WordPress News: Security Patches, Core Updates, WooCommerce Growth (Week of 13 July 2026)

This was a quiet week by WordPress standards: a batch of plugin patches, a routine core update, and steady progress on WooCommerce. Nothing here is a fire drill, but a few things are worth ten minutes of your time.

Update these plugins now, one flaw was rated critical

Wordfence's weekly vulnerability report for June 29 to July 5, published July 9, logged 250 new vulnerabilities across WordPress plugins and themes. The one that matters most: a critical flaw (rated 9.8 out of 10) in Blocksy Companion, the companion plugin bundled with the widely used Blocksy theme. It's already patched in the current version. Also worth knowing about: high severity, already patched issues in Dokan Pro (a popular WooCommerce vendor marketplace plugin) and W3 Total Cache (one of the most common caching plugins), plus a file read flaw in Ninja Forms' File Uploads add-on that let attackers pull files without logging in. Wordfence pushed a firewall rule to Premium, Care and Response customers within a day of that one being disclosed; free version users get the same protection after a 30 day delay.

What this means for you: if you run Blocksy, Dokan Pro, W3 Total Cache or Ninja Forms with the File Uploads add-on, update now if you haven't already. If a host or maintenance plan handles your updates automatically, you're most likely already covered. If you manage updates yourself, this is the week to log in and check. For a wider look at hardening your site beyond just staying patched, see our security best practices guide.

WordPress 7.0.1 fixes a stack of bugs, update when convenient

WordPress released version 7.0.1 on July 9, a maintenance release patching 31 bugs across Core and the Block Editor, mostly touching the admin interface and media handling, according to the official announcement. It follows the 7.0 release, which introduced real time collaborative editing, a feature developers have debated more than site owners have asked for, a bit like arguing over whether the Death Star's exhaust port really needed to be that wide. Nothing in 7.0.1 is security related, it's straightforward bug fixing ahead of WordPress 7.1, due in August.

What this means for you: sites with automatic background updates already have this. If you update manually, there's no urgency, but no reason to put it off either. If your process includes testing updates before they go live, our guide to running a staging site covers how to do that safely.

WooCommerce 11.0 is shaping up around real performance work

WooCommerce published its developer preview for version 11.0 on July 13. The headline items are performance improvements for larger stores (including product object caching, already rolling out for new stores), more flexible customer and order email flows, reporting improvements, and a set of compatibility changes extension developers will need to account for, per the WooCommerce developer blog.

What this means for you: if your store is small to mid sized, this is good news that arrives automatically, faster admin screens and cleaner reporting with no action needed. If you run a high volume store and have noticed WooCommerce straining under a large catalogue or order volume, this release shows the core team is paying attention to that pain point too. That said, some businesses with genuinely heavy requirements, huge catalogues, complex fulfilment logic, multi warehouse stock, eventually reach a point where even a well tuned WooCommerce store is the wrong tool for the job, and a custom built system makes more sense. That's a conversation worth having with a developer, not a plugin decision.

WooCommerce Bookings adds the CSV import merchants have been asking for

WooCommerce Bookings shipped updates on July 8 adding CSV import and export, calendar improvements, and accessibility fixes, according to the WooCommerce blog. If you run appointments, rentals or reservations through WooCommerce, bulk managing bookings by spreadsheet has been a long standing gap.

What this means for you: nothing to fix here, just a genuine improvement if you use Bookings. Update the extension when convenient to get the new import and export tools.

Wrap up

Nothing this week demands an emergency response, but the plugin patches are worth acting on soon rather than later. If a maintenance plan is already handling your updates and monitoring, you're covered. If it isn't, this week is as good a reminder as any of why one matters, see what a proper maintenance plan actually includes.

May the Code Be With You.