WordPress Weekly
WordPress
Security
Business

WordPress Weekly: Security Updates, WooCommerce Testing and Essex Funding — 2 November 2026

By Web Wonderland2 November 2026

This week's first priority is checking that your WordPress website has received its security updates. After that, there is a WooCommerce release to prepare for, a local funding opportunity to explore and some longer-term changes worth understanding.

Our 2 November roundup explains what the news means for business owners across Essex and the UK, with questions to help you talk to your website provider.

For the hosting and plugin incidents covered previously, see last week's WordPress Weekly. Those checks remain relevant even after newer updates arrive.

Your priorities this week

Check your updates: ask whoever maintains your website to confirm that security releases have actually installed.
Run an online shop? arrange testing before the next major WooCommerce update reaches your live store.
Have an innovative Essex business idea? look at the Innovate Essex Fund and its 4 November briefing.
Plan ahead: understand the direction of e-invoicing and AI content controls without rushing into new tools or settings.

1. WordPress 7.1.4: check the security update has installed

WordPress released 7.1.4 on 28 October and recommends updating promptly. It fixes security weaknesses, including a problem in the upgrade process itself.

Ask your developer or hosting company to confirm which release your website is running and whether the relevant fixes have been applied. Automatic updates are useful, but a scheduled update and a successfully completed update are different things.

Some fixes are also available for older WordPress versions. That does not mean an old version has become fully supported again: your provider should explain the route to a current, maintained release.

A sensible check includes working backups and a look at the pages, forms and customer journeys you rely on after updating. If an update fails or the website behaves unexpectedly, ask for help rather than repeatedly retrying it.

2. Check for ACF Extended, a separate WordPress add-on

The ACF Extended changelog lists security fixes in version 0.9.2.8, including tighter permission checks for forms and shortcodes. Shortcodes are small instructions that add features within website content.

This concerns ACF Extended, a separate add-on. Using ordinary Advanced Custom Fields or ACF Pro on its own does not mean you have this particular plugin installed.

Ask your developer to check the plugin list and update affected installations to the latest compatible release; 0.9.2.8 is the release identified in this week's notice. Afterwards, test any forms and custom content that depend on it.

If you have noticed unfamiliar users, unexpected redirects or other unusual changes, mention those too. Updating a plugin fixes the software weakness; it does not, by itself, remove changes an intruder may already have made.

3. Prepare your shop for WooCommerce 11.3 on a test copy

WooCommerce 11.3 is in beta, with the production release planned for the week of 9 November.

A beta belongs on a separate test copy, not your live shop. Ask your developer to check product searches and filters, checkout, refunds and the connections between your store and other business systems.

The release also changes how approved AI tools can connect with WooCommerce. Existing integrations may need changes to their connection and sign-in methods. This does not mean your shop automatically becomes publicly accessible to AI agents.

If you already use such a connection, ask who can access it, what it can change and how activity is recorded. Decisions that affect payments, refunds or stock need clear oversight. A test store should not take real payments or send messages to customers.

4. E-invoicing is a planning task, not an urgent software purchase

The government's e-invoicing implementation roadmap, published on 28 October, sets out a requirement from 1 April 2029 for VAT-registered persons to issue and receive electronic VAT invoices, subject to exemptions.

Technical details are still developing. Sending a PDF by email is not the same thing as a structured electronic invoice that another system can process automatically.

For now, understand how your invoices travel between your website, order system and accounting software. Ask your accountant and software provider how they expect to support the new requirements before buying anything.

If staff repeatedly copy invoice details between systems, there may already be a useful improvement to make. Our guide to choosing your first process to automate explains how to start with one manageable task and measure the benefit.

5. Innovate Essex Fund: check whether your idea could qualify

The Innovate Essex Fund offers three routes for eligible businesses based in Essex or with significant operations in the county:

Explore: grants of up to £5,000 for early ideas and opportunities.
Develop: grants from £5,000 to £15,000 to test and refine innovations, with a minimum 20% cash contribution.
Scale: up to £15,000 worth of specialist University of Essex support, rather than a cash grant.

An online briefing on 4 November covers the programme and application process. Check the event details and booking arrangements directly.

Eligibility depends on the proposed innovation, its commercial potential and economic benefit. A routine website redesign is not automatically eligible. Before planning a project around funding, check which activities and costs qualify, what contribution you need and when work can begin.

6. Google's proposed AI controls need consideration, not a quick switch

Google has described plans for a shared AI-training control in robots.txt, with support intended for early 2027. This is a future change, not a setting every business needs to apply this week.

Training a model, using web content to inform an AI answer and including a page in ordinary search results are different activities. A choice about one should not be treated as a guarantee about another.

Google says its existing Google-Extended control does not affect conventional Search ranking. Before changing crawler instructions, discuss how you want your content used and which tools those instructions affect.

Ask your website or marketing provider to document the choice and review the published guidance when the new control arrives. Avoid blanket changes made on the assumption that blocking AI training will improve rankings or automatically remove your content from every AI service.

Useful questions for your website provider

You should be able to get a clear answer about what needs attention and who is responsible. Start with these questions:

Which security updates have completed, and does anything still need action?
Are our backups working, and what was checked after updating?
Does our shop need a test update before the next WooCommerce release?
Which outside systems can see or change our website data?

Our WordPress maintenance and support service helps businesses across Essex and the UK keep track of updates, investigate problems and plan improvements. If something is already broken, the WordPress Fix Desk is a practical starting point.

For repeated admin tasks, our SME Automation Sprints start with the process and the business benefit. Tell us about your website or the task taking up your time, and we can help you decide what to tackle first.

Sources and further reading

Published 2 November 2026. Check the linked notices for current release information, requirements and funding criteria before making decisions.

← Back to Blog