The WordPress Guy

The WordPress Guy

@wpguy.uk

#ActuallyAutistic WordPress developer specialising in forensic troubleshooting, security and performance. 20 years experience. 🏴󠁧󠁢󠁳󠁣󠁴󠁿 Political commentator at @bylines.scot

1.2K followers 851 following477 posts

The WordPress Guy

wpguy.ukPHP2Shell: Why Your Host Decides If You're ProtectedYour server can be taken over without anyone touching your WordPress site. No malicious plugin, no compromised admin account, no brute-force login attempt — just a flaw in the PHP layer underneath

The WordPress Guy

wpguy.ukPHP2Shell: Critical PHP Vulnerabilities Affecting WordPressTwo critical vulnerabilities in PHP — the programming language that runs every WordPress site — were disclosed in July 2025, and the fix cannot come from WordPress itself. No plugin update, no

The WordPress Guy

wpguy.ukEU Supplement Duties: Fix Your WooCommerce Pricing NowSelling supplements into EU markets from a UK warehouse used to be a logistics question. Since July 2026, it has become a pricing and compliance question, and the answer your WooCommerce store gives

The WordPress Guy

wpguy.ukWooCommerce vs Marketplaces: Own Your Ecommerce RevenueThe regions generating the highest concentration of online small-business activity in Europe tend not to be the wealthiest. Places like Greater Manchester, the wider North West, and parts of the

The WordPress Guy

wpguy.ukHow Plugins Are Slowing Down Your Client SitesEvery plugin installed on a client site is a decision with a cost attached — measurable, not theoretical. Each plugin adds HTTP requests, database queries, and PHP execution time to every page load.

The WordPress Guy

wpguy.ukBackuply Vulnerability: How Subscribers Gain Admin AccessThe plugin that got you was the one you trusted to keep you safe. That is the specific irony of the Backuply vulnerability disclosed earlier this year: a backup tool installed on over 600,000

The WordPress Guy

wpguy.ukGhostscript CVE-2025-27830: Is Your WordPress Server Safe?Ghostscript is a system-level program installed on a large number of web servers. Most business owners have never heard of it, which is exactly why it presents a problem. When you or a customer

The WordPress Guy

wpguy.ukWhy European Refunds Take 16 Days on WooCommerce StoresEuropean shoppers buying from British retailers are waiting up to nine weeks for refunds. That figure comes from a [ShopReturns mystery shopping study](https://www.shopreturns.eu/) examining real

The WordPress Guy

wpguy.ukWooCommerce CVE-2026-106608: Update to 11.2.0 NowIf your store runs WooCommerce, an attacker can currently exploit a known vulnerability to gain elevated access to your site. No physical access is required, no stolen password, no prior knowledge of

The WordPress Guy

wpguy.ukWooCommerce European Shipping: Closing the Shopify GapPeak trading periods expose fulfilment operations in ways that quieter months never do. When order volumes spike in November and December, every manual step in your shipping workflow gets multiplied

The WordPress Guy

wpguy.ukWooCommerce for Secondhand Sales: Meeting UK Demand87% of UK consumers bought secondhand in the past year. That figure, from [eBay's 2026 Recommerce Report](https://www.ebay.co.uk/recommerce), makes the UK the most active pre-loved market in the

The WordPress Guy

wpguy.ukHow UK Independent Stores Can Compete With AmazonTwo-thirds of UK shoppers go straight to Amazon or a major marketplace before they consider buying from an independent retailer. That figure describes a habit problem, and habit is far harder to

The WordPress Guy

wpguy.ukWordPress 7.1.2: Critical RCE Vulnerability ExplainedSeptember 2026 brought two critical vulnerabilities in WordPress core, one of which allows an attacker to execute arbitrary code on your server without holding any account credentials. No login is

The WordPress Guy

wpguy.ukWordPress Core Flaw Scores 9.2: Patch Your Site NowA flaw confirmed in WordPress core, in the software itself, means an attacker can read files from your server or execute malicious code without ever needing a username or password. No brute-force

The WordPress Guy

wpguy.ukWordPress 6.7.2: Critical RCE Patch You Must Apply NowRemote code execution means an attacker can run their own code on your web server without needing a username or a password. No login credentials, no weak password to guess, no employee to trick into

The WordPress Guy

wpguy.ukeBay Grants for WooCommerce Sellers: Up to £200,000Running a WooCommerce store and selling on eBay at the same time is a reasonable multi-channel strategy, but it creates a persistent operational problem: keeping product data, inventory counts, and

