WordPress released version 7.0.3 as a critical security update this week, addressing twelve vulnerabilities across the platform. The release arrived alongside WordPress 7.1 Release Candidate 1 and Gutenberg 23.7, marking another significant week in WordPress development.

Site administrators should update immediately if automatic background updates haven’t already applied the patch. The security fixes address serious vulnerabilities that could compromise site security.

Critical Security Fixes in WordPress 7.0.3

Release lead John Blackbourn detailed the twelve vulnerabilities patched in this update. The most serious issue involves a pre-authentication XSS vulnerability on the login screen that could enable PHP code execution. Additionally, the update addresses several contributor-level stored XSS issues and a multisite privilege escalation vulnerability.

The security team backported these fixes to all supported branches down to WordPress 4.7. WordPress 7.1 RC2 also includes these security patches. This extensive backporting effort reflects the severity of the vulnerabilities and WordPress’s commitment to long-term security support.

Surge in Security Reports

The WordPress security team faces an unprecedented workload. Monthly security reports have jumped from 20-30 earlier this year to approximately 450 per month currently. This fifteen-fold increase demonstrates both heightened scrutiny and the platform’s growing complexity.

Both recent security updates, 7.0.2 and 7.0.3, required backporting across two dozen major versions. The team maintained support not only for the officially supported versions 6.9 and 7.0, but extended protection back to version 4.7.

WordPress 7.1 Release Candidate 1 Now Available

Benjamin Zekavica announced the availability of WordPress 7.1 Release Candidate 1 for testing. The final release is scheduled for August 19. Since Beta 4, developers merged more than 145 updates—57 in the Editor and 88 in Core.

New features include the Icons API, shareable revision links, and email notifications for mentions in Notes. Plugin and theme developers should complete testing and update their “Tested up to” version to 7.1. WordPress Playground enables browser-based testing without requiring a separate installation.

WordPress 7.1 Field Guide Published

Milana Cap compiled the WordPress 7.1 Field Guide, documenting more than 310 Core Trac tickets and twenty new hooks. The guide covers roughly 600 Gutenberg enhancements scheduled for the August 19 release.

Key highlights include client-side media processing, the always-iframed post editor, the SVG Icon API, responsive block styles, and the persistent admin bar. The guide also transparently addresses features that didn’t make the cut, including the Classic block’s reprieve, real-time collaboration, and React 19 integration.

Post Editor Always Iframed in WordPress 7.1

The post editor will run in an iframe by default in WordPress 7.1. The escape hatch that allowed one apiVersion 2 block to pull an entire post out of the iframe will be removed. This change represents the primary compatibility risk for the release.

Release coordinator Benjamin Zekavica outlined this and other compatibility considerations in the developer’s audit list. He organized each section by risk level and provided guidance on the SVG Icon API’s strict sanitizer, responsive block styles, and new DataViews filters. The audit concludes with a practical checklist for the August 19 release.

Gutenberg 23.7 Ships Interface Refinements

Jonathan Bossenger detailed the improvements in Gutenberg 23.7. The Gallery block’s ambiguous “Convert to images” button now reads “Detach” and includes a modal explaining the action. These refinements improve clarity for users managing block content.

Additional updates include moving the Global Styles inheritance UI to opt-in status via the Experiments page. The Math block now delays LaTeX error messages until users leave the field. Developers also fixed issues with floated blocks overlapping sticky elements and Pullquote line height inconsistencies in the editor.

WooCommerce 11.0 Improves Performance and Analytics

WooCommerce 11.0 delivers measurable performance gains according to Brent MacKinnon. Variable product pages load approximately 9 to 12 percent faster, while large stores experience improved responsiveness on Order screens.

Analytics reliability improved significantly in this release. Refunds now count in the period they occurred rather than when processed. Session counts exclude bot traffic for more accurate data. Guest customers can claim past orders when creating an account, and a Checkout Recovery beta allows testing messaging before full rollout.

Theme Control Tool Targets Agency Workflows

Brian Coords introduced wp-theme-control, an experimental approach to Create Block Theme functionality. The tool addresses a longstanding frustration for agency developers: extracting Site Editor changes from the database into version control.

His agent-first solution wraps the upcoming WP-CLI 3.0 wp block commands in bash scripts. The workflow includes a plan command that lists database changes, followed by dry-run testing, export to theme files, and optional database cleanup. Coords is gathering feedback before presenting the approach at WordCamp US.

New Tools for Client Collaboration and Maps

Ben Elwood launched Reviso, a client feedback and approvals plugin. The tool enables clients to pin comments directly onto live pages without requiring logins, email chains, or PDF workflows. Version 1.5.2 defaults to Suggest mode, allowing reviewers to propose wording changes that teams can apply with one click.

Bas Buis released Dynamic OSM Maps, bringing interactive maps to WordPress without Google API keys or recurring fees. The block runs on OpenStreetMap and Leaflet. The Pro version connects custom fields—coordinates, addresses, or repeaters—enabling unlimited markers and popups for directory and listing sites.

AI Gateway and Block Processing Tools

Vercel shipped the Vercel AI Gateway Provider plugin, developed by former Core AI team representative Felix Arntz. One API key provides access to hundreds of models from over 40 providers. The platform includes automatic fallbacks during provider outages and charges provider rates without additional platform fees.

Human Made open-sourced Block Runner on GitHub, a deterministic Node CLI that converts generated HTML into properly nested native blocks. The tool validates every result against headless Gutenberg. In benchmarking, raw models writing block markup scored 35 to 73, while the same models paired with Block Runner achieved scores of 93 to 99.

These tools address the challenge of integrating AI-generated content with WordPress’s block editor. The official WordPress agent-skills repository takes a complementary approach by teaching AI coding assistants to write valid block markup from the start.

Original Source: gutenbergtimes.com