WordPress 6.2.1, which was released recently, included five important security fixes. However, the update has caused issues for many users as shortcode support has been removed from block templates. This change has impacted how plugins display things like breadcrumbs, newsletter signup forms, WPForms, Metaslider, bbPress content, and more. The problem affects template blocks, not sites that are using non-FSE themes.
Users have taken to the support forum to express their frustration with the update. Some have reported that the update has broken hundreds of pages on their site. Others have been forced to revert to previous insecure versions of WordPress in order to keep critical functionality on their sites working. WordPress developer Oliver Campion commented on the Trac ticket with more details about how sites are currently using shortcodes in templates.
Shortcode Blocks are essential to the design process when using Block Themes. They are used to inject classic menus that can have dynamic menu items, dynamic header content, specialized loops and footer content that’s as simple as showing the current year in the copyright statement to showing a contact form or other such dynamic content.
This update has destroyed many users’ confidence in WordPress’ automatic updates. This kind of breaking change should never happen in a release that auto installs overnight. Even if it’s absolutely necessary to avoid a zero-day vulnerability on WordPress sites, discontinued shortcode support in block templates should have been accompanied with more information to help affected users find a solution.
During today’s core dev meeting, WordPress 6.2.1 co-release lead Jb Audras said this issue may prompt a quick 6.2.2 release but the details are not yet available. In the meantime, those who cannot employ a workaround and are looking to rollback to 6.2 can use the WP Downgrade plugin as a temporary fix, with the knowledge that this leaves the site vulnerable until a permanent solution can be put in place.
