The WordPress Guy

· 1mo ago

If your site runs Elementor Pro with a file upload field in any form, patch immediately. Versions 4.2.1 and below contain a critical flaw that allows complete site takeover — no account, no password, no interaction required. The upload field your visitors use daily is the attack vector. I recommend updating now without delay. #WordPress #Elementor #WebSecurity #WordPressSecurity #SecurityHardening https://wpguy.uk/blog/elementor-pro-file-upload-vulnerability-patch-now/

Elementor Pro File Upload Vulnerability: Patch Now | The WordPress Guy

If your site runs Elementor Pro and you have ever added a file upload field to a form, an attacker can take complete control of your site without holding

· 1mo ago

With 59,000+ free plugins available, the question is never just "which plugin does this job" — it is "which plugin does this job without costing more than it delivers." Quality beats quantity every time. A lean set of well-coded plugins will always outperform a bloated collection. #WordPress #WebPerformance #WordPressPlugins #PerformanceOptimisation https://wpguy.uk/blog/which-wordpress-plugins-actually-improve-site-speed-and-business-performance/

How to Choose WordPress Plugins That Don

Plugin selection is a commercial decision. Every plugin you install adds maintenance overhead, broadens your security exposure, and either contributes to

· 3mo ago

Three plugins I keep a close eye on — WPForms (6M+ sites), WPvivid, and Smart Slider 3 — all had vulnerabilities publicly disclosed in June 2026. Patches are available for all three. If you have not updated recently, your site is likely exposed. Worth checking your versions today. #WordPress #WordPressSecurity #WPForms #PluginUpdates #WebsiteSecurity https://wpguy.uk/blog/wordpress-plugin-vulnerabilities-in-june-2026-what-site-owners-must-know/

WPForms, WPvivid & Smart Slider 3 Vulnerabilities Patched | The WordPress Guy

If your WordPress site is running WPForms, WPvivid, or Smart Slider 3, and those plugins have not been updated in the past few weeks, your site is exposed

· 3mo ago

250+ WordPress plugin vulnerabilities are disclosed every week in 2026 — that is not a spike, it is the baseline. What concerns me most is that 43% require no login to exploit. Automated scanners find vulnerable sites before most owners even know a patch exists. This is the environment I work in daily, and it demands a serious approach to hardening. #WordPress #WebSecurity #WordPressSecurity #PluginSecurity https://wpguy.uk/blog/wordpress-plugin-vulnerabilities-are-rising-what-business-owners-must-know/

WordPress Plugin Vulnerabilities: What

Over 250 new WordPress plugin vulnerabilities are disclosed every week. This is the normal operating condition of the WordPress plugin ecosystem in 2026,

· 2mo ago

UK high street footfall dropped 6.2% in June — four times the May decline. Scotland, where it stayed cooler, actually saw a 1.7% increase. Shoppers are not disappearing, they are redirecting. For WooCommerce store owners, that shift is worth paying attention to. #WooCommerce #WordPress #eCommerce #UKRetail #OnlineShopping https://wpguy.uk/blog/why-uk-heatwaves-are-pushing-more-shoppers-to-buy-online/

How Heatwaves Are Driving Shoppers Online to WooCommerce | The WordPress Guy

UK high street footfall fell 6.2% year-on-year in June, against a 1.5% decline in May, a fourfold acceleration in a single month. British Retail

· 2mo ago

Tide has attracted over 1.5 million UK businesses, which is worth pausing on. I took a proper look at whether their free plan genuinely suits small business workflows or quietly costs more than a paid account would. My verdict might surprise you. #WordPress #SmallBusiness #BusinessBanking #Tide #UKBusiness https://wpguy.uk/blog/free-uk-business-bank-account-is-tide-right-for-your-small-business/

Tide Business Account: Is the Free Plan Worth It? | The WordPress Guy

Picking a business bank account feels like a minor administrative task until the fees start adding up or your accounting software refuses to connect. For

· 2mo ago

WordPress 7.1 drops on 19 August 2026. Beta 1 landed on 15 July, which means the testing window is already open. I've seen live sites break on smaller releases than this — a checkout or corrupted layout mid-upgrade is not a risk worth taking. My advice: test before August, not after. #WordPress #WordPressDeveloper #WebDevelopment #BusinessWebsites #WordCamp https://wpguy.uk/blog/wordpress-71-is-coming-what-business-owners-need-to-do-now/

