Nick Fox

The often nonsensical ramblings of a thirty-something law graduate.

[Kyle 🚄 @KyleTrainEmoji]

PICARD: Data, shields up

DATA: Brilliant! Shields can reduce damage we sustain. Not immunity. Not hubris. Just prudence. It's not precaution—it's strategy.

[camera shakes]

WORF: HULL BREACHES ON NINE DECKS

DATA: Here's what happened: you told me to raise shields, and I didn't

[AFC Bournemouth 🍒 @afcbournemouth]

The next incredible chapter of this football club is written ❤️

We’ll be in Europe for the first time in our 127-year history next season 🌎

On to Sunday for one final push to find out which competition 💪

[Kelly Somers @KellySomers]

I started my career at Bournemouth - they were languishing at the bottom of league one. They didn’t have a real training ground, they had a 3 sided stadium. So many people deserve credit, but the fans who collected money in buckets to save their club are now saving for EUROPE ❤️

[roots.io @rootswp]

An early warning system for WordPress plugin security issues: WP Packages now tracks vendor mass closures publicly

RSS feed and APIs also available for mass closures 🔔

https://t.co/jxUw3OLCID

[Tyron Surmon @TyronSurmon]

Looks like we got this almost exactly perfect - including the exact turnout!! Very happy

[Jessica Simor KC @JMPSimor]

@Nigel_Farage says the £5m was a "personal gift." The rules say such gifts should be registered if they "could...reasonably be thought by others to be related to membership of the House or to the Member’s parliamentary or political activities.." "Security" is plainly that.

[Jessica Simor KC @JMPSimor]

One might expect @ChrisMasonBBC to be able to find the rules on donations - it takes 3 seconds to do so: https://t.co/xwlNSOQ7lL

[Mistress Dividend @mistressdivy]

I'd rather drink the water from a tin of tuna than be asked to share a fun fact about myself as an icebreaker during a team building activity at work.

[Sybre Waaijer @SybreWaaijer]

100,000+ stores run this WooCommerce plugin. I doubt any of them know their payments are broken. Any store with $1M ARR could be missing $700k+ in revenue. If you run WooCommerce Subscriptions, check your store.

Yesterday, I reported a bug to WooCommerce that silently broke subscription payments after a product switch. Then I got worried: if they missed something this obvious, what else did they get wrong? So I started auditing. Within hours, I had found three more bugs. There were 121 affected subscriptions, and $43,274 in lost revenue.

Here's what I found.

WooCommerce Subscriptions has an internal flag that controls whether a subscription charges the customer automatically or waits for them to pay manually. When a customer checks out with (for example) Stripe or PayPal, this flag should be set to "automatic." If it isn't, subscription renewals silently stop working: no charge is attempted, no failure email is sent, and the subscription goes on hold until the customer notices and pays manually, or doesn't and churns.

Bug 1 (stale cache): After saving subscription dates, the order cache was never cleared. Subsequent saves could serve a stale object with the flag still set to its default: manual. Fixed in subscriptions-core 6.9.0.

Bug 2 (broken HPOS backfill): Missing getter/setter methods prevented subscription metadata from being properly synced to postmeta in HPOS when data sync is enabled. Fixed in subscriptions-core 6.5.0.

Bug 3 (unnecessary re-fetch): wcs_create_subscription() returned a freshly fetched instance from cache/DB instead of the already-configured object. Any unsaved state, including the corrected flag, was silently discarded. Fixed in subscriptions-core 7.1.0.

These three combined accounted for roughly 7% of all subscriptions created at checkout that were silently born broken, despite the customer paying successfully. For 7+ years (we have data from 2017–2024). Automatic payments NEVER fired for these subscriptions. Users never got renewal emails, either. The only way to know they were broken was if the customer noticed they lost access and contacted support, or if the merchant audited their database manually.

Bug 4 (switch): When a customer upgrades or downgrades their subscription, the switcher flags the subscription as manual renewal; it only corrects the flag if the payment gateway changes. A customer switching plans while keeping the same gateway (e.g. Stripe to Stripe) cements the flag stuck on manual. I discovered this two days ago, when I found a happy customer in the store overview that I had just helped upgrade, with multiple valid cards on file, put "On Hold" because of a missed payment.

For years, I've offered to help WooCommerce improve its code quality and performance. I dry-run code: I find bugs by reading. All four of these bugs are clearly visible in the source without needing to use the software. They could have been caught early. They weren't. The incompetence is immeasurable (well, actually, with the diagnostic queries in my next post, it might be measurable). Our store is small. WooCommerce Subscriptions powers hundreds of thousands of stores. If 7% of subscriptions were silently broken across even a fraction of them, we're looking at potentially millions of dollars in spoiled revenue industry-wide that could have been prevented. Perhaps even billions.

None of this was disclosed well or at all. No admin notice. No email. No advisory.

The fixes shipped under vague changelog lines like "Make sure we always clear the subscription object from cache after updating dates" and "Ensure proper backfilling of subscription metadata." One fix was labeled "Dev" instead of "Fix." Two don't appear in the GitHub release notes at all. No remediation tool or diagnostic query was provided. Store owners have NO way to know they're affected unless they manually audit their database. The woocommerce-subscriptions-core repo was archived in May 2025 after the code was absorbed into WooCommerce core — making the fix history harder to trace.

If you run WooCommerce Subscriptions and used HPOS before mid-2024, check your store. Queries are linked in the tweet below.

[AFC Bournemouth 🍒 @afcbournemouth]

Thank you for everything, Andoni ❤️

[jerry fox @furiouschin]

I know I’m shallow but just how good does that make the rest of the weekend😂 #afcb

[Ben Word @retlehs]

🔎 quien — a better WHOIS. Domain lookups with a clean TUI instead of parsing raw 𝚠𝚑𝚘𝚒𝚜 output. DNS records, mail config, SSL certs, HTTP headers, and tech stack detection all in one tool.

https://t.co/Cp22UWLh1e

[roots.io @rootswp]

✨ @​roots/vite-plugin v2.1.0 adds support for theme.json partials

You can now split your block styles into `.theme.js` files and co-locate them next to your block templates instead of maintaining one giant theme.json

https://t.co/Hi3FTCfYqG

[Supertanskiii @supertanskiii]

Found the meteorologist responsible for naming Storm Dave.

[Pick My Postcode @pickmypostcode]

🎉🎂 We’re 15! 🎂🎉

Happy Birthday to us! 🥳 For 15 years, Pick My Postcode has been giving away free cash to our amazing community, all thanks to YOU! 💙

#PickMyPostcode #BirthdayCelebration #FreeMoney #WinBig #HappyBirthday

[IGN @IGN]

Brie Larson was in 1st place in Mario Kart World... until she wasn't.

[roots.io @rootswp]

3 ways WordPress plugins break non-standard installs:

- Hardcoded wp-content paths
- Direct wp-load.php includes
- Assuming WP lives at the root

https://t.co/oWWODU6MWU

[Ben Word @retlehs]

New site is: https://t.co/IujH8JBMSr

Already using WP Composer? Your packages will continue to work, but you'll see a warning to migrate

The old repo is no longer fetching new updates, so update your config from the one liner in the blog post when you get a chance

[roots.io @rootswp]

WP Composer is now WP Packages

Details: https://t.co/MbtN1E3Pzl