Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 51, where you get curated news about WordPress and the WordPress community all in one place.
I know, I am one day late. Sorry for the delay!
Nearly half the WordPress plugin directory has gone stale, WooCommerce 11.0 is out with real speed and analytics improvements, your REST API is probably more exposed than you think, small purpose-built plugins deserve a second look, and WordPress 7.0.3 just patched 12 vulnerabilities as AI-assisted bug hunting hits an all-time high.
The WordPress Plugin Directory Has a Staleness Problem
WooCommerce 11.0 Brings Speed Gains and Smarter Analytics
Why You Should Lock Down Your WordPress REST API
The Case for Small, Purpose-Built WordPress Plugins
WordPress 7.0.3 Patches 12 Vulnerabilities Amid AI-Powered Bug Bounty Surge
A new report from WP Goldmine analyzed 60,257 WordPress plugins and found that 43.8% have not been updated in over two years. Among plugins with 10,000 or more active installs, 207 have been abandoned for at least two years, with Limit Login Attempts (300K+ installs) topping that list.
The support data tells a similar story: Classic Editor has 9M+ installs but only a 10% support resolution rate. W3 Total Cache sits at 28%. For plugin developers, every stale high-install plugin is an opening for a modern, maintained alternative. For site owners: audit what’s running. If a plugin hasn’t shipped an update in years and has unresolved support threads, replace it.
Read the full blog on WP Goldmine →
WooCommerce 11.0 shipped this week, and it has concrete speed numbers worth knowing.
Variable product pages now load 9-12% faster in WooCommerce 11.0, thanks to a new product object caching experiment enabled by default for new stores. Bundle products are 6-12% faster at checkout too.
Analytics reporting also gets more accurate: refunds now count in the period they happened, making month-by-month figures more trustworthy. Session tracking is stricter, stripping out bots and fleeting connections that were inflating visitor counts. Guest customers can now connect past orders to a new account just by confirming their email. A Checkout Recovery beta lets you test recovery messaging before rolling it out broadly. Note that the experimental Product Editor beta is retired in this release, though your product data stays intact.
Read the full blog on WooCommerce →
Faster sites are good, but most WordPress installs have a security surface that often goes unexamined.
The WordPress REST API powers the block editor, wp-admin, and dozens of plugins, and by default it exposes quite a bit publicly. A recent deep-dive from WebTNG shows what the API makes visible to unauthenticated visitors, including a full list of registered endpoints from core and active plugins, and walks through why leaving it open is a risk.
Two approaches are covered: restrict API access to logged-in users only, or disable all endpoints by default and re-enable only what your site needs. The latter is more precise. Re-enabling an analytics plugin’s endpoint after a blanket lockdown, for instance, keeps front-end tracking intact without reopening anything else. The public oEmbed endpoint is also flagged as the one implicated in a recent Remote Code Execution vulnerability.
Read the full blog on WebTNG →
How you choose plugins shapes how easy the site is to debug and hand off six months later.
A plugin that does one thing is easier to debug, safer to disable, and clearer to hand off months later. Developer V. Chuy makes the case for single-purpose plugins over all-in-one solutions on client sites, and the maintenance argument is solid.
Large plugins bring extra database tables, frontend assets, unnecessary hooks, and third-party dependencies even when you only need one feature. A small plugin with a descriptive name like client-checkout-rules makes its purpose obvious. The article covers practical safeguards: check dependencies before calling plugin code, validate input, use nonces for forms and AJAX, and decide what happens on deactivation. A WooCommerce example shows how an order flag can live in a compact standalone plugin rather than inside a sprawling tool.
Read the full blog on V. Chuy Develop →
Leaner plugin stacks help, but the WordPress Security Team has had a busy week on core itself.
WordPress 7.0.3 shipped with fixes for 12 security vulnerabilities. The most serious is a pre-authentication cross-site scripting flaw on the login screen that could enable remote code execution through social engineering. Sites with automatic updates should already be patched. Backports cover branches back to WordPress 4.7.
