WebsitesConfirmed01
WordPress 7.1.1: technical details emerge around the Click2Shell attack chain
Additional technical details have emerged about one of the Core vulnerabilities patched in WordPress 7.1.1. Researchers at pwn.ai called the demonstrated chain Click2Shell. A specially crafted link opened by an authenticated administrator could trigger installation of an existing theme from WordPress.org without the normal Install interaction. The Core issue alone did not allow an arbitrary theme ZIP upload and did not automatically provide remote code execution. Researchers demonstrated, however, that it could be chained with a separate vulnerability in an installed theme to execute code. WordPress addressed the issue in 7.1.1 alongside ten other security fixes. At the time the technical research was published, there was no evidence that this particular chain had been exploited in the wild.
Business impactYesterday's WordPress update is now an even higher priority across the managed portfolio. Administrator accounts, unexpected inactive themes and sites that have not yet received the security release deserve particular attention.
WordPress News ↗
Do this nextVerify that every managed WordPress site is on a patched release. After updating, review installed themes and remove unnecessary inactive ones. For administrator accounts, review MFA, active administrator count and recent security events.
Local SEOOfficial02
Google adds local-business queries to Aggregator and Supplier search units
Google's latest Search documentation update adds local-business query support to Aggregator and Supplier units. These specific search experiences apply to the European Economic Area, so this is not a Toronto Local Pack change or a new Canadian ranking factor. The architectural signal is still useful. Google continues to use structured information about local businesses outside the traditional Maps interface. For direct suppliers, Google can use information available through ordinary web crawling. This is another reason a local-business website should describe its entity unambiguously: business name, services, categories, geography, hours, imagery, reviews and other business facts should align across the website and external sources.
Business impactNo immediate implementation is required for GTA clients because of the EEA feature. Website entity completeness is nevertheless becoming an increasingly reusable asset across Search and AI surfaces.
Google Search Central ↗
Do this nextChoose one local-service website and compare the homepage, service pages, GBP and LocalBusiness schema. Check business name, primary services, service area, phone, hours and entity description for contradictions.
Lead GenerationOfficial03
ChatGPT Ads now requires a separate crawler-accessibility check
OpenAI now documents dedicated technical requirements for ChatGPT Ads landing pages. OAI-AdsBot must be able to access a landing page for ads validation, while allowing OAI-SearchBot is recommended for public-web discovery. OpenAI specifically warns that access can be blocked not only through robots.txt but also by Cloudflare, WAFs, bot protection, JavaScript challenges, CAPTCHAs, authentication, geographic restrictions and rate limiting. Separate IP ranges are available for OAI-AdsBot, and Cloudflare recognizes it as a verified crawler. Ads readiness therefore becomes a technical property of the website. A page can work perfectly for users and Googlebot while remaining unsuitable for ChatGPT Ads because of firewall or bot-management rules.
Business impactAllsite can add OpenAI crawler validation to the standard website launch and Ads-readiness checklist without turning it into a complex standalone service.
OpenAI Help Center ↗
Do this nextOn one production domain, review robots.txt and Cloudflare or WAF rules for OAI-AdsBot and OAI-SearchBot. Record the landing-page HTTP response and confirm that the crawler does not receive a 403, CAPTCHA or redirect loop.
AI SearchIndependent Test04
Local AI visibility should be measured as persistence, not a single ranking
BrightLocal's research across 200,085 localized searches and roughly 1.9 million AI citations provides a practical measurement model for local AI visibility. The same prompt can return different businesses across repeated runs, although individual businesses reappear in more than half of repeated searches. Results also vary across ChatGPT, Google AI Mode, AI Overviews and different locations within the same city. Google Maps mentioned the tracked business in roughly 66% of searches compared with 32–38% across the AI surfaces studied. Traditional rank position therefore translates poorly to AI. More useful measurements include Mention Rate, persistence, Share of Voice, cited domains and consistency of recommendation across repeated runs.
Business impactThis applies directly to the standalone analytics plugin and Client Visibility system. AI Visibility should not be presented to clients as Position 1, 2 or 3; the more defensible model measures frequency and persistence of visibility.
BrightLocal ↗
Do this nextAdd four AI metrics to the analytics plugin specification: Mention Rate, Persistence, Share of Voice and Citation Sources. Store multiple runs of the same prompt instead of keeping only the latest answer.