Agencies/freelancers who maintain and develop woocommerce shops and websites: Have you been getting requests from your customers (the actual business owners) to give AI access to add content/products, manage orders themselves, or even (god forbid!) develop small features?

Maybe from the more technical people on their staff?

Is this a thing?

I added query loop block in 'home' page. Home is also set as homepage in reading settings.

The posts are visible in editor but not on page when seen in browser.

This site exists on Local.

Thanks!

Been thinking about this lately. I use AI tools for some parts of client work, drafting copy, generating images, sometimes boilerplate code. I always review and edit everything, but I don't explicitly tell clients which parts had AI help. Honestly the stuff I make with AI looks so real that no one has figured it out so far. Part of me feels like as long as the final quality is good it doesn't matter, part of me feels like they should know what they're paying for. What do you guys do? Tell them upfront, or is it just part of the process now?

How are you using AI to design your stores? For example, for a static website, you can use Claude or OpenCode along with a template to create a landing page really quickly, but for sites that actually require WordPress and WooCommerce, how are you doing that?

Wordfence published a write-up today (15 October) of CVE-2026-93953 in Backuply, the backup plugin with more than 600,000 active installs on wordpress.org. CVSS 8.0. Any logged-in user, down to a subscriber, can plant text that turns into SQL when an administrator later restores a backup. Versions up to and including 1.5.8 are affected; the author shipped 1.5.9 on 1 October.

How it works, because the two-step part is what makes it odd. A subscriber puts a crafted string in the Biographical Info field of their own profile. WordPress stores it as plain text in wp_usermeta, and when Backuply makes a database backup it writes that bio into the dump as a correctly quoted value. Nothing is wrong yet. The flaw is in the restore: after running each statement from the dump, Backuply runs an unanchored regular expression over the same statement to find the old table prefix. That pattern is not limited to a real CREATE TABLE line and does not skip quoted values, so it also matches text inside the bio. If the statement also contains the string backuply_version, the captured text is pasted straight into an UPDATE query as if it were the prefix.

So the bio can carry a whole UPDATE statement of the attacker's choosing, ended with a comment marker so the plugin's own trailing SQL is thrown away. Wordfence's example sets default_role to administrator and users_can_register to 1 in wp_options. After the restore, the registration form is open and every new account is an administrator. The attacker registers one and owns the site.

Some calibration on the 8.0. It needs an account on the site, so a site with open registration or a membership or shop setup is the exposed kind. It needs an administrator to restore a backup made after the bio was planted, and nothing runs until that restore happens. Restoring is the whole point of the plugin, so that is a routine action, but a site that only makes backups and never restores is not hit by it. Wordfence says nothing about exploitation in the wild in the write-up. The injection returns nothing to the attacker, so it can only change records, not read them, which is why the privilege escalation goes through those two options.

Timeline from Wordfence: reported 17 September, firewall rule for Premium, Care and Response users on 24 September, vendor told 28 September, patch 1 October, and free Wordfence users get the same rule on 24 October. The plugin's changelog for 1.5.9 says only "fixed a security issue in the restoration process", so the details are in the Wordfence post.

What I would do this week: update Backuply to 1.5.9 on every site that has it, including the ones you forgot about. If you restored a backup in the last few weeks on a site that lets people register, look at Settings, General, and check that "Anyone can register" and the New User Default Role are what you set. Check Users for administrators you did not create. And if you have not updated yet, hold off on restoring any backup that was made while subscribers could edit their profiles.

When you do restore on a site with user accounts, do you check anything first, or do you just trust your own backups?

Have you seen this? This happened yesterday. The owners of the LearnDash plugin did a digital town hall and announced a price increase of more than 100% on some their tiers, now including 3 other plugins from the same company aparantly. So for example from 199 to 399 for one site, and from 399 to 599 for 10 sites. If you had legacy licenses, just in April you would have gotten en Email saying "don't worry, we will honor your licenses".

Well no more honor at LearnDash, it seems.

This smells like a cash grab before collapse. People in their forum are mightily pissed, many saying their final goodbyes from the plugin. And I am betting basically every other plugin studio is panicking right now, too.

Just LearnDash alone had an a third party premium addon costing several hundreds a year, just for B2B functionality, and they claim several thousand users on their own. So thats a whole plugin ecosystem collapsing right now, at this very moment.

Hello, WP commmunity. I'm looking for help on two fronts, one is design related and one is more technical.

One, I am looking to move a very old WP website from Vultr cloud hosting to Namecheap SharedHosting. The old website is running plugins, theme and WP versions from 2009-2014. (WP 4.0.38) Is there any easy way to move all of the WP files and linked image/media files without blowing this whole thing up? Yes, I do want to modernize it, but I wanted to move everything first. (I do have background FTP access, but do not have CPanel or management access on the Vultr anymore - long story.)

Two, disregarding all of the above, how can I build a new, up-to-date responsive WP site that looks and functions similar to the old school PrimePress theme with minimal coding or design knowledge? I want to basically recreate my old site layout, nav, rotating header, colours, etc. while also adding newer features and plug-ins.

Thanks, everyone, for kindly helping a noob like me.

I’ve been wondering about this lately.

When you visit a website that supports multiple languages, do you actually use the language switcher, or do you normally rely on browser translation?

For people managing multilingual sites, do you notice visitors manually changing languages often?

Curious whether traditional language switchers are still as important as they used to be.