WordPress Weekly Recap: What You Missed (May 12–18, 2025)

The week of May 12 to 18, 2025, brought notable activity across the WordPress ecosystem. From serious security disclosures to strategic updates in core development and contributions, the community remained engaged and responsive. In this weekly recap, we’ve compiled all major developments, curated from verified sources including Make WordPress Slack, Wordfence, developer blogs, and relevant social channels.

Core Development and Community Events

WordPress Core Developer Chat - May 14, 2025

The weekly WordPress Core Developer Chat was held on May 14 at 15:00 UTC in the #core Slack channel. Key points of discussion included:

• Planning and preparation for upcoming minor releases.
• An open invitation for contributors to suggest agenda items ahead of time.
• Continued focus on testing new WordPress 6.8 features and encouraging community feedback.

Reference: Dev Chat Agenda - May 14, 2025

Accessibility Bug Scrub in Honor of Global Accessibility Awareness Day

On May 15, the WordPress community conducted a dedicated bug scrub session focused on accessibility issues. Organized in the #core Slack channel, this initiative supported Global Accessibility Awareness Day by prioritizing improvements in:

• Keyboard navigation support.
• Screen reader compatibility.
• Overall usability enhancements for all users.

Details available in the Dev Chat post.

Security and Vulnerability Disclosures

Motors Theme Security Vulnerability (CVE-2025-4322)

A critical privilege escalation vulnerability was disclosed in the premium Motors theme. Identified as CVE-2025-4322 with a severity score of 9.8 out of 10, this flaw allowed unauthenticated attackers to gain administrator access.

• Affected Version: Pre-5.6.68
• Patched Version: 5.6.68 (released May 14, 2025)
• Users were strongly advised to update immediately

Sources:

• Wordfence Security Advisory
• TechRadar
• BleepingComputer

Wordfence Weekly Vulnerability Report

Wordfence added 132 vulnerabilities to its Intelligence Database during the week. These included:

• 110 affected WordPress plugins
• 9 affected themes

Administrators are advised to perform immediate reviews of installed extensions and update all outdated components. For a comprehensive approach to securing web applications, explore our guide on zero trust security models.

Reference: Wordfence Blog

TheGem Theme Vulnerability Discussion

Although patched prior to the start of the week, TheGem theme remained in discussion due to its widespread use. The theme had suffered from critical vulnerabilities, including remote code execution issues.

• Over 82,000 active installations were affected
• Patched in version 5.10.3.1 on May 7, 2025

Further Reading: Cybersecurity News

Gutenberg and WordPress 6.8 Testing

Gutenberg 20.8 Feature Testing

Gutenberg 20.8 was under continued evaluation following its release alongside WordPress 6.8. Key feature updates under review included:

• Advanced block bindings
• Section style controls
• Improved editor consistency and interface performance

For a detailed look at the latest WordPress maintenance improvements, read our overview of WordPress 6.8.2.

Reference: Gutenberg 20.8 Announcement

Deprecated APIs in @wordpress/components

Developers took note of several deprecations in the @wordpress/components package, including the removal of ButtonGroup and related UI components. Plugin and theme authors were encouraged to begin transitioning to modern alternatives.

Core details: WordPress 6.8 Overview

Community and Industry News

WPContent Tweet on Ecosystem Updates

On May 14, the @wpcontent_co account posted an update linking to the latest WordPress news and developments. Although the tweet did not specify topics in detail, it highlighted active engagement from within the community.

View post: @wpcontent_co Tweet

Modular DS Raises €615K for WordPress Management Platform

Modular DS, a Spain-based startup focused on WordPress site management, announced €615,000 in seed funding to expand its tools for performance monitoring, scaling, and security.

Coverage: Tech.eu

JD Supra Publishes Plugin Risk Advisory

On May 15, JD Supra issued a legal and technical advisory for WordPress users, warning against excessive plugin usage. Recommendations included:

• Minimizing third-party plugins
• Conducting regular audits
• Prioritizing performance and security

Read the full advisory: JD Supra

Contributor Participation and Maintenance

WordPress 6.8 Release Parties Continue

Throughout the week, contributors gathered virtually to test recent changes and discuss upcoming refinements in WordPress 6.8. These “release parties” provided a collaborative environment for bug reporting and feedback.

Updates: Make WordPress Core

Wordfence Bug Bounty Program

Wordfence continued its bug bounty initiative, offering rewards of up to $31,200 per qualifying vulnerability. Researchers and developers were encouraged to report responsibly disclosed issues in plugins and themes.

Program details: Wordfence Bug Bounty

Ongoing Emphasis on Plugin Maintenance

In response to the large volume of vulnerabilities reported, site administrators were reminded to:

• Remove inactive or unmaintained plugins
• Keep all assets updated
• Monitor vulnerability feeds regularly

WordPress support forums and Slack discussions reflected heightened awareness of proactive site hygiene.

Reference: WordPress Support Forums

Summary Table

Recommendations for Site Administrators

1. Update the Motors theme to version 5.6.68 immediately.
2. Review your plugin and theme stack for known vulnerabilities using tools like Wordfence or WPScan.
3. Participate in community testing and bug scrubs via the Make WordPress Slack.
4. Limit plugin usage to actively maintained, well-supported options.
5. Enable strong authentication mechanisms, including two-factor authentication.

Final Note

While no major core releases landed during the week, the WordPress ecosystem was alive with activity. Security remained a top concern, and the community’s emphasis on accessibility and testing demonstrated WordPress’s continued evolution through open collaboration. For a broader perspective on how different CMS platforms compare, explore our complete guide to CMS platforms.

For real-time updates, follow @WordPress, @wpcontent_co, and @wordfence.