Bug bounty submissions to the WordPress HackerOne program hit 450 in July, up from a steady 20-30 per month for the previous decade. AI-assisted research is driving it. After a researcher found a WordPress RCE using OpenAI’s Sol Ultra for roughly $25, rival labs took notice. Anthropic, pwn.ai, and Aikido Security are all credited in this release. WordPress Security Team lead John Blackbourn confirmed GPT 5.3 and Claude Opus 4.6 as the main drivers. WordPress 7.1 remains on track for August 19.
Read the full report on The Repository →
→ Patchstack Challenges WordPress.org to Fast-Track Security Fixes Under Protect the Shire (therepository.email) - Patchstack tracked 114 releases and found security patches get held just as long as cosmetic updates under the Protect the Shire policy.
→ For the First Time in 10 Years, I Built a Site With No Page Builder (linkedin.com)
→ WordPress 7.1 Source of Truth (gutenbergtimes.com)
→ Getting Started With the WordPress Abilities API: A Practical Guide (kinsta.com)
→ WordPress Blocks Breaking in 7.1? Here’s Why (youtube.com)
→ Our Own Newsletter Took the Site Down (developer.woocommerce.com)
→ Meet the New WordPress Playground Interface (make.wordpress.org)
→ Plugins Directory Release Process Issues (make.wordpress.org)
→ What’s New in Gutenberg 23.7? (05 August) (make.wordpress.org)
→ Iframed Editor Changes in WordPress 7.1 (make.wordpress.org)
→ AI Contributor Weekly Summary - 5 August 2026 (make.wordpress.org)
→ WordPress Credits Adds 10 New Partner Institutions in a Single Month as Education Programs Continue Pushing Into New Regions (therepository.email)
→ Pull Up a Chair for the State of Open Source (us.wordcamp.org)
→ Defensive Data Design (make.wordpress.org)
→ Leaner, Steadier PHPUnit Runs for Upcoming Releases (make.wordpress.org)
→ WordPress 7.1 Beta 4 Is Here (wordpress.org)
→ WordPress 7.1 Release Candidate 1 Ships With Field Guide and 145 Fixes Ahead of WordCamp US Launch (therepository.email)
→ Perspectives with Josepha Haden Chomphosy (crossword.fm)
→ Ceilingless WooCommerce: Why Merchants Don’t Need to Outgrow Open Source (urumi.ai)
→ Poland Warns of Critical WordPress Flaws That Could Let Attackers Seize Servers (tvpworld.com)
→ Automattic’s Anne McCarthy Joins the PHP Foundation Board (therepository.email)
→ DocsBot Launches Free AI Sidekick for WordCamp US 2026 Attendees, Builds It a Physical Body Too (therepository.email)
→ WPManageNinja Discloses Supply Chain Attack After Forgotten Server Delivers Tampered Plugin Updates (therepository.email)
→ Why I’m Organizing CMS Conf (maciekpalmowski.dev)
→ Md Noruzzaman Receives the Yoast Care Fund for His Contributions to the WordPress Community (yoast.com)
→ 3 Failed WP-Admin Projects, Let’s Go for the 4th! (anchor.host)
→ A Year of Working on My Content: What Happened in Search and AI (alwaysopen.design)
→ Why It Took Me 16 Years to Contribute to WordPress (shifteq.com)
→ AI in WordPress...The New Era (Jeffrey @ Lytbox with Shahjahan Jewel) (youtube.com)
→ What Experts Say About WordPress Future (youtube.com)
WordPress 7.0.3 patched 12 vulnerabilities this week while bug bounty reports jumped from 30 to 450 a month. Patchstack’s data shows those patches sit in the queue just as long as cosmetic updates. Meanwhile, nearly half the plugin directory hasn’t shipped an update in two years, WooCommerce 11.0 brings real speed numbers, and your REST API is probably more open than you think.
Plenty to act on. Have you audited your plugin stack lately? Locked down your REST API? Reply and let me know where you’re at. If this issue was useful, share it with someone in the WordPress world who’d appreciate the roundup.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Thanks for reading WP More! This post is public, so feel free to share it.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.