WordPress 7.1: What Business Sites Must Do Before August | The WordPress Guy

The release date is fixed. WordPress 7.1 arrives on 19 August 2026, timed with WordCamp US, and the window between now and then is preparation time. If

· 2mo ago

A critical WordPress RCE vulnerability, wp2shell, was disclosed on 17 July 2026. It chains a REST API route confusion flaw with an SQL injection in WP_Query — no login required, no plugin involved. If my site were unpatched, an attacker could take full control. Check your WordPress version now. #WordPress #Security #WordPressSecurity #WebSecurity #RCE https://wpguy.uk/blog/is-your-wordpress-site-exposed-to-the-wp2shell-remote-code-execution-flaw/

wp2shell: Patch the WordPress RCE Flaw Now | The WordPress Guy

A critical flaw in WordPress core was made public on 17 July 2026. If your site has not received the patch, an attacker can take full control of it

· 2mo ago

If your WooCommerce store relies heavily on Google Shopping, the EU's July 2026 Digital Markets Act decisions matter to you. Google must now share anonymised search ranking data with rivals, which could shift how product discovery works across the board. I'd read up on this before assuming your current traffic sources stay stable. #WooCommerce #WordPress #GoogleShopping #DigitalMarketsAct #eCommerce https://wpguy.uk/blog/will-google-losing-its-eu-data-monopoly-change-how-your-woocommerce-store-gets-found/

Google

If your WooCommerce store gets most of its traffic from Google Shopping and Google

· 2mo ago

TikTok contributed £10 billion to the UK economy in 2025 and supported 153,000 jobs. If your WooCommerce store has no presence there, someone else is taking those sales. I help store owners connect WooCommerce to TikTok Shop so their products reach buyers who are already ready to purchase. #WooCommerce #TikTokShop #WordPress #eCommerce #WordPressEngineer https://wpguy.uk/blog/is-your-woocommerce-store-missing-out-on-tiktoks-10bn-sales-opportunity/

Grow Your WooCommerce Store With TikTok Shop Integration | The WordPress Guy

TikTok contributed £10 billion to the UK economy in 2025 and supported 153,000 jobs, according to a Public First and EY report. That figure is the

· 2mo ago

If you're running WordPress 6.9.0 through 7.0.1, working exploit scripts are already circulating publicly on GitHub — right now, before 7.1 even ships on 19 August. I would not wait for release day on this one. Update the moment 7.1 lands. #WordPress #WordPressSecurity #WebDev #WordCamp #WPGuy https://wpguy.uk/blog/wordpress-71-is-coming-what-business-owners-need-to-know-now/

WordPress 7.1: Security Flaw Puts 6.9–7.0.1 Sites at Risk | The WordPress Guy

A major WordPress update lands on 19 August 2026, timed with WordCamp US 2026, and the beta cycle is already revealing exactly why this one deserves your

· 2mo ago

UK WooCommerce merchants running both online and in-person sales have always faced a stock sync headache — something selling at a market before the online listing updates. The new iPhone POS integration addresses that directly by keeping everything inside one system. Worth a look if you split your sales across locations. #WooCommerce #WordPress #pointofsale #ecommerce #ukbusiness https://wpguy.uk/blog/how-uk-woocommerce-stores-can-now-take-card-payments-with-just-an-iphone/

wpguy.uk

· 2mo ago

Fluent Forms CVE-2026-16655 scores 7.2 on the CVSS scale — High severity — and allows data manipulation or extraction without admin credentials. If my sites were running Fluent Forms below 6.2.8, updating would be my immediate priority. Check your version now and update to 6.2.8. #WordPress #WordPressSecurity #FluentForms #CVE #WebSecurity https://wpguy.uk/blog/high-vulnerability-in-fluent-forms-customizable-contact-forms-survey-quiz-amp-conversational-form-builder-fluent-forms-customizable-contact-forms-survey-quiz-amp-conversational-form-bui/

Fluent Forms CVE-2026-18146: Update to 6.2.12 Now | The WordPress Guy

If your site runs Fluent Forms and you have not updated it since 13 August 2026, an attacker may already be scanning for your installation. The

#WordPress #Security #WordPressSecurity #RCE #Patching

· 2mo ago

If your WordPress site runs 6.8.x, 6.9.x, or 7.0.x and has not been patched recently, the wp2shell vulnerability chain disclosed in July 2026 allows full admin takeover via SQL injection — no credentials required. I would check your version right now and update immediately.

https://wpguy.uk/blog/is-your-wordpress-site-safe-after-july-2026s-record-security-patch-wave/