The WordPress Guy

wpguy.ukThe Events Calendar Plugin: Critical 9.8 VulnerabilityOver 600,000 websites running The Events Calendar plugin are currently exposed to a pair of vulnerabilities that allow an anonymous attacker to take complete control of a WordPress site without

The WordPress Guy

wpguy.ukWooCommerce CVE-2026-48888: Update to 11.1.0 NowIf your business runs WooCommerce, a high-severity vulnerability is sitting in your store right now unless you have already updated to version 11.1.0. An attacker who finds your site before you patch

The WordPress Guy

wpguy.ukCut Delivery Costs with Locker Options in WooCommerceEvery WooCommerce store owner I speak to has an opinion on carrier rates. Most of them are watching the per-parcel price closely, renegotiating contracts, switching between couriers to shave pennies

The WordPress Guy

wpguy.ukPrepare Your WooCommerce Store for TikTok Shop EU LaunchRunning a WooCommerce store and selling on TikTok Shop already puts you ahead of most UK retailers. The next question is whether you will be positioned to sell into Europe when TikTok opens its Sell

The WordPress Guy

wpguy.ukCritical WordPress Backup Plugin Flaw Risks Site TakeoverIf your business uses WordPress, there is a reasonable chance your site is running the All-in-One WP Migration and Backup plugin. With over five million active installations, it is one of the most

The WordPress Guy

wpguy.ukWooCommerce CVE-2026-57777: Fix Privilege Escalation NowA vulnerability in WooCommerce allows an attacker to escalate their privileges on your site. Any store running a version below 11.0 is exposed: a user with a low-level account, a free subscriber

The WordPress Guy

wpguy.ukWordPress Plugin Vulnerabilities and Site Takeover RisksYour website is an asset. To an attacker, it is also infrastructure. When a critical vulnerability surfaces in a widely-used WordPress plugin, criminal operators do not wait weeks to act — they scan,

The WordPress Guy

wpguy.ukEU Customs Duty 2026: Prepare Your WooCommerce Store NowFrom 1 July 2026, every parcel you send to an EU customer carries a new per-tariff-line customs duty. The headline figure being discussed is €3 per line item. Send a customer three different products

The WordPress Guy

wpguy.ukAmazon Pan-EU FBA Deadlines: What WooCommerce Sellers NeedIf you sell via Amazon Pan-EU FBA and run a WooCommerce store alongside it, two deadlines are now sitting on your calendar whether you have noticed them yet or not. Amazon has introduced mandatory

The WordPress Guy

wpguy.ukCritical Auth Bypass in WPMU DEV Dashboard PluginIf you are running the WPMU DEV Dashboard plugin on your WordPress site, you are currently exposed to a confirmed authentication bypass vulnerability that requires no technical skill to exploit. An

The WordPress Guy

wpguy.ukAvada RCE Vulnerability: Patch Now or Risk Full TakeoverIf your website runs the Avada theme, a complete stranger on the internet can take full control of it right now without needing an account, a password, or any action from you or your staff. That is

The WordPress Guy

wpguy.ukEU Customs Rules: What UK WooCommerce Stores Must KnowBlack Friday generates exactly the kind of orders that will hurt you most under the EU's new customs rules. Multi-item baskets across different product categories, the natural result of a well-run

The WordPress Guy

wpguy.ukElementor Pro File Upload Vulnerability: Patch NowIf your site runs Elementor Pro and you have ever added a file upload field to a form, an attacker can take complete control of your site without holding an account, without guessing a password, and

The WordPress Guy

wpguy.ukSide Income for Teachers: 10 Self-Employment ModelsMany teachers reach a point where the salary feels fixed whilst the workload keeps climbing. Private tutoring is the obvious move, but it is one option among many. Teachers carry a set of

The WordPress Guy

wpguy.ukEU Customs Charges 2026: What WooCommerce Sellers Must DoFrom 1 July 2026, every item category shipped from the UK into the EU attracts a three euro customs charge. For WooCommerce stores dispatching volume into France and Germany, that cost compounds on

The WordPress Guy

wpguy.ukEU Customs Charges 2026: What WooCommerce Sellers Must DoFrom 1 July 2026, every item category shipped from the UK into the EU attracts a three euro customs charge. For WooCommerce stores dispatching volume into France and Germany, that cost compounds on

The WordPress Guy

wpguy.ukFluent Forms CVE-2026-18146: Update to 6.2.12 NowIf your site runs Fluent Forms and you have not updated it since 13 August 2026, an attacker may already be scanning for your installation. The [CVE-2026-18146

