Twelve security holes, one release. If your website runs WordPress, the update that landed yesterday is the most urgent job on your list this morning. One of the flaws sits on the login screen and needs no account at all to reach it. The rest of the week brings countdown badges on Google Shopping, a new advert slot inside Instagram Reels, and Google pushing back publicly on what its bidding change actually does.
Your website
WordPress 7.0.3 fixes twelve flaws, one of them before anyone logs in
WordPress released 7.0.3 on 6 August. It closes twelve vulnerabilities. The one that matters most is a pre-authentication reflected cross-site scripting flaw on the login screen, tracked as CVE-2026-64638, with the potential to run PHP code. Pre-authentication means an attacker never needs a username or a password. They only need someone to open a crafted link. The release also fixes a privilege escalation issue on multisite networks and several stored cross-site scripting flaws.
Sites with automatic background updates switched on will take this over the next few days without anyone touching them. Sites where a developer turned automatic updates off will not.
Why this matters for your business: your login screen is the one page on your site that faces the public and sits directly against your database. Open your dashboard today and check the version reads 7.0.3. If it does not, click update now rather than waiting. Then find out whether automatic updates are switched on at all. Plenty of developers disable them to stop a plugin conflict and never switch them back.
Search and ads
Google Shopping starts putting countdown badges on expiring deals
Google has documented a new Deal Ends annotation for Shopping ads and free listings. It prints a small urgency label under your price, along the lines of three days left or five hours left. Google builds it from the promotions and sale prices already sitting in your Merchant Center feed, so there is nothing technical to add. A deal has to expire within seven days to qualify. It runs everywhere except the European Economic Area, Switzerland and the United Kingdom, which puts South African merchants firmly in scope. You cannot opt in and you cannot opt out.
Why this matters for your business: your sale end dates stop being an internal admin field and become public advertising copy. Go through your feed this week and check that every promotion carries a real end date rather than one you quietly roll forward each month. A badge counting down to a deadline you never enforce looks dishonest to a shopper who comes back and finds the same price waiting.
Google denies the 17 August bidding change goes further than stated
We covered the target based bidding change coming on 17 August yesterday. The new development is that Google is now arguing back in public. After advertisers on LinkedIn suggested the change amounted to a quiet Smart Bidding overhaul dressed up as a small fix, Ads Liaison Ginny Marvin replied that it only touches campaigns limited by budget that use a target, because that is already how bidding behaves once a campaign is no longer budget constrained. She also rejected the claim that Google is telling advertisers to spend more.
Why this matters for your business: the denial narrows the blast radius without removing it. If any campaign of yours shows the limited by budget status and runs on target cost per acquisition or target return on ad spend, it is in scope. Pull that list this week. Marvin’s underlying point holds either way, which is that your target now controls your efficiency more precisely than your budget does.
Social and content
Instagram opens post-view Reels ads to every advertiser
Instagram rolled its post-view Reels placement out to advertisers worldwide this week. The advert plays at the moment an organic Reel finishes, before it loops back to the start. Viewers see a five second countdown on the organic Reel first, and Instagram has added a manual skip button. The placement only runs after organic Reels longer than sixty seconds. You reach it through the Reels advert tools already in Campaign Manager.
Why this matters for your business: this is fresh inventory, and fresh inventory usually means cheaper impressions for a few weeks until everyone else finds it. The catch is the viewer’s state of mind. They have just finished something they chose to watch and their thumb is already moving. Your first second carries the whole message, so lead with the offer rather than a slow brand opening.
Instagram is testing Series, a Reels hub on your profile
Instagram is trialling a feature called Series that groups related Reels into their own hub on a profile, with a watch next button so someone can move through them in order. It is a limited test and Meta has announced nothing about a wider rollout. Instagram also added Japanese, Korean, French, German and Italian to its Reels translation tool, which dubs the audio and adjusts the speaker’s mouth to match.
Why this matters for your business: episodic content has always struggled on Instagram because episode four sits buried under everything you posted since episode three. If Series ships, planning content in runs of five or six becomes worth the effort. Start thinking in sequences now rather than scrambling to catch up when the feature arrives.
Automotive
What a pre-login flaw means for a dealership website
This one is a read-across rather than automotive news, because nothing new broke in dealer marketing this week. The WordPress flaw above lands harder on a dealership than on most businesses, and it is worth spelling out why.
A dealer site is not a brochure. It holds finance application details, trade-in valuations, test drive bookings and service appointments, all attached to names, phone numbers and often identity numbers. Plenty of South African dealer sites run WordPress with an inventory plugin bolted on, and plenty of those installs sit behind a developer who switched automatic updates off to stop the stock feed breaking. That combination is the whole problem.
Why this matters for your dealership: ask whoever runs your website three questions today. Are we on 7.0.3. Are automatic security updates switched on. Where do lead form submissions actually get stored. If the answer to the third is the WordPress database rather than your customer system, a site compromise becomes a customer data problem under POPIA and not just a website problem. That is a very different conversation to have with your dealer principal.
What to do this week
- Update WordPress to 7.0.3 today, then switch automatic security updates back on if someone turned them off
- Check every Merchant Center promotion carries a real end date before Deal Ends badges start counting down in public
- Pull the list of campaigns showing limited by budget that run on a target, and reset those targets near what you actually pay
- Test the post-view Reels placement with a short, offer led creative while the inventory is still new
If you would rather someone else tracked all of this and told you only what needs doing, that is the job we do every day. Talk to us.
Sources
- WordPress 7.0.3 Release, WordPress News
- New Google help doc details Deal Ends annotations for Shopping ads, Search Engine Land
- Google denies broader Smart Bidding change as August 17 nears, PPC Land
- Instagram expands access to post-view ads in Reels
- Instagram updates for 2026, including the Series test