v1.3.0 — WordPress 7.0 currency + SSRF/broken-access-control security refresh

July 2026 refresh — all facts web-sourced (WordPress.org, WP.org plugin guidelines page updated 2026-03-11, Patchstack 2025 security report, current npm / GitHub-Actions majors).

Baselines

• WordPress 7.0 current stable (7.1 due Aug 2026; 6.9.x maintenance line)
• PHP floor 7.4 (WP 7.0 dropped 7.2/7.3), recommended 8.3+
• 18 WP.org directory guidelines · WPCS 3.1 · @wordpress/scripts 32 · actions/checkout@v5 + cache@v5 · setup-node@v6 (GH Actions Node-24 default from June 2026)

wp-plugin-audit

• Dimension A: dated Version-currency block; flags a Tested up to ahead of the latest release (not just stale), Requires PHP < 7.4, Requires Plugins slug mismatch.
• security.md: added SSRF and broken access control / IDOR / privilege escalation (the WAF-invisible classes), phar:// deserialization, Path Traversal → Path Traversal & LFI, Patchstack-2025 prevalence. Wired into the Dimension D checklist.

Currency + completeness

• wp-org-submission, wp-plugin-release: Tested up to → 7.0
• wp-coding-standards: WPCS 3.1 note
• wp-ci-qa: CI matrix WP 6.9/7.0/latest, PHP 7.4/8.2/8.3/8.4, @v5 actions
• wp-build-tools: @wordpress/scripts ^32 + Node guidance
• wp-structured-data (19th skill) now listed in README + all descriptions
• CHANGELOG: backfilled the missing [1.2.4] and completed [1.3.0]

Full detail: CHANGELOG.md.