This was a week to check your site rather than assume it is fine. Attackers are going after a WordPress core flaw that was patched less than two weeks ago, a server-level bug needs an answer from your host, and I shipped a plugin to the directory that fits the mood. Here is what happened, what it means for your site, and what people are searching for right now.
New this week: iDownAlert is in the WordPress.org directory
iDownAlert went live on WordPress.org on November 6. It is free, and it does one job: it tells you the moment something goes wrong on your site, before your visitors do.
It covers fatal errors, database outages, malware and file changes, brute-force bots, and risky changes like new admin accounts. Alerts still go out when the database is down or a plugin has crashed the site, which is exactly when most tools go quiet.
I wrote up how it works in the launch post.
I also launched something outside WordPress this week: RMS, point of sale and inventory software for shops in Pakistan.
In case you missed it on this blog
- iStyleBlox 2.0. Twelve free blog blocks with FAQ, Review and HowTo schema built in.
- Why is my WordPress site not showing up on Google? Seven checks, in the order I run them.
- How to update the PHP version without breaking your site. The steps, and what to test afterward.
- Why is my WordPress admin so slow? How to find the cause instead of guessing.
- WordPress vs Wix vs Squarespace. Which one suits a business website.
- Is WordPress outdated in 2026? A developer’s honest answer.
- How to add social share buttons without slowing your site down. What to look for, and what to avoid.
The top WordPress stories this week
Attackers are probing the core flaw fixed in 7.1.4
Wordfence reports that attackers started targeting CVE-2026-119977 on the day it was disclosed, and its firewall has blocked more than 240,000 attempts. The flaw affects WordPress 4.7 through 7.1.3 and can let an attacker with no account run code on your server during a core update. CISA added it to its Known Exploited Vulnerabilities catalog on November 2.
Keep this in proportion. It is a race condition, the window lasts only as long as the update, and Wordfence calls successful exploitation difficult in practice. The fix is still simple: go to Dashboard, Updates and confirm you are on 7.1.4 or the patched release for your branch. Most sites updated themselves, but check anyway. Do not delay the update out of caution. Once you are on a patched version, future updates are no longer affected.
A Brotli bug that your host has to fix
CVE-2026-111497, circulating as HTTP2Shell, is a critical flaw in the Brotli compression library, not in WordPress. The name is misleading, because it has nothing to do with HTTP/2. WordPress does not ship Brotli, but it can reach it through the server when it fetches data from other sites. Patchstack shows that a pingback request to xmlrpc.php is one route, and warns that turning off XML-RPC closes the easiest door but leaves others open.
Wordfence reproduced code execution in a lab, though the public exploit depends heavily on the server setup. The public reports it reviewed through November 2 did not document a successful real-world compromise. Updating WordPress does nothing here. Ask your host one question: has the Brotli library on my server been patched for CVE-2026-111497? Fixed versions are 1.0.10, 1.1.1 and 1.2.1.
If this sounds familiar, it is the same pattern as PHP2Shell: a server-level bug where the fix happens at your host, not in your dashboard.
WordPress 7.2 Beta 4 is out
Beta 4 landed on November 3. It brings accessibility and editor fixes, updates to the new Ipsum default theme, and a change I like: the Updates screen now lists individual translation updates, so you can review them one by one. The final 7.2 release is planned for December 8. If you run a custom theme, test it on a staging copy now, and keep betas off live sites.
Gutenberg 24.3 and AI plugin 1.5.0
Gutenberg 24.3 lets you format text across several blocks at once, adds emoji reactions to Notes, and gives the media inserter a new grid layout.
The WordPress AI plugin reached 1.5.0 with six new experiments, including text to speech for posts and an MCP Access screen where you choose which abilities outside AI agents can use. It also fixes two security advisories, so update if you run it.
Another big week of plugin vulnerabilities
Wordfence logged 549 new vulnerabilities in 351 plugins and 4 themes from October 26 to November 1. Of those, 17 were critical and 41 had no patch yet. Firewall rules went out for flaws in The Grid (2.8.1 and earlier) and YOOtheme Pro (5.0.0 to 5.0.52), so check those if you use them. This is the case for running fewer plugins, and deleting the ones you have only deactivated.
Wordfence prices go up on December 3
Wordfence Premium rises to $199 a year on December 3, with Care at $890 and Response at $1,900. You can renew early at current pricing. Free users also have a date to note: the firewall rule for the core flaw above reaches the free version on November 27, 30 days after premium customers got it.
What people are asking Google about WordPress right now
I went through Google’s search suggestions for WordPress this week. These keep coming up, with short answers.
Why is WordPress so vulnerable?
The core is well maintained. The numbers look bad because WordPress is huge, and because tens of thousands of plugins are written by people of very different skill. Most hacks come through an outdated plugin or a weak password, not core. Fewer plugins, quick updates and tested backups remove most of the risk.
Will WordPress die?
Not any time soon. It is in the middle of a busy release cycle, with AI features in core and 7.2 due in December. I went through this in is WordPress outdated.
Will AI replace WordPress developers?
It is replacing some of the repetitive work, and I use it every day. It does not replace someone who knows what to do when a live store breaks, or who is accountable for the result. For simple brochure sites, expect more do-it-yourself. For anything with real business logic, the job is changing, not vanishing.
Does WordPress have an MCP?
Yes. The MCP Adapter plugin is available on WordPress.org, and it lets AI assistants work with your site through abilities you allow. Before you try it, read how to connect AI to WordPress safely.
Should I use WordPress or build from scratch?
Use WordPress unless you have a specific reason not to. A custom build means paying for logins, editing, media and updates that WordPress already gives you. Building from scratch makes sense for a web application, not for a marketing site or a blog.
Is WordPress free forever?
The software is, and that will not change, because it is open source. You still pay for hosting and a domain, and for premium themes or plugins if you choose them. WordPress.com is a separate hosted service with its own paid plans.
Why is WordPress not updating my changes?
It is almost always a cache. Clear your caching plugin, then your host’s cache, then your CDN, and check in a private browser window. If the change still does not appear, you may be editing a different page or template than the one you are looking at.
When is WordPress 7.2 coming out?
The planned date is December 8, 2026. Release candidates come first.
Topics to watch next week
- 7.2 release candidates. The point where theme and plugin authors should finish their testing.
- Your host’s answer on Brotli. CISA’s deadline for federal agencies is November 10, so hosts should have one by now.
- More attempts against the core flaw. Sites that never updated are the easy targets.
Need a hand?
If you are not sure where your site stands on any of this, take a look at how I handle WordPress security or tell me what you are seeing. And if you would like to hear about problems before your customers do, iDownAlert is free.
