Technical guides, diagnostic walkthroughs, and update notices from the WPerizo team. Everything here is WordPress and WooCommerce – written by the people who work on it daily.
WordPress 7.1.2 arrived on September 22, five days after 7.1.1. One fix, critical severity: an unauthenticated attacker can make page template resolution load a PHP file from outside your theme — and under the right conditions, run it. Here’s what that actually means, why you can’t self-assess your exposure, and what to do in the next hour.
WordPress 7.1.1 landed on September 17 with 11 security fixes. One of them can be triggered by a visitor with no account. Several more need only a Contributor login — which is exactly what membership sites, multi-author blogs and WooCommerce stores with staff accounts hand out by default. Here’s what’s in it and what to verify afterwards.
Most hacked-site guides start with “scan and clean.” That’s step four. Doing it first is why sites get reinfected within days — here’s the sequence that actually holds, in the order we run it on client emergencies.
