We've seen a few significant things happen in the WordPress world over the last 24 hours, and we wanted to give you a heads up. One is a critical security fix you should apply today; the other two are worth knowing before you move to WordPress 7.1.

1. Critical: update Elementor Pro now (unauthenticated RCE)

A critical vulnerability (CVE-2026-32475, CVSS 9.0) affects Elementor Pro 4.2.1 and earlier. It is fixed in 4.2.2.

The flaw is in the Forms module's file upload field. The plugin validates uploads in one loop and moves them in another, and the two disagree about empty entries. By sending a multipart upload with an empty first entry followed by a PHP file, an attacker slips past the extension blocklist and the PHP file still gets written to wp-content/uploads/elementor/forms/, a public directory. From there it can be executed directly. No login is required, and every value the request needs is visible in the page HTML, so this is trivial to automate at scale.

What to do: update Elementor Pro to 4.2.2 or later immediately. If your site ran a vulnerable version, also check wp-content/uploads/elementor/forms/ for unexpected files, especially anything ending in .php.

Details: Patchstack advisory

2. WordPress 7.1 "Mary Lou" is out

WordPress 7.1 shipped on 19 August 2026. Headline changes include responsive styling controls in the Site Editor (less custom CSS for per-viewport layouts), a persistent admin bar across editing screens, a consolidated media editor for cropping and rotation, richer collaboration notes with @mentions, new Playlist and Tabs blocks, and in-browser image compression via WebAssembly that supports AVIF and HEIC while taking load off the server.

It is a solid release, but as always with a major version, do not rush it on production. Test on staging, confirm your theme and plugins are compatible, and take a backup first. See item 3 before you upgrade if you use WP Rocket.

Release notes: WordPress 7.1 "Mary Lou"

3. WP Rocket + WordPress 7.1: fatal error, now patched

If you run WP Rocket, upgrading to WordPress 7.1 first could take your site down. Older WP Rocket versions throw a fatal TypeError from the Cloudflare integration (substr(): Argument #1 ($string) must be of type string, int given in Cloudflare.php). It crashes every entry point, front end, admin, REST API and WP-CLI, so the site goes fully white.

The root cause is a legitimate WordPress 7.1 change: hook callback IDs are now generated with spl_object_id() (small numeric strings) instead of spl_object_hash() (hex strings). PHP then casts those numeric keys to integers, and WP Rocket's strict type checks expected strings. Nothing wrong on your side; it just needs the patched plugin.

This is fixed in WP Rocket 3.23.2.2. The safe order is: update WP Rocket first, then move to WordPress 7.1. If you have not upgraded WordPress yet, update WP Rocket and you are clear.

If a site is already down, the quickest recovery is to disable WP Rocket. On our cPanel servers you can do that a few ways:

• WP Toolkit in cPanel: open the site and toggle WP Rocket off.
• WP-CLI (Terminal in cPanel): wp plugin deactivate wp-rocket --skip-plugins=wp-rocket (the --skip-plugins flag stops WP-CLI from loading the broken plugin as it runs).
• File Manager: rename wp-content/plugins/wp-rocket to something else, which force-deactivates it.
• FTP/SFTP/SSH: same rename, if you prefer the command line or an external client.

Once the site is back, update WP Rocket to 3.23.2.2 and re-enable it. Note that a few users are still reporting errors after the patch (WP Rocket issue #8752), so keep an eye on your site after upgrading.

One broader point: all our servers run LiteSpeed Enterprise. On this stack the LiteSpeed Cache plugin is the better-matched choice, since it hooks directly into the server's cache rather than caching in PHP. It's worth considering as an alternative to WP Rocket on our platform.

WP Rocket references: documentation on the issue and changelog.

The Fusioned team