WordPress plugin opportunities, WooCommerce 11.0, REST API security, and a bug bounty spike.
This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 51, where you get curated news about WordPress and the WordPress community all in one place.
I know, I am one day late. Sorry for the delay!
Nearly half the WordPress plugin directory has gone stale, WooCommerce 11.0 is out with real speed and analytics improvements, your REST API is probably more exposed than you think, small purpose-built plugins deserve a second look, and WordPress 7.0.3 just patched 12 vulnerabilities as AI-assisted bug hunting hits an all-time high.
In this Issue:
- The WordPress Plugin Directory Has a Staleness Problem
- WooCommerce 11.0 Brings Speed Gains and Smarter Analytics
- Why You Should Lock Down Your WordPress REST API
- The Case for Small, Purpose-Built WordPress Plugins
- WordPress 7.0.3 Patches 12 Vulnerabilities Amid AI-Powered Bug Bounty Surge
The WordPress Plugin Directory Has a Staleness Problem
A new report from WP Goldmine analyzed 60,257 WordPress plugins and found that 43.8% have not been updated in over two years. Among plugins with 10,000 or more active installs, 207 have been abandoned for at least two years, with Limit Login Attempts (300K+ installs) topping that list.
The support data tells a similar story: Classic Editor has 9M+ installs but only a 10% support resolution rate. W3 Total Cache sits at 28%. For plugin developers, every stale high-install plugin is an opening for a modern, maintained alternative. For site owners: audit what’s running. If a plugin hasn’t shipped an update in years and has unresolved support threads, replace it.
Read the full blog on WP Goldmine →
WooCommerce 11.0 shipped this week, and it has concrete speed numbers worth knowing.
WooCommerce 11.0 Brings Speed Gains and Smarter Analytics
Variable product pages now load 9-12% faster in WooCommerce 11.0, thanks to a new product object caching experiment enabled by default for new stores. Bundle products are 6-12% faster at checkout too.
Analytics reporting also gets more accurate: refunds now count in the period they happened, making month-by-month figures more trustworthy. Session tracking is stricter, stripping out bots and fleeting connections that were inflating visitor counts. Guest customers can now connect past orders to a new account just by confirming their email. A Checkout Recovery beta lets you test recovery messaging before rolling it out broadly. Note that the experimental Product Editor beta is retired in this release, though your product data stays intact.
Read the full blog on WooCommerce →
Faster sites are good, but most WordPress installs have a security surface that often goes unexamined.
Why You Should Lock Down Your WordPress REST API
The WordPress REST API powers the block editor, wp-admin, and dozens of plugins, and by default it exposes quite a bit publicly. A recent deep-dive from WebTNG shows what the API makes visible to unauthenticated visitors, including a full list of registered endpoints from core and active plugins, and walks through why leaving it open is a risk.
Two approaches are covered: restrict API access to logged-in users only, or disable all endpoints by default and re-enable only what your site needs. The latter is more precise. Re-enabling an analytics plugin’s endpoint after a blanket lockdown, for instance, keeps front-end tracking intact without reopening anything else. The public oEmbed endpoint is also flagged as the one implicated in a recent Remote Code Execution vulnerability.
Read the full blog on WebTNG →
How you choose plugins shapes how easy the site is to debug and hand off six months later.
Brought to you by
WP More Socials
I send this newsletter every week, but do you want to keep up with WordPress and the community?
Then follow WP More’s social profile.
X (formerly Twitter) – https://x.com/WPMoree
LinkedIn – https://www.linkedin.com/company/wordpress-more/
BlueSky – https://bsky.app/profile/wpmore.bsky.social
I post there every day. So, you are not going to miss anything.
Follow WP More, Stay Updated with WordPress!
The Case for Small, Purpose-Built WordPress Plugins
A plugin that does one thing is easier to debug, safer to disable, and clearer to hand off months later. Developer V. Chuy makes the case for single-purpose plugins over all-in-one solutions on client sites, and the maintenance argument is solid.
Large plugins bring extra database tables, frontend assets, unnecessary hooks, and third-party dependencies even when you only need one feature. A small plugin with a descriptive name like client-checkout-rules makes its purpose obvious. The article covers practical safeguards: check dependencies before calling plugin code, validate input, use nonces for forms and AJAX, and decide what happens on deactivation. A WooCommerce example shows how an order flag can live in a compact standalone plugin rather than inside a sprawling tool.
Read the full blog on V. Chuy Develop →
Leaner plugin stacks help, but the WordPress Security Team has had a busy week on core itself.