The WordPress Guy

wpguy.ukUK Retail Shift: Why Your WooCommerce Store Must PerformPhysical retail for non-food goods is shrinking. [BRC July 2026 data](https://internetretailing.net/online-growth-offsets-weak-store-sales-as-uk-retail-growth-slows-in-july/) shows in-store non-food

The WordPress Guy

wpguy.ukRoyal Mail's Electric Fleet: Update Your WooCommerce CheckoutYour checkout is the last thing a customer sees before they commit. If your shipping options don't reflect how your business actually operates, you're leaving trust on the table at exactly the wrong

The WordPress Guy

wpguy.ukHow to Choose WordPress Plugins That Don't Slow You DownPlugin selection is a commercial decision. Every plugin you install adds maintenance overhead, broadens your security exposure, and either contributes to or drains your site's performance. With [more

The WordPress Guy

wpguy.ukWordPress 7.1: How to Prepare Before the August ReleaseThe 19 August 2026 release date for WordPress 7.1 is fixed. WordCamp US is the backdrop, and the WordPress project has tied the release to that event, which means the timeline will not slip for

The WordPress Guy

wpguy.ukIs Your WooCommerce Hosting Ready for AI-Driven Retail?The infrastructure powering online retail is being rebuilt at a pace most store owners have not registered. AWS reported its fastest growth in 18 quarters in its most recent financial results, with

The WordPress Guy

wpguy.ukwp2shell WordPress RCE Flaw: Check and Patch NowYour WordPress site may already be compromised. If it runs any version from the 6.8.x, 6.9.x, or 7.0.x branches and has not been updated in the past few weeks, an attacker can take full

The WordPress Guy

wpguy.ukFluent Forms CVE-2026-16655: Update to 6.2.8 NowIf your site runs Fluent Forms and the plugin is below version 6.2.8, an attacker can exploit a confirmed vulnerability to manipulate or extract data from your site without needing administrative

The WordPress Guy

wpguy.ukWP2Shell: Critical WordPress RCE Flaw Actively ExploitedTwo critical vulnerabilities in WordPress Core, collectively known as WP2Shell, are being actively exploited right now. If your site is running WordPress 6.9.0 through 6.9.4, or 7.0.0 through 7.0.1,

The WordPress Guy

wpguy.ukWooCommerce iPhone POS Now Live for UK MerchantsIf you sell online through WooCommerce and also take money face-to-face at markets, pop-ups, or a physical location, you have probably dealt with the awkward reality of running two separate systems.

The WordPress Guy

wpguy.ukWordPress 7.1: Security Flaw Puts 6.9–7.0.1 Sites at RiskA major WordPress update lands on 19 August 2026, timed with WordCamp US 2026, and the beta cycle is already revealing exactly why this one deserves your attention before the release date arrives. If

The WordPress Guy

wpguy.ukGrow Your WooCommerce Store With TikTok Shop IntegrationTikTok contributed £10 billion to the UK economy in 2025 and supported 153,000 jobs, according to [a Public First and EY

The WordPress Guy

wpguy.ukGoogle's EU Data Ruling: What WooCommerce Stores Must KnowIf your WooCommerce store gets most of its traffic from Google Shopping and Google's AI-powered product discovery tools, you are building on ground that regulators are actively digging up. The

The WordPress Guy

wpguy.ukwp2shell: Patch the WordPress RCE Flaw NowA critical flaw in WordPress core was made public on 17 July 2026. If your site has not received the patch, an attacker can take full control of it without logging in, without exploiting a plugin,

The WordPress Guy

wpguy.ukWordPress Security Vulnerabilities Fixed in Version 7.0.2If your WordPress site is running version 6.8 or 6.9, two formally tracked security vulnerabilities were sitting in your codebase until 17 July 2026. One of them could give an attacker the ability to

The WordPress Guy

wpguy.ukWordPress 7.1: What Business Sites Must Do Before AugustThe release date is fixed. WordPress 7.1 arrives on 19 August 2026, timed with WordCamp US, and the window between now and then is preparation time. If you run a business on WordPress and have not

The WordPress Guy

wpguy.ukVAT Registration Guide for UK Self-Employed Business OwnersThe VAT threshold sits at £90,000 of taxable turnover over any rolling 12-month period. Cross it, and registration becomes a legal requirement. If you expect to hit that figure within the next 30

The WordPress Guy

wpguy.ukHow Heatwaves Are Driving Shoppers Online to WooCommerceUK high street footfall fell 6.2% year-on-year in June, against a 1.5% decline in May — a fourfold acceleration in a single month. [British Retail Consortium