Uncategorized

On 12 August 2026, an advisory landed for WooCommerce Subscriptions: unauthenticated PHP object injection, escalating to remote code execution, in every version below 9.1.0. The trigger condition is the interesting part — it applies when High-Performance Order Storage is switched on. HPOS is switched on here. So before writing anything about it, I ran the…

Verified — 20 August 2026, against the shipped release: Guidelines is not in WordPress 7.1. This post said the Guidelines feature appeared in the June roadmap, was absent from the August Field Guide, and that secondary coverage contradicted itself — and it declined to call the outcome. Here is the outcome, checked rather than read…

WordPress 7.0.4 patches an Author+ RCE. Our automatic updates were enabled and it still never installed. Here is the measurement, and the 30-second check.

Between 31 July and 13 August 2026, this site logged 157,619 requests. About 5% of them claimed to be an AI crawler — GPTBot, ClaudeBot, PerplexityBot, ChatGPT-User, OAI-SearchBot. We checked each one against the IP ranges the vendors publish themselves. Forty-six percent were not who they said they were. That number matters because “how much…

There is a setting in our chatbot’s admin screen that says transcripts are deleted after one month. It is set. It has been set for a long time. This morning I checked whether it actually happens, and the honest answer is that the job responsible for it last ran on 9 August and is not…

WordPress now runs an AI security review over plugin and theme updates before they reach your site, and holds each release for a cooldown period first. It is called Protect The Shire, it has been live since June, and it is a genuinely good idea. This morning I pointed it at my own install and…

Correction — 19 August 2026: the increase described below will not happen. This post was published on 10 August 2026 and argued, correctly at the time, that Claude Sonnet 5 would move from $2/$10 to $3/$15 per million tokens on 1 September. Anthropic has since reversed that. Its pricing documentation now carries this note: “The…

One article of the EU Cyber Resilience Act starts applying on 11 September 2026, and it lands on commercial WordPress plugin vendors — including free plugins with a Pro tier.

On 2 August 2026, Article 50 of the EU AI Act became applicable. Most of the coverage aimed at WordPress site owners — including ours — was about the chatbot: the widget in the corner now has to tell people it is an AI. That is the visible half. The half that reaches more WordPress…

If you run a WooCommerce store, you have probably read that AI agents are about to start buying things on your customers’ behalf, and that you should get ready. What almost none of that coverage tells you is that the readiness work is already sitting in your plugins directory. WooCommerce 11.0.0 ships a complete implementation…