Digest 128: Fake Browser Updates Target Admins via Plugin

View in the browser

This week, the “weekend project” was redefined as AI took center stage in the WordPress ecosystem. Jamie Marsland proved the power of AI by building a 15-year dream project in just 48 hours, signaling a shift where WordPress acts as the ultimate “orchestration layer” for complex apps. However, innovation comes with new risks we’re tracking a sophisticated “Modern Recent Posts” plugin scam targeting admins with fake browser updates.

---

Zero Compromise Hosting: 20i Delivers Peak WordPress Performance

Tired of slowdowns? Instantly eliminate downtime with our True Autoscaling Cloud that proactively absorbs traffic spikes. Accelerate every site load using High-Frequency CPUs for record-breaking processing speed and enjoy global coverage with Unlimited Edge Pre-Caching CDN. Migration is seamless, downtime is zero.

See the difference – First month only $1

---

↑ Brought to you with support from these partners

💡 WordPress Spotlight

• Jamie Marsland Builds 15-Year Dream Project in a Weekend via AI
  Jamie Marsland (Pootlepress) showcased how AI enabled him to build a complex prediction market app in just 48 hours. He argues that this shift positions WordPress as a powerful “orchestration layer,” where its established systems for users and commerce will act as a major accelerator for AI-driven applications and the upcoming Abilities API. (Source)
• Fake Browser Updates Target Admins via “Modern Recent Posts” Plugin
  A malicious WordPress plugin titled “Modern Recent Posts” is targeting site administrators with sophisticated social engineering. Once installed, it displays fake browser and Java update notifications exclusively to logged-in admins on Windows machines. The goal is to trick users into downloading malware, such as information stealers or ransomware, directly onto their local computers. The plugin also features a self-destruction mechanism to evade detection. (Source)
• WP REST Playground: A Headless WordPress & React Template
  Developer 00kaku has released WP REST Playground, a React-based application that demonstrates how to use a local WordPress installation as a headless CMS. The project features JWT authentication for secure logins, real-time post searching, and category-based navigation. It also includes two custom PHP plugins that create unique REST API endpoints, making it an excellent starter kit for developers looking to master headless WordPress workflows. (Source)
• WPBakery Crowned “Best Page Builder” in 2025 TemplateMonster Awards
  WPBakery has earned the top spot as the Best Page Builder for WordPress in the annual TemplateMonster Awards. Determined by community votes, the win highlights WPBakery’s long-standing reputation for stability and theme compatibility. With over a decade in the market and millions of active users, the team emphasizes that this recognition validates their commitment to maintaining a “stable and maintainable” workflow for developers and agencies worldwide. (Source)
• Open Channels FM Celebrates 8 Years and 1.53 Million Seconds
  In a milestone post, BobWP celebrates the 8th anniversary of his podcast network, now rebranded as Open Channels FM. Sharing impressive metrics, he noted that the network has produced enough content over nearly a decade to equal the word count of the Harry Potter series three times over. The anniversary marks a continued evolution for the platform as it refocuses on serving the open web and the WordPress community with dedicated shows like the recently relaunched Do the Woo. (Source)
• WP Tavern Podcast: Brian Coords on WooCommerce’s Global Evolution
  In episode #199 of the Jukebox podcast, Nathan Wrigley talks with Brian Coords, Developer Advocate at WooCommerce. Coords discusses the platform’s recent massive rebrand and its strategic shift from being seen as “just a plugin” to a comprehensive e-commerce solution. The episode covers how WooCommerce is navigating competition with SaaS giants like Shopify, the increasing role of AI in store management, and the push for deeper integration with WordPress core block editing to streamline the merchant experience. (Source)
• GoDaddy Airo™ Site Designer: AI-Powered WordPress Building
  GoDaddy has officially rolled out Airo™ Site Designer, an AI-driven tool integrated into their Managed WordPress Hosting. The assistant allows users to describe their business via a simple chat interface, which then generates a multi-page, professional WordPress site in under a minute complete with copy, layouts, and Getty images. Adam Warner (GoDaddy) has invited the community to “roast it, praise it, or teach us,” seeking feedback on how the AI interprets complex requests and integrates with the native block editor (Twenty Twenty-Four). (Source)
• Plugin Jam: New Miniature Hackathons for WordPress Builders
  Nik McLaughlin has announced the launch of Plugin Jam, a series of miniature hackathons designed specifically for the WordPress community. Moving away from traditional high-pressure coding marathons, these “jam sessions” focus on collaboration and creative building. The inaugural event is set to kick off online on January 23, 2026, offering a space for developers and designers to experiment with new ideas and ship lightweight solutions in a supportive environment. (Source)
• Patchstack Previews “The Next Era” of Vulnerability Management
  In a new update, Oliver Sild (Patchstack) teased a transformative roadmap for 2026, focusing on automating the entire lifecycle of vulnerability management. The vision moves beyond simple alerts toward “Virtual Patching” that proactively secures sites before official updates are even released. Sild emphasizes that as bot-driven attacks become more sophisticated in 2026, the focus must shift toward lightning-fast, automated remediation to protect the open-source ecosystem. (Source)
• WB Polls 4.5.0: Professional Polling Now for All WordPress Sites
  Formerly “BuddyPress Polls,” WB Polls has rebranded and launched version 4.5.0, removing the BuddyPress requirement to work on any WordPress site. The update introduces five rich media poll types (Text, Image, Video, Audio, and HTML), a modern GLightbox viewer, and a full REST API for developers. It remains fully compatible with BuddyBoss while serving as a standalone, high-end polling solution. (Source)

