This week in WordPress: a critical wake-up call.
A 9.8-severity flaw in a popular OAuth SSO plugin just exposed millions of sites to full takeover, and two separate backdoor campaigns have compromised over a million installs. On the brighter side, WordPress 7.0.1 shipped with 31 fixes, WooCommerce 11.0 is on the way, and 7.1 Beta 1 lands July 15. Here’s what to patch first and everything else you missed.
Kinsta – The AI & Bot Traffic Reality Check
Smart WordPress pros are already blocking this. Are you still letting it in?
AI bot traffic grew 300% in a single year. By late 2025, one in every 31 web requests came from an AI crawler. Scrapers, broken automation loops, and aggressive crawlers are quietly draining your server resources, skewing your analytics, and slowing your site.
Kinsta analysed more than 10 billion requests to expose exactly what’s happening and what site owners who act now can do about it.
Peak Performance WordPress Hosting, No Compromises
Leave single-server hosting in 2015. Choose autoscaling Managed WordPress Hosting built for traffic surges, complex sites & demanding PHP workloads, all without missing a beat.
↑ Brought to you with support from these partners
🏷️ SureContact Early Bird Deal Closing Soon
Still paying monthly for your marketing CRM? Lock this in for life instead. SureContact is offering a rare Early Bird Lifetime Deal for businesses that want a powerful CRM built for serious marketing, automation, and conversions, without recurring fees.
This is a premium, performance-focused platform, and the window is closing fast. Only 144 of the 500 exclusive lifetime spots remain. When they’re gone, this offer is gone for good. If you’ve been waiting for the right moment to upgrade your marketing stack, this is it.
What You Get with SureContact Lifetime
• Manage up to 100,000 contacts
• Send unlimited emails
• Use your own sending infrastructure like Amazon SES to keep ongoing costs near zero
💡 WordPress Spotlight
Critical miniOrange OAuth SSO plugin flaw exposes millions of sites: A critical vulnerability (CVE-2026-57807, CVSS 9.8) in the widely-used WordPress OAuth Single Sign-On plugin was disclosed by Patchstack on July 9, 2026, exposing millions of WordPress websites to complete takeover by unauthenticated remote attackers, exploiting a flaw in the plugin’s password recovery mechanism. (Sources)
WordPress 7.0.1 maintenance release ships: WordPress 7.0.1 was released July 10, fixing 31 bugs across Core and the block editor, seven weeks after WordPress 7.0 “Armstrong” shipped with AI infrastructure and a modernized dashboard. Notably, it fixes a regression in wp_kses() that was corrupting valid CSS background-image declarations. (Sources)
Hijacked plugins used to plant backdoors on 1.2M sites: Attackers tampered with OptinMonster and sister plugins to plant hidden backdoors across over a million WordPress installs. (Sources)
WP-SHELLSTORM operation exposed: A cybercrime crew’s own exposed server revealed WP-SHELLSTORM, a backdooring operation hitting thousands of WordPress sites, reported July 10. (Sources)
WordPress 7.1 roadmap firm up, Beta 1 due July 15: WordPress 7.1 Beta 1 is scheduled for July 15, with the first release candidate on August 5, and final release August 19 coinciding with the final day of WordCamp US. WordPress is also upgrading from React 18 to React 19, with expanded Unicode support shipping for email addresses, usernames, and slugs. (Sources)
🏷️ Exclusive LIFETIME Deals Digest
Stop paying monthly for your favorite tools. We’ve curated an elite collection of Lifetime Deals that allow you to invest once and profit forever. Grab these high-end, premium WordPress solutions at a massive discount today and enjoy professional-grade performance without the recurring fees.
✨ Fresh Features Rollout
WooCommerce 11.0 on the horizon: WooCommerce 11.0 is coming, with performance work for larger stores, more flexible customer and email flows, reporting improvements, and compatibility changes for extension developers. (Sources)
WooCommerce previews new Settings UI: A new React-based Settings UI for WooCommerce extensions is available for developers to test, opt-in, while retaining legacy PHP functionality. (Sources)
Gutenberg 23.5 brings draggable responsive canvas: Gutenberg 23.5 shipped July 1, letting users drag the editor canvas to any width, with the device preview dropdown and resize handles working together for responsive editing; the experimental Media editor gains a magnified crop canvas and Cover block support. (Sources)
Playground gains MCP support: Personal Playground gains MCP support along with a playground_ability meta-tool, letting agents list, inspect, and execute abilities through a single tool, plus Blueprint upgrades like activation Options and onError skip-plugin options. (Sources)
Responsive Styling opens for testing: An official Call for Testing on Responsive Styling landed July 3, letting developers style blocks per viewport directly in the editor. (Sources)
🆕 Fresh Releases
WooCommerce 10.9.4: Released July 7, 2026, this dot release fixes VAT exemption logic for block checkout, correcting is_vat_exempt handling during checkout for logged-in users. (Sources)
WordPress 7.0.1 official release: Released to the public on July 9, 2026, available via Dashboard > Updates or the release archive. (Sources)
WordPress 7.1 Beta 1 imminent: Landing July 15, kicking off weekly betas through the end of the month ahead of the August 19 final release. (Sources)
🗓️ Mark Your Calendar
If you’re looking for opportunities to network and learn, check out these upcoming WordPress events and meetups:
Flagship WordCamps
August 16 – 19, 2026: WordCamp US 2026, Phoenix, Arizona.
April 09 – 11, 2027: WordCamp Asia 2027, Penang, Malaysia.
Offline Events for WordPress
September 23, 2026: LoopConf 2026, event for WP developers & engineers.
October 16, 2026: WP Suomi 2026, for Nordic WP enthusiasts, Oulu, Finland.
Upcoming WordCamps
September 11, 2026: WordCamp Switzerland 2026, Fribourg, Switzerland.
September 18, 2026: WordCamp Bretagne 2026, Rennes, Brittany, France.
October 03, 2026: WordCamp Rajasthan 2026, Jaipur, Rajasthan, India.
November 05, 2026: WordCamp Canada 2026, Vancouver, Canada.
November 12, 2026: WordCamp Netherlands 2026, Netherlands.
November 13, 2026: WordCamp Pisa 2026, Pisa, Italy.
Wrap-Up
That’s a wrap for this week’s WPDigest! Stay tuned for more exciting WordPress updates next week.
Want to feature your WordPress product, service, or update news? Submit it for free using our form, helping spread the goodness of WordPress!
📩 Enjoyed this digest? Share it with your network!
