WordPress shipped emergency releases for a chained core vulnerability nicknamed “wp2shell” that let an anonymous attacker take over a default install with zero plugins and within days, real-world exploitation was confirmed. Meanwhile, WooCommerce 11.0 reaches general availability today, WordPress 7.1 Beta 3 drops a long-awaited feature over security concerns, and a separate plugin flaw hit a popular translation tool. Here’s what to patch first and everything else you missed.
Kinsta – The AI & Bot Traffic Reality Check
Smart WordPress pros are already blocking this. Are you still letting it in?
AI bot traffic grew 300% in a single year. By late 2025, one in every 31 web requests came from an AI crawler. Scrapers, broken automation loops, and aggressive crawlers are quietly draining your server resources, skewing your analytics, and slowing your site.
Kinsta analysed more than 10 billion requests to expose exactly what’s happening and what site owners who act now can do about it.
Peak Performance WordPress Hosting, No Compromises
Leave single-server hosting in 2015. Choose autoscaling Managed WordPress Hosting built for traffic surges, complex sites & demanding PHP workloads, all without missing a beat.
↑ Brought to you with support from these partners
🏷️ SureContact Early Bird Deal Closing Soon
Still paying monthly for your marketing CRM? Lock this in for life instead. SureContact is offering a rare Early Bird Lifetime Deal for businesses that want a powerful CRM built for serious marketing, automation, and conversions, without recurring fees.
This is a premium, performance-focused platform, and the window is closing fast. Only 144 of the 500 exclusive lifetime spots remain. When they’re gone, this offer is gone for good. If you’ve been waiting for the right moment to upgrade your marketing stack, this is it.
What You Get with SureContact Lifetime
• Manage up to 100,000 contacts
• Send unlimited emails
• Use your own sending infrastructure like Amazon SES to keep ongoing costs near zero
💡 WordPress Spotlight
“wp2shell” core RCE chain triggers emergency patch and active exploitation: On July 17, WordPress shipped emergency releases 7.0.2, 6.9.5, and 6.8.6 patching a chained vulnerability (CVE-2026-63030 + CVE-2026-60137) that let an unauthenticated attacker reach full remote code execution on a bare install with zero plugins. By July 20, cybersecurity firms including Patchstack, Hexastrike, and WatchTowr confirmed hackers were actively exploiting sites still on vulnerable versions. (Source)
Loco Translate hit by a CSRF-to-RCE flaw: Wordfence disclosed CVE-2026-15005 on July 16, a high-severity bug (CVSS 8.8) in the popular Loco Translate plugin. A missing nonce check in the plugin’s template function lets an attacker who tricks an admin into clicking a link achieve arbitrary PHP code execution via a php://filter stream wrapper. (Source)
WooCommerce 11.0 reaches general availability today: WooCommerce 11.0 officially ships July 28, closing out a two-week beta. The release leans heavily on performance variable products load 9–12% faster, bundle-product checkout is 6–12% faster, and the HPOS Orders screen gets optimized multi-status queries alongside compatibility changes like the removal of the block product editor package entirely. (Source)
WordPress 7.1 Beta 3 ships, pulls Unicode email support over security concerns: Released July 22 with more than 70 fixes, Beta 3 also removes Unicode email address support from the 7.1 release after co-founder Matt Mullenweg raised concerns about the security surface the 11-year-old feature would introduce; it will continue development as a standalone community plugin instead. (Source)
Contributors propose design system theming, laying groundwork for the admin redesign: On July 9, Automattic developer Andrew Duthie published a merge proposal to standardize styling across wp-admin in WordPress 7.1, enabling future personalization, branding, and dark-mode work building on the long-delayed admin overhaul that was scaled back to a “coat of paint” in WordPress 7.0. (Source)
A new “Agentic Commerce” extension lands for WooCommerce: A fresh WordPress.org plugin publishes structured product data and discovery files (llms.txt, .well-known/agent.json) so AI shopping agents can find and transact with WooCommerce catalogs, routing payment through the store’s existing gateway rather than a third party. (Source)
🏷️ Exclusive LIFETIME Deals Digest
Stop paying monthly for your favorite tools. We’ve curated an elite collection of Lifetime Deals that allow you to invest once and profit forever. Grab these high-end, premium WordPress solutions at a massive discount today and enjoy professional-grade performance without the recurring fees.