✨ Fresh Features Rollout

1. SureCart 3.17.5: Mandatory Tax Fields and Enhanced Performance
   The latest SureCart update introduces a highly requested compliance feature: the option to make VAT and Tax ID fields mandatory during checkout. Additionally, developers can now use filters to customize the country list selection for shipping and billing settings. Improvements include offset support for the related product list block and a refactor of variant pills for better frontend performance. (Source)
2. Tutor LMS 3.9.5: PHP 8.4 Support and Admin Certificate Downloads
   The latest update to Tutor LMS brings full support for PHP 8.4 and introduces several workflow enhancements. Administrators and instructors can now download certificates directly (Pro), and course creators have the ability to remove co-instructors from their own courses. The release also fixes several security issues, improves the “gift course” functionality, and allows users to retry failed payment transactions seamlessly. (Source)
3. Astra v4.12.0: Command Palette Integration & Learn Tab Astra has released version 4.12.0, introducing a powerful integration with the WordPress Command Palette. Users can now jump directly to Astra Customizer panels using the Cmd + K / Ctrl + K shortcut. The update also debuts a new “Learn” Tab within the theme dashboard, providing step-by-step guides for mastering site configuration. For Astra Pro users, this release adds vertical and horizontal alignment controls for blog cards and categories, offering even more granular design flexibility. (Source)
4. Essential Addons for Elementor v6.5.5: Stability and Liquid Glass Effects
   The latest update to Essential Addons for Elementor (v6.5.5) focuses on refining existing widgets and ensuring full compatibility with PHP 8.4. Key highlights include a “Liquid Glass Effect” enhancement for Advanced Tabs and a new location field in the Event Calendar popup. Several layout fixes were also deployed, specifically for the Feature List and Advanced Tabs widgets, addressing alignment and background color issues. Additionally, the update improves performance by reducing unnecessary queries and introduces Cloudflare Turnstile support for the Login/Register widget. (Source)
5. BookingPress 5.0.4: Enhanced Calendar Views and Performance Kicking off the new year, BookingPress released version 5.0.4 with a focus on UI and stability. This update introduces a more intuitive “Month View” for the admin booking calendar and enhances the “Staff Member” selection logic in the booking form. Under the hood, the release addresses performance bottlenecks for high-traffic sites and resolves issues related to time zone conversions for international appointments. (Source)
6. Ultimate Addons for Elementor 2.8.0: Content Duplication & Command Palette
   The new UAE Duplicator Extension allows for one-click cloning of pages, posts, and custom blocks. Additionally, UAE Pro v1.42.2 introduces Command Palette integration for faster navigation and adds Cloudflare Turnstile support to login and registration forms for improved spam protection. (Source)
7. SureForms 2.3.0: Form Duplication & Premium Integrations
   This update introduces one-click form duplication and preselect options for dropdowns. SureForms Pro users now get a native Google Sheets integration and password-protected forms. The release also includes enhanced security hardening and better accessibility for form settings. (Source)
8. JetAppointments Booking v2.3.4: Smarter Working Hours & Better Logic
   The latest update to JetAppointments Booking introduces more flexible “Working Hours” settings, allowing for more complex scheduling across different providers. It also enhances the “Buffer Time” logic to prevent overlapping bookings more effectively. Key fixes include improved compatibility with the latest version of JetEngine and resolved issues with time slot availability when using specific time zone offsets. (Source)
9. Yoast SEO 26.7: Site Kit for All and Schema Enhancements
   The latest update makes the Site Kit by Google integration available to all users, providing direct access to Google analytics and search data within the Yoast dashboard. It also refines Schema output to ensure Article entities render even without a defined publisher. Key fixes include resolving an issue where AI consent modals appeared incorrectly on profile pages and improving plugin upgrade stability for a larger subset of users. (Source)
10. EmbedPress 4.4.8: Performance & Accessibility Boost
    It brings key refinements to its document and media embedding features. This update fixes an accessibility issue with missing iframe titles in the PDF block and resolves a Wistia video color scheme bug in Elementor. Additionally, PDF embedding performance has been improved, and Meetup event dates now display in the user’s local time. (Source)
11. Patchstack v2.3.0: Core Architecture Update
    Marks a significant update to the plugin’s core architecture. This version introduces a new communication layer for faster synchronization with the Patchstack App and includes internal optimizations to the firewall engine for better performance. Key improvements also include a more robust GeoIP database update and enhanced protection for WordPress REST API endpoints. (Source)
12. AIOSEO 4.9.3: Rich Schema Updates and AI Hardening
    Introduces review support for Book and Event schema types, helping these results stand out with rich snippets. The update also includes security hardening to protect AI access tokens and adds new filters to disable AI Assistant blocks or customize LLM titles. Developers will appreciate the refactored WPBakery integration and a performance-optimized import process that now only targets active data from other SEO plugins. (Source)
13. BetterLinks 2.4.2: Integration Stability & UX Refinements
    This update strengthens the Fluent Boards integration, resolving task-sharing issues within link management. It builds on recent major additions, including bulk analytics deletion, multiple URL slug generation, and auto-fetching link titles from target URL metadata. (Source)
14. Next3 Offload v4.3.5: Advanced Delivery & Image Optimization
    The latest update to Next3 Offload introduces new “Delivery Settings,” including options to add versioning to media URLs and support for Presigned Object URLs. This follows the major v4.3.4 release, which added a new Image Optimization Engine with support for TinyPNG, Kraken.io, ShortPixel, and EWWW Optimizer, significantly expanding media compression options for offloaded files. (Source)
15. FluentCart 1.3.4: Product Bundles & Razorpay Support
    The headline feature in this update is the new Product Bundles system, enabling custom-priced product groupings. The release also adds Razorpay for one-time payments, Stripe Hosted Checkout for better conversions, and 100% recurring discounts for subscriptions. Security is also improved with Cloudflare Turnstile integration at checkout. (Source)
16. Elementor 3.34: Atomic Tabs & Entrance Interactions
    As Elementor moves toward version 4.0, the 3.34 update introduces Atomic Tabs, allowing users to build fully custom tabbed layouts by styling triggers and panels as independent elements. This release also debuts Entrance Interactions, a performance-focused animation system that lets you stack effects like fade, slide, and scale. These features can be enabled via the new Editor V4 tab in settings. (Source)

