WordPress News: Critical Core Exploit, WooCommerce 11.0 (Week of 28 July 2026)

This week has one clear headline: a critical, unauthenticated flaw in WordPress core itself is being actively exploited, and the window between "patch available" and "attackers using it" was measured in minutes, not days. Alongside that, WooCommerce shipped its 11.0 release with a few breaking changes worth knowing about before you click update.

Patch WordPress core today if you have not already

On 17 July 2026, the WordPress security team released versions 7.0.2, 6.9.5, and 6.8.6 to fix two vulnerabilities that, chained together, let an anonymous attacker take over a default WordPress install with no plugins involved. The exploit chain is now known publicly as "wp2shell." Wordfence's writeup on the aftermath confirms WordPress 6.9.x and 7.0.x are affected by the full remote code execution chain, while 6.8.x is affected only by the underlying SQL injection.

Here is the part that should get your attention: according to Patchstack's detailed traffic analysis, the first real exploitation attempts hit their sensors roughly ninety minutes after the patched version was released, not days later. In the days that followed, Patchstack alone blocked more than 65,000 exploitation attempts from over 1,500 unique IP addresses, most of it automated scanning to find unpatched sites, but a small number of attackers went straight for creating a rogue administrator account. It is less a distant threat and more a "these are not the droids you are authorized to have on your site" situation: if you are still running an unpatched version, assume someone has already tried the door.

What this means for you: If your WordPress version is below 7.0.2, 6.9.5, or 6.8.6, update immediately, today, not next week. Most reputable hosts and managed WordPress providers will have already pushed this automatically, but self-managed sites and older installs need manual attention. After updating, check for administrator accounts you do not recognise, plugins you did not install, and stray files in your uploads folder. If you find any of those, treat it as a confirmed compromise and follow our hacked site recovery guide rather than just deleting the obvious stuff and hoping. If you are already patched and have not seen anything unusual, you are fine.

WooCommerce 11.0 is out, and a few things changed under the hood

WooCommerce 11.0 reached general availability on 28 July 2026, following the vendor's usual five-week release cadence. According to WooCommerce's own developer notes, the headline items are performance improvements aimed at larger catalogues, a new (still-beta) checkout recovery flow for abandoned carts, and the retirement of the old block-based product editor beta in favour of the current editor. Two changes are worth flagging specifically because they can quietly break custom code: the product shipping-class taxonomy is now private rather than public, and the Shop page's get_queried_object() call now returns a different object type than before. Neither of these affects a standard store using off-the-shelf themes and plugins, but they can trip up custom-built integrations or older extensions that were written against the old behaviour.

What this means for you: If you run a fairly standard WooCommerce store with mainstream plugins, this update should be routine, back up first as always, then update. If you or your developer have custom code that touches shipping classes or the Shop page programmatically, test the update on a staging site before pushing it live. This is exactly the kind of update where "it worked on my last three sites" is not a substitute for checking your specific one.

This is also a good moment to say plainly: if your store's checkout, inventory, or shipping logic has grown complex enough that every WooCommerce release means a stressful afternoon of testing, that is a sign the platform is being asked to do more than it was built for out of the box. Some businesses reach a point where a custom-built solution, rather than an increasingly customised WooCommerce install, is the more stable long-term answer. That is not a knock on WooCommerce, most stores never hit that ceiling, but a few genuinely do.

The pattern this week

Both stories point to the same underlying lesson: WordPress and WooCommerce move fast, security researchers and attackers move even faster, and the gap between "there is an update" and "you should have already applied it" keeps shrinking. Ninety minutes is not a lot of runway.

If keeping up with this pace is not something you want to manage yourself, this is precisely what a maintenance plan is for: updates get applied on a monitored schedule, security patches like this week's core fix go out without you having to watch security blogs, and someone is actually looking at your site rather than hoping nothing goes wrong. It is not glamorous work, but this week is a good reminder of why it matters.

May the Code Be With You.