WordPress 7.0.3 Patches 12 Vulnerabilities Amid AI-Powered Bug Bounty Surge
WordPress 7.0.3 shipped with fixes for 12 security vulnerabilities. The most serious is a pre-authentication cross-site scripting flaw on the login screen that could enable remote code execution through social engineering. Sites with automatic updates should already be patched. Backports cover branches back to WordPress 4.7.
Bug bounty submissions to the WordPress HackerOne program hit 450 in July, up from a steady 20-30 per month for the previous decade. AI-assisted research is driving it. After a researcher found a WordPress RCE using OpenAI’s Sol Ultra for roughly $25, rival labs took notice. Anthropic, pwn.ai, and Aikido Security are all credited in this release. WordPress Security Team lead John Blackbourn confirmed GPT 5.3 and Claude Opus 4.6 as the main drivers. WordPress 7.1 remains on track for August 19.
Read the full report on The Repository →
WordPress Must Read
→ Patchstack Challenges WordPress.org to Fast-Track Security Fixes Under Protect the Shire (therepository.email) – Patchstack tracked 114 releases and found security patches get held just as long as cosmetic updates under the Protect the Shire policy.
→ For the First Time in 10 Years, I Built a Site With No Page Builder (linkedin.com)
→ WordPress 7.1 Source of Truth (gutenbergtimes.com)
→ Getting Started With the WordPress Abilities API: A Practical Guide (kinsta.com)
→ WordPress Blocks Breaking in 7.1? Here’s Why (youtube.com)
On Other WordPress News
→ Our Own Newsletter Took the Site Down (developer.woocommerce.com)
→ Meet the New WordPress Playground Interface (make.wordpress.org)
→ Plugins Directory Release Process Issues (make.wordpress.org)
→ What’s New in Gutenberg 23.7? (05 August) (make.wordpress.org)
→ Iframed Editor Changes in WordPress 7.1 (make.wordpress.org)
→ AI Contributor Weekly Summary – 5 August 2026 (make.wordpress.org)
→ WordPress Credits Adds 10 New Partner Institutions in a Single Month as Education Programs Continue Pushing Into New Regions (therepository.email)
→ Pull Up a Chair for the State of Open Source (us.wordcamp.org)
→ Defensive Data Design (make.wordpress.org)
→ Leaner, Steadier PHPUnit Runs for Upcoming Releases (make.wordpress.org)
→ WordPress 7.1 Beta 4 Is Here (wordpress.org)
→ WordPress 7.1 Release Candidate 1 Ships With Field Guide and 145 Fixes Ahead of WordCamp US Launch (therepository.email)
From WordPress Community
→ Perspectives with Josepha Haden Chomphosy (crossword.fm)
→ Ceilingless WooCommerce: Why Merchants Don’t Need to Outgrow Open Source (urumi.ai)
→ Poland Warns of Critical WordPress Flaws That Could Let Attackers Seize Servers (tvpworld.com)
→ Automattic’s Anne McCarthy Joins the PHP Foundation Board (therepository.email)
→ DocsBot Launches Free AI Sidekick for WordCamp US 2026 Attendees, Builds It a Physical Body Too (therepository.email)
→ WPManageNinja Discloses Supply Chain Attack After Forgotten Server Delivers Tampered Plugin Updates (therepository.email)
→ Why I’m Organizing CMS Conf (maciekpalmowski.dev)
→ Md Noruzzaman Receives the Yoast Care Fund for His Contributions to the WordPress Community (yoast.com)
→ 3 Failed WP-Admin Projects, Let’s Go for the 4th! (anchor.host)
→ A Year of Working on My Content: What Happened in Search and AI (alwaysopen.design)
→ Why It Took Me 16 Years to Contribute to WordPress (shifteq.com)
→ AI in WordPress…The New Era (Jeffrey @ Lytbox with Shahjahan Jewel) (youtube.com)
→ What Experts Say About WordPress Future (youtube.com)
Until Next Week
WordPress 7.0.3 patched 12 vulnerabilities this week while bug bounty reports jumped from 30 to 450 a month. Patchstack’s data shows those patches sit in the queue just as long as cosmetic updates. Meanwhile, nearly half the plugin directory hasn’t shipped an update in two years, WooCommerce 11.0 brings real speed numbers, and your REST API is probably more open than you think.
Plenty to act on. Have you audited your plugin stack lately? Locked down your REST API? Reply and let me know where you’re at. If this issue was useful, share it with someone in the WordPress world who’d appreciate the roundup.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply