The first half of August 2026 brought two WordPress security releases, the WooCommerce 11.0 major release and its 11.0.1 security update, and the launch of Grok Bot from xAI. This Release Brief covers the WordPress releases first, then WooCommerce and Grok Bot, with what each means for your website, store and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.0.3 | August 6, 2026 | Security release | Update now |
| WordPress 7.0.4 | August 12, 2026 | Security release | Update now |
| WooCommerce 11.0 | August 4, 2026 | Major release | Plan and test |
| WooCommerce 11.0.1 | August 10, 2026 | Security release | Update now |
| Grok Bot launch (xAI) | August 11, 2026 | AI product (beta) | Pilot |
WordPress 7.0.3 security release
WordPress 7.0.3 was released on August 6, 2026, with fixes for 12 security issues, led by a reflected XSS on the login screen that needs no login (CVE-2026-64638). Other fixes cover stored XSS by contributors, a multisite privilege escalation and an SSRF in URL validation, all backported to 4.7. Apply it right away.
For the full write up, read our standalone post: WordPress 7.0.3 Fixes a Login Screen XSS and 11 More Security Issues.
WordPress 7.0.4 security release
WordPress 7.0.4 was released on August 12, 2026, with one security fix: an authenticated remote code execution issue where an author or higher could upload a malicious file on sites that use Imagick and Ghostscript (CVE-2026-65640). The fix was backported to 4.7 and later. Update now and review who has author access.
For the full write up, read our standalone post: WordPress 7.0.4 Fixes an Imagick and Ghostscript Code Execution Risk.
WooCommerce 11.0
WooCommerce 11.0 was released on August 4, 2026, with minimums at WordPress 6.9 and PHP 7.4. Logged in customers can verify an email address and claim past guest orders, failed analytics imports can be retried, product object caching is on by default for new stores, and the block based Product Editor beta is removed.
For the full write up, read our standalone post: WooCommerce 11.0.
WooCommerce 11.0.1 security release
What shipped
WooCommerce 11.0.1 was released on August 10, 2026, as a security update with no database update. It validates Store API cart tokens before a customer session loads, uses stronger salted hashing for guest session cookies (existing cookies stay valid until they expire), sanitizes Cart and Checkout block notices, enforces coupon usage limits on Store API payments for existing orders, and tightens permission checks across the REST API, Marketplace subscriptions, onboarding and analytics exports. Writing a log no longer scans the whole wc-logs directory, which reduces checkout latency on stores with large log backlogs, and the Orders list works with WordPress 7.1's list table markup.
What it means for you
Shoppers should not lose their guest carts when the update is applied, and lower privileged accounts are more tightly limited.
How we use it in WordPress builds
For WooCommerce stores, we add items as a guest on staging, apply the update and confirm the cart survives. We log in as each custom role, such as shop manager, to confirm everyday tasks still work, and set a retention period for large log folders.
What it means for mobile apps
AppPresser store apps use the same cart and checkout, so we run a test purchase in the app after the update.
What to do next
- Update to 11.0.1 and test guest carts and staff roles.
Grok Bot launch from xAI
What shipped
On August 11, 2026, xAI launched Grok Bot in beta: AI teammates that have their own cloud computer, sign into the tools a team already uses and carry a job through to the end. Bots work across apps and sites, including platforms with no clean API, keep working when you step away and come back when something needs your approval. You can message a Bot from a phone or desktop, run several Bots in parallel, teach a Bot a job by doing it once so it saves a routine, and rely on memory of past conversations. At launch Grok Bot was in beta on desktop and iOS for eligible SuperGrok and Cursor subscribers.
What it means for you
Repetitive work across tools, such as reports, outreach and office operations, can be handed off with a person approving the important steps.
How we use it in WordPress builds
With Grok Bot, Bots can handle routine site operations such as content checks and reporting from WordPress data, with publishing and other final steps left to a person.
What it means for mobile apps
A Bot can gather app store reviews and feedback for an AppPresser app and draft summaries for the team.
What to do next
- Pick one repetitive weekly task as a first routine.
- Learn more about Grok and our AI implementation services.
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule, security releases first. Hosting and server changes are covered by our WordPress security and hosting service.
Frequently asked questions
Which update should I apply first?
WordPress 7.0.3 and 7.0.4, then WooCommerce 11.0.1. All three are security releases.
Will customers lose their guest carts with WooCommerce 11.0.1?
No. Existing guest cookies stay valid until they expire, so guest carts survive the update.
Will my products disappear with the Product Editor beta removal?
No. Products and product data remain. Only the experimental editing screen is retired.
Is product object caching on for my existing store?
Not automatically. It is on by default for new stores, and existing stores can opt in.
Brief us on your mission
Want security releases and WooCommerce upgrades handled for you, or a Grok Bot pilot? Tell us about your project and a specialist will follow up.
