Prompt Injection Is an SEO Surface Now
Agents now read your pages and act on them. That makes your comments, reviews and user profiles an input to someone else’s assistant, and a moderation problem.
security
WordPress.org Now Auto-Blocks Risky Plugin Releases
Every WordPress.org plugin release passes a six-hour security cooldown, and since 9 September 2026 a high-risk score halts distribution with no human in the loop.
Sudo Mode and a Secrets API Are Coming in 7.2
The WordPress 7.2 roadmap, published 18 September 2026, names sudo mode, a Secrets API and Application Passwords hardening for an early December release.
7.1.2 Patched a Hole That Reaches Back to 4.7
WordPress 7.1.2 fixed CVE-2026-87902, an unauthenticated path traversal in template resolution backported to 4.7. Probing began the same day it shipped.