WordPress

WordPress shipped 7.0.2 and 6.9.5 on July 17 and enabled forced auto-updates to fix wp2shell, a two-CVE chain allowing unauthenticated remote code execution in core, as public proof-of-concept exploits circulate.

An unauthenticated PHP code-injection bug in the Everest Forms Pro plugin, patched in March, has been exploited since April 13 to plant rogue administrator accounts on WordPress sites.

WordPress 7.0 arrives May 20 with new blocks, an AI Connectors API, and a redesigned admin, but its headline collaboration feature was cut on May 8 over performance and reliability concerns.

WordPress 7.0 arrives May 20 with a built-in AI Client API and a wp-admin refresh, after real-time collaboration was cut from the release over stability concerns.

Cloudflare has released EmDash v0.1, a full-stack serverless CMS written in TypeScript atop the Astro framework it acquired in January, promising sandboxed plugin isolation, AI-native management via MCP, and MIT licensing as a direct challenge to the 42.5 percent of the web still running WordPress.