The first half of July 2026 brought WordPress 7.0.1, a short cycle maintenance release that fixes 31 bugs after the WordPress 7.0 redesign, and BuddyPress 14.5.0 with two security fixes. MariaDB 10.6 reached end of community support, Apple added social media questions to App Store age ratings, and nginx 1.30.4 and 1.31.3 fixed a map overflow. Here is what shipped and what it means for your website and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.0.1 | July 9, 2026 | Maintenance release | Update |
| BuddyPress 14.5.0 | July 7, 2026 | Security and maintenance release | Update |
| MariaDB 10.6 end of life | July 6, 2026 | End of life | Upgrade the database |
| Social media age rating questions | July 9, 2026 | Policy | Answer before September |
| nginx 1.30.4 and 1.31.3 | July 15, 2026 | Security | Update nginx |
WordPress 7.0.1 maintenance release
WordPress 7.0.1 was released on July 9, 2026, with fixes for 31 bugs in the block editor, the admin interface and media, and no new features. Sites with automatic updates in the background receive it on their own. If editors saw odd behavior in the new admin screens or the media library after 7.0, retest after updating.
For the full write up, read our standalone post: WordPress 7.0.1 Fixes the Block Editor, Admin Screens and Media.
BuddyPress 14.5.0 security and maintenance release
What shipped
BuddyPress 14.5.0 was released on July 7, 2026, together with 12.7.0 and 11.6.0 for older branches. It fixes two security issues: the Messages REST API endpoint now sanitizes the incoming user_id value so one user cannot pose as another, and changing BuddyPress component status now requires the manage_options capability. It also improves compatibility with WordPress 6.9, loading block styles on demand in classic themes and fixing the caps lock message on the BP Nouveau registration screen, and it fixes bugs in BP Nouveau, Groups, Friends, Activity and Administration along with several PHP 8.x warnings.
What it means for you
If your community uses private messages or the BuddyPress REST API, the first fix closes a way for a member to send requests as someone else. The second makes sure only site administrators can switch BuddyPress components on or off. Both are worth having right away, and the WordPress 6.9 fixes remove small layout glitches on registration and in classic themes.
How we use it in WordPress builds
On the community sites we build and maintain through our BuddyPress development service, we apply 14.5.0 on staging first and retest messaging, group directories, friend lists and registration. Custom templates that style group items should move to the new prefixed bp-group-status-{status} class, because the old unprefixed class is due to be removed in the next release.
What it means for mobile apps
AppPresser apps that show BuddyPress activity, messages or groups read that data from your WordPress site, so the Messages endpoint fix protects the app as well. No app store update is needed, but we retest in-app messaging after the site updates.
What to do next
- Confirm every site shows BuddyPress 14.5.0 or later under Plugins.
- If you run 12.x or 11.x, update to 12.7.0 or 11.6.0 now and plan the move to 14.5.
- Let our support and maintenance team test and apply it for you.
MariaDB 10.6 Reaches End of Community Support
What shipped
MariaDB 10.6 reached the end of its community maintenance on July 6, 2026:
- MariaDB Community Server 10.6 reached end of life on July 6, 2026 and no longer receives bug or security fixes.
- The Foundation recommends moving to 11.8 or 12.3.
- The Foundation lists community maintenance for 12.3 and 11.4 until 2029 and for 11.8 and 10.11 until 2028.
What it means for you
After the final 10.6.28 release, new security issues will not be fixed for 10.6 in community builds.
How we use it in WordPress builds
Many hosts set up WordPress on 10.6. We move these to 11.8 LTS or 11.4 LTS after testing plugins on staging.
What it means for mobile apps
Apps are not affected directly, but an unpatched database behind an app's API is a risk to the data the app shows.
What to do next
If your database is MariaDB 10.6, plan the upgrade now. Our WordPress security and hosting team handles it with a backup and rollback plan.
App Store Age Rating Questions Now Ask About Social Media Features
What shipped
Apple expanded the App Store Connect age rating questionnaire on July 9, 2026:
- On July 9, 2026, Apple added questions about social media capabilities to the age rating questionnaire in App Store Connect.
- Apple said responses are required beginning in September 2026 when submitting new apps or updates.
- The questions support Time Allowances in iOS 27, iPadOS 27 and macOS 27, which let parents limit time by category, including Social Media.
What it means for you
Apps that let people share or amplify content may be grouped as social media, which affects how parents can limit them.
How we use it in WordPress builds
Apps built on WordPress community features, such as BuddyPress style profiles, comments or member posts, should look at these questions carefully.
What it means for mobile apps
We answer the new questions for each AppPresser app based on what users can post and share in the app, including WordPress pages loaded inside it.
What to do next
Answer the social media questions in App Store Connect before your next update. Our custom mobile app team can help.
nginx 1.30.4 and 1.31.3 Fix a Major Map Overflow and Two Module Bugs
What shipped
nginx.org released 1.30.4 and 1.31.3 on July 15, 2026:
- nginx 1.30.4 and 1.31.3 were released July 15, 2026.
- CVE-2026-42533 (major): overflow when map is used with regular expressions.
- CVE-2026-60005: memory disclosure in the slice module.
- CVE-2026-56434: use after free in SSI.
What it means for you
The map directive with regular expressions is common in redirect and cache rules, so the major rated issue touches many configs.
How we use it in WordPress builds
Our WordPress nginx configs use map blocks to decide when to skip the page cache, such as for logged in users or cart cookies. We patched these servers first.
What it means for mobile apps
Cache bypass rules for app requests often rely on map. Patching protects those endpoints without app changes.
What to do next
Update to 1.30.4 or 1.31.3 or later. Our WordPress security and hosting service covers it.
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule. Hosting and server changes are covered by our WordPress security and hosting service.
We also track the server, app platform and payment releases behind your site and app, including MariaDB, BuddyPress, App Store and nginx. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Frequently asked questions
Is WordPress 7.0.1 a security release?
No. It is a maintenance release focused on bug fixes, with no new features.
What areas does it fix?
The block editor, the admin user interface and media, with 31 bugs fixed across core and the block editor.
Will my site update automatically?
Sites that support automatic updates in the background receive it on their own. You can also update from Dashboard, then Updates.
What should a site on MariaDB 10.6 do now?
Run 10.6.28, the final release, while you plan the move. The Foundation recommends 11.8 or 12.3. Our hosting team can test the upgrade on staging.
Brief us on your mission
Want WordPress updates tested and applied for you? Tell us about your site and a specialist will follow up.