✨ Fresh Features Rollout
WooCommerce selective plugin loading: now cites the actual post (/2026/07/21/selective-plugin-loading/) with the real mechanism (mu-plugin filtering active_plugins), real numbers (800ms→475ms on the subscription-check endpoint), and the author’s own caveat that it’s not a fit for smaller sites. (Source)
WordPress 7.1 Beta 3: now cites the real URL with the actual Beta 3 specifics the “Apply globally” style review step, the specific media-upload fixes, WP Coding Standards 3.4.0, and confirmation that Beta 2 (July 17) carried the wp2shell security fixes. (Source)
7.1 locks in an enforced iframed post editor: Among the roadmap items confirmed for 7.1, the post editor will always run inside an iframe going forward, isolating the editing canvas from admin styles for more predictable rendering one of several changes DreamHost’s developer roundup flags as worth testing ahead of the August release. (Source)
AI-focused sessions added to the WordCamp US schedule: This week’s Gutenberg Times roundup covers new 7.1 dev notes alongside AI-focused sessions being added to the WordCamp US schedule, plus early Playground UI testing. (Source)
Gutenberg 23.6 stable arrives after a July 14 release candidate: The RC shipped July 14 to lock in packages ahead of the July 22 stable release, which extends the experimental Media editor’s cropping controls to the Cover block and shows the admin bar in the Post and Site Editor by default. (Source)
Podcast breaks down what’s landing in 7.1 versus what got punted: The latest Gutenberg Changelog episode walks through proposals under discussion for Core, the calls for testing already underway, and which Gutenberg 23.4/23.5 features are locked in for the 7.1 release. (Source)
WooCommerce 11.0 audit checklist flags Checkout Recovery and HPOS changes: A developer-focused breakdown of the 11.0 beta highlights the new Checkout Recovery feature and further High-Performance Order Storage changes agencies should test on staging before the July 28 GA. (Source)
🆕 Fresh Releases
WordPress 7.0.2, 6.9.5, and 6.8.6: Emergency security releases shipped July 17 to patch the wp2shell RCE chain; sites on 6.8.x only need the SQL-injection fix since the RCE path doesn’t affect that branch. (Source)
WooCommerce 11.0.0: General availability July 28, 2026, following the standard five-week beta cadence Woo has run since late 2024. (Source)
Gutenberg 23.6.0: Released July 22, now requiring WordPress 6.9 or higher and tested up to WordPress 7.0.2. (Source)
Yoast SEO 28.0: Released July 6, adding Elementor V4 atomic-editor compatibility and patching outdated Guzzle HTTP dependencies flagged in security advisories. (Source)
Action Scheduler 4.0.0: Ships alongside WooCommerce 11.0, with failed actions now purging after three months, uniqueness checks that account for arguments, and new daily cleanup jobs. (Source)
🗓️ Mark Your Calendar
If you’re looking for opportunities to network and learn, check out these upcoming WordPress events and meetups:
Flagship WordCamps
August 16 – 19, 2026: WordCamp US 2026, Phoenix, Arizona.
April 09 – 11, 2027: WordCamp Asia 2027, Penang, Malaysia.
Offline Events for WordPress
September 23, 2026: LoopConf 2026, event for WP developers & engineers.
October 16, 2026: WP Suomi 2026, for Nordic WP enthusiasts, Oulu, Finland.
Upcoming WordCamps
September 11, 2026: WordCamp Switzerland 2026, Fribourg, Switzerland.
September 18, 2026: WordCamp Bretagne 2026, Rennes, Brittany, France.
October 03, 2026: WordCamp Rajasthan 2026, Jaipur, Rajasthan, India.
November 05, 2026: WordCamp Canada 2026, Vancouver, Canada.
November 12, 2026: WordCamp Netherlands 2026, Netherlands.
November 13, 2026: WordCamp Pisa 2026, Pisa, Italy.
Wrap-Up
That’s a wrap for this week’s WPDigest! Stay tuned for more exciting WordPress updates next week.
Want to feature your WordPress product, service, or update news? Submit it for free using our form, helping spread the goodness of WordPress!
📩 Enjoyed this digest? Share it with your network!