🆕 Fresh Releases

• WooCommerce USPS Shipping Plugin with Print Label
  A comprehensive shipping solution that automates USPS shipping rates, allows for bulk printing of shipping labels directly from your WooCommerce dashboard, and provides real-time tracking for customers. It includes advanced features like flat-rate boxes, thermal printing support, and “Pay-at-Post-Office” options. (Source)
• Antimanual – The Ultimate AI Solution
  This all-in-one AI powerhouse combines an intelligent chatbot (now with GPT-5 support), auto-posting, and a documentation generator. It also offers unique bbPress forum automation, which can automatically turn closed forum topics into knowledge base posts or generate AI-powered replies to keep discussions active. (Source)
• Wontonee CommerIQ – AI Commerce Insights
  Designed for WooCommerce, CommerIQ uses AI to generate product descriptions and professional images. Its standout feature is Intelligent Price Comparison, which tracks competitor pricing across multiple platforms in real-time, providing actionable insights to help store owners optimize their pricing strategy. (Source)
• Redirect Cleanup
  A vital SEO utility for sites running Yoast SEO Premium. This plugin scans your site for redirect chains, loops, and problematic homepage redirects. It features a modern React-based interface and WP-CLI support, making it easy to fix SEO-damaging redirect issues in bulk. (Source)
  

🗓️ Mark Your Calendar 

If you’re looking for opportunities to network and learn, check out these upcoming WordPress events and meetups:

• WordCamp Nepal (Butwal, January 23-24, 2026)
• WordCamp Zaragoza (January 24, 2026)
• WordCamp Kolhapur (January 31, 2026)
• WordCamp Pune (February 08, 2026)
• WordPress DevDay (February 21, 2026)
• WordCamp Nice (March 06, 2026)
• WordCamp Madrid (March 06-07, 2026)
• WordCamp Mukono (March 13-14, 2026)
• WordCamp Asia (Mumbai, April 9 – 11, 2026)
• WordCamp Torino (May 08-09, 2026)
• WordCamp Portugal (May 15-16, 2026)
• WordCamp Europe (Poland, June 4-6, 2026)
• WordCamp US (Phoenix, 2026)

That’s a wrap for this week’s WPDigest! Stay tuned for more exciting WordPress updates next week.

Want to feature your WordPress product, service, or update news? Submit it for free using our form, helping spread the goodness of WordPress!

📩 Enjoyed this digest? Share it with your network!