#WordPress #WordPressSecurity #WP2Shell #CVE #SecurityHardening

· 2mo ago

WP2Shell is being actively exploited right now. If your site runs WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1, a single unauthenticated HTTP request can hand an attacker full control. No plugin, no login, no prior access needed. CVSS 9.8. Update immediately.

https://wpguy.uk/blog/wp2shell-what-wordpress-site-owners-must-do-right-now/

#WordPress #WordPressSecurity #CVE #WebSecurity #WPSecurity

· 2mo ago

Two CVEs in WordPress 6.8 and 6.9 were patched on 17 July 2026. One allows arbitrary code execution on your server — that is as serious as it sounds. If my sites were still on either version, updating to 7.0.2 would be the first thing I did this morning. Both CVEs are publicly logged, meaning unpatched sites are visible targets.

https://wpguy.uk/blog/wordpress-security-flaw-what-business-owners-must-do-right-now/

#WordPress #SelfEmployed #VAT #UKBusiness #SmallBusiness

· 2mo ago

Many self-employed owners only discover they have crossed the £90,000 VAT threshold at year end — by which point they already owe VAT they never collected. If you expect to hit it within 30 days, you must register before reaching it. I have linked a full guide below.

https://wpguy.uk/blog/vat-registration-for-the-self-employed-what-business-owners-must-know-in-2026/

VAT Registration Guide for UK Self-Employed Business Owners | The WordPress Guy

The VAT threshold sits at £90,000 of taxable turnover over any rolling 12-month period. Cross it, and registration becomes a legal requirement. If you

#WordPress #Security #WordPressSecurity #PluginSecurity

· 3mo ago

Critical plugin flaws disclosed in June 2026 mean attackers can create admin accounts with no password — WP Maps Pro exposes a nonce in every frontend page, making its "protection" worthless. I see sites exploited within hours of disclosure. Patch immediately or remove plugins you are not actively using.

https://wpguy.uk/blog/wordpress-plugin-flaws-in-june-2026-put-thousands-of-business-sites-at-risk/

#WooCommerce #WordPress #UKVat #eCommerce #OnlineRetail

· 3mo ago

Up to £3.2 billion in UK online retail sales each year involve sellers fraudulently claiming to be UK-established to dodge VAT. That 20% margin gives overseas operators a structural pricing advantage over legitimate sellers. As a WooCommerce specialist, I'm watching this consultation closely — the outcome will directly affect how UK stores compete.

https://wpguy.uk/blog/vat-loophole-costing-uk-online-sellers-millions-what-changes-next/

#WooCommerce #Shopify #WordPress #RetailTech #eCommerce

· 3mo ago

Quadrant, Lando Norris's sports brand, chose Shopify to run their London pop-up at Outernet ahead of British Grand Prix week — opening in days, not weeks. In my view, WooCommerce can handle pop-up retail, but it requires more setup time. Worth weighing up before your next physical activation.

https://wpguy.uk/blog/can-woocommerce-power-a-pop-up-store-as-well-as-shopify-can/

#WooCommerce #eCommerce #WordPress #ReturnsPolicies #OnlineRetail

· 3mo ago

Stricter returns policies are quietly killing WooCommerce sales. Locus research puts £34.1bn in UK online revenue at risk because shoppers are abandoning stores with tough returns rules. I see this with clients regularly — tightening policy to cut costs often costs more in lost conversions. Worth reviewing before your next sale season.

https://wpguy.uk/blog/could-your-returns-policy-be-costing-your-woocommerce-store-customers/

#WordPress #WooCommerce #PCICompliance #WebSecurity #WordPressSecurity

· 3mo ago

PCI DSS certification confirms you met a minimum standard for handling cardholder data. It does not confirm your WooCommerce checkout is secure. Conflating the two is one of the more expensive mistakes a store owner can make — and I see it regularly.

https://wpguy.uk/blog/why-pci-compliance-alone-will-not-protect-your-woocommerce-checkout/

· 2w ago

WordPress 6.7.2 patches a confirmed critical-severity remote code execution vulnerability — meaning an attacker can run code on your server with no login credentials whatsoever. In my view, this is not optional. If you have not updated yet, do it now. The risk of malware, hidden admin accounts, and data theft is real and immediate. #WordPress #Security #WebDev #WordPressSecurity #WPGuy https://wpguy.uk/blog/wordpress-672-critical-rce-patch-you-must-apply-now/