Another busy stretch in the WordPress world has passed, and this week the headlines lean heavily toward security, browser-level engineering and the road to the next major release. For this roundup we scanned WP Tavern, WordPress.org News, WordPress Planet, WP Newsboard and Gutenberg Times, set aside the affiliate and SEO filler, and picked the five stories that matter most to anyone building or maintaining WordPress sites.
1. WordPress 7.1.3 Patches Seven Security Issues
The 7.1.3 maintenance release landed on October 6 and it is more than a routine bug-fix drop. Seven security problems were closed, among them a stored XSS in the Comments admin screen, a second-order SQL injection in the WXR exporter, and a flaw that exposed comments on private and unpublished posts to anonymous visitors. If your sites do not auto-update, treat this as a same-day task, since the project itself says to update immediately and is backporting fixes to older branches as they become ready. Source: WordPress.org News
2. The Road to WordPress 7.2: Gutenberg 24.0 and the Ipsum Theme
Gutenberg Times rounded up what is shaping the next major version, due in early December. The plugin’s 24.0 release adds revision diffs for post titles, a Grid variation for the Gallery block and fit-text for Site Title, while the 7.2 roadmap leans toward security with sudo mode, a Secrets API and hardened Application Passwords. Perhaps the most symbolic change is Ipsum, a minimal blog-first default theme that breaks the tradition of naming defaults after the year, so themes will now change when the design does, not when the calendar does. Source: Gutenberg Times
3. WordPress Pushes Browsers to Standardize Client-Side Media Processing
In a post on his personal blog, Matt Mullenweg explained how WordPress wants image handling to run on visitors’ and editors’ own devices rather than on busy servers. The approach depends on a Google-created feature called Document Isolation Policy, which worked only in Chromium browsers when 7.1 shipped. Mozilla has since voiced support and WebKit has dropped its earlier objections, so a formal standards request is now underway. It is a good example of the project shaping the web platform itself, and if it succeeds, cheaper hosting and faster uploads could follow. Source: Matt Mullenweg
4. Security Survey Shows High Concern but Thin Recovery Planning
The latest WP Tavern podcast features Robert Abela discussing the 2026 WordPress Security Survey. The headline finding is a gap: people say they worry a great deal about security, yet few have an actual recovery plan for when something goes wrong. Paired with growing talk of AI-assisted attacks, the episode is a useful nudge to test your backups and incident steps before you need them. Source: WP Tavern
5. bbPress 2.6.20 Tightens Password Rules and Adds a Forum Status Setting
The forum plugin bbPress shipped version 2.6.20 on October 15 as a security and maintenance update. It brings stronger password validation, a new site-wide Forum Status setting and assorted fixes. Anyone running community forums on WordPress should update, because user-facing plugins like this are a favourite target for attackers looking for the weakest link. Source: bbPress.org via WordPress Planet
That is the week in WordPress. Update your sites, keep an eye on the 7.2 betas, and we will be back next Monday with five more stories worth your time.