touch. No matter […]

OpenStation Blog: Someone Said “I Hate OpenStation.” That Was Actually Useful.

0

A few days ago, someone opened a support thread about AllTerrain Forms and, in the middle of otherwise useful feedback, wrote something very direct: “I hate OpenStation.”

Obviously that is not the nicest sentence to read when you are working on the product, but at the same time it immediately got my attention because this is exactly the kind of feedback that can be useful if you don’t take it personally.

So instead of trying to explain why OpenStation is good, or why we made certain decisions, I asked a very simple question: what exactly makes you hate it?

Her answer was actually very good.

She works on a laptop, so screen space matters a lot. OpenStation was opening windows too small for her workflow, which meant that one of her first actions was always maximizing them. She also didn’t like losing the visible URL because she regularly copies URLs into emails, project trackers or messages. On top of that, her users are not very technical, and from her point of view OpenStation was adding another layer to WordPress that she would eventually have to explain and support.

She basically said that browser tabs already exist, users understand them, they use the whole screen, and they don’t hide the URL.

And I think this is exactly where building software becomes interesting, because from our side all of those decisions had reasons behind them, but reasons don’t really matter if the final experience is worse for the person using it.

None of these are theoretical product discussions. They are very concrete things that someone hit while trying to use the software for real work.

That matters a lot to me.

We started discussing these points immediately, and one of them has already made it into the next OpenStation release.

OpenStation Preferences interface displaying settings for window appearance and behavior, including options for window focus, corners, and dimming effects.

Users will now be able to choose how new windows open: using the current default behaviour, maximized, or focused. Focused mode maximizes the new window and minimizes the other windows on the same desk, so people working on smaller screens can have something much closer to the experience they expect.

This came directly from that kind of feedback, and the implementation is already merged:

PR #964: Preferences: choose how newly opened windows appear

And this is really the point.

We obviously have our own vision for OpenStation. We believe WordPress can have a much better working environment than the traditional admin experience, and there are many things we still want to explore there. But having a strong idea of where the product should go does not mean pretending every decision we make is correct.

Sometimes the most useful feedback is not “great release” or “this looks amazing”. Sometimes it is someone telling you that a window is too small, that they want the URL back, that something scrolls when it shouldn’t, or simply that they don’t see the benefit of what you built.

That kind of feedback forces you to look at the product from outside your own head, which is probably one of the hardest things to do when you have been working on it every day for months.

For me, OpenStation becoming more mature is not only about adding more apps, more features or more ambitious ideas. A big part of maturity is improving all those small things that make the product feel natural, predictable and less annoying to use.

And I think there is also something important here about open source. People can complain, explain exactly what does not work for them, and a few days later they can literally see the code that changes that behaviour.

That is a pretty healthy way to build software.

So yes, tell us when OpenStation is great, but especially tell us when it sucks. We may not agree with every suggestion, and we obviously cannot build every requested feature, but if there is a real problem behind the feedback, we want to understand it.

In this case, someone said “I hate OpenStation.”

Fair enough.

A few days later, OpenStation got better because of it.

Open Channels FM: Technology’s Fast Feedback Loop with Triumph of the Nerds, Agile AI, and WordPress Security

0

Faster tech means new challenges from AI feedback loops to WordPress security incidents.

Open Channels FM: Topics in Tech Business, It’s Rinse and Repeat

0

Sometime we think, been there, done that, but hey, not everyone has done that.

Akismet: Akismet Now Supports Drupal 12

0

Version 1.1.0 of the official Akismet Drupal module is out with support for Drupal 12. If you’re planning your move to 12, spam protection won’t hold you back. Here are the highlights.

Drupal 12 from day one

The module now runs on Drupal 10.3+, 11 and 12. On Drupal 12, Akismet checks comments and user registrations as soon as you install it, since both live in core. Contact forms, webforms, and the Key module will be supported as soon as they’re ready for D12.

What else is new in 1.1.0

Better spam scoring

Every check now gives Akismet a fuller picture of each submission. The module’s bot detection watches how someone fills out a form: how long they take, how they type, and how they scroll, click or tap. In 1.1.0, all of those signals feed straight into Akismet’s spam scoring. With more context, Akismet can better tell a real person from a bot, so you should see more spam caught and fewer real messages flagged by mistake.

Better GDPR export

drush akismet:gdpr-export now takes --format=json (or csv and yaml) and returns the full stored record for each match, including the original submission. That makes subject access requests easier to answer completely.

The export also withholds the moderator’s identity, as GDPR Article 15(4) allows.

Clearer warnings about your stored API key

The status report now warns you about a leftover copy in yoursettings and stays visible until you deal with it. A new Delete stored API key form removes it in one step. You’ll find the link on the settings page and in the status report.

Coming from the community module?

Before the official module, some Drupal sites used the community-maintained Akismet module (drupal/akismet). That project is no longer maintained. If you’re still running it on Drupal 10.3 or later, 1.1.0 can take over your install in place. Your API key, connection timeout and protection settings carry over, and the update prints a report of everything it migrated, changed or dropped. Our migration guide on drupal.org walks through the process.

Get started

You’ll need an Akismet API key. Grab one from our pricing page. It’s free for personal sites.

For a new install:

composer require drupal/akismet_antispam

If you’re already on 1.0, update the module along with the Akismet PHP SDK it depends on, then run the database updates:

composer update drupal/akismet_antispam --with-dependencies
drush updb

The module needs Drupal 10.3, 11 or 12 and PHP 8.1 or newer, or the newer PHP your Drupal core requires.

Found a bug or have an idea? Tell us in the issue queue.

New to the module? Start with our introduction to the official Akismet Drupal module, or see how it’s built on the official Akismet PHP SDK.

Open Channels FM: Beyond Rants, Productive Discussions and the Mystery of Poor Design Choices

0

Bob Dunn reflects on online conversation styles and an infamous hardware design blunder, offering unsolicited solutions and food for thought.

Open Channels FM: Why We Build Systems aka Zach and Carl’s Emporium of Madness

0

In this episode, hosts Zach and Carl discuss adapting to technological change, personal reinvention, and the impact of AI on creativity and web development, emphasizing diverse income strategies and effective ADHD management.