Javier Carazo (@carazo) – WordPress user profile

Bio

I am CEO and co-founder of Codection. We develop WordPress and WooCommerce plugins and we offer specialized service for WordPress owners, mainly custom develops and optimizations.

WordPress Origin Story

I knew WordPress when a colleague tell me he had a better solution to do a blog than the one we used then, Drupal. After it, I created Linux Hispano Juegos, a blog about gaming in Linux; and later we moved Linux Hispano to WordPress (before it worked with phpNuke, Mambo, Joomla! and Drupal).

Then I started to be more interested in this technology and I write a book about it “WordPress: Manual Básico” (editorial Ra-Ma). Maybe the first book about WordPress in Spanish.

After it I continue focused in it and then, Alberto Hornero and me founded Codection and we start to sell services with WordPress from the first day. And I continue here, now CEO of the company and coding everyday.

Badges

CODE

2 badges

Core Contributor '22 Plugin Developer

COMMUNITY

1 badge

WordCamp Speaker '14

PRACTICE

1 badge

Support Contributor '26

POLYGLOTS

1 badge

Translation Contributor '20

Current Job

WordPress Engineer

Present

Codection

Recent impact

Score weights high-impact work (commits, releases, approved translations, props) at 3x routine activity.

Last 30 days

12contributions

high9

medium3

score30

Last 90 days

45contributions

high27

medium18

score99

Last 12 months

163contributions

high57

medium106

score277

WordPress releases

Contributed to 2 releases

Contributions

Type

September 2026

Sep 08 Tue · 22:21

Plugins high

Committed [3687349] to Plugins SVN:
2.4.18: Security fix: align CSV export/import escape character (was allowing role column injection via profile fields) and require create_users to assign administrator role during import.

Sep 01 Tue · 22:37

Plugins high

Committed [3676907] to Plugins SVN:
Version 2.4.17 - Security fix: role from CSV no longer applied on unattended cron ticks unless the actor who saved the recurring settings had promote_users, closing the gap left by 2.4.16; manual backend import now also requires delete_users/promote_users for the delete-users-not-present and change-role-not-present options

Sep 01 Tue · 12:40

Plugins high

Committed [3676105] to Plugins SVN:
2.4.16 - Security fix: no-session cron run still let a create_users-only user get an administrator role assigned via the CSV's own role column, because the promote_users check saw the substituted fallback Administrator instead of the actual caller (incomplete fix in 2.4.15)

August 2026

Aug 28 Fri · 23:17

Plugins high

Committed [3670994] to Plugins SVN:
2.4.15 - Security fix: privilege escalation via recurring import cron settings (v2.4.15)

Aug 25 Tue · 08:31

Plugins high

Committed [3664892] to Plugins SVN:
Version 2.4.14: path field validation UI + SSRF hardening on remote CSV import

Aug 19 Wed · 15:03

Forums med

Posted a reply to Is there any way to identify users with weak passwords?, on the site WordPress.org Forums:
@maggiez, Passwords are stored in encrypted form in the database and can never be viewed,…

Aug 14 Fri · 06:58

Plugins high

Committed [3646785] to Plugins SVN:
Version 2.4.13: role errors during the import now tell exactly what is wrong (role does not exist and which ones can be used, role name used instead of its slug, role not assignable by the current user, empty role cell) instead of always showing the permissions message; fixed roles with uppercase slugs being rejected, get_editable_roles() reading the global before it is initialized in cron/frontend imports, and a fatal error when the role cell contains the :: separator

Aug 12 Wed · 08:12

Forums med

Posted a reply to Woocommerce address fields import but do not show in user profile, on the site WordPress.org Forums:
Thanks for reporting the issue. If you like this plugin, please, leave a good review…

Aug 11 Tue · 12:38

Plugins high

Committed [3641987] to Plugins SVN:
Version 2.4.12: fixed the 'too many redirects' error caused by the force reset password option - the redirection is now skipped when the user is already on the destination URL, it does not run on AJAX, REST, cron, XML-RPC or non GET requests, and it gives up after 3 consecutive redirects (new acui_force_reset_password_max_redirects filter). Added a FAQ section documenting the issue and the force reset password hooks

Aug 11 Tue · 08:25

Forums med

Posted a reply to Woocommerce address fields import but do not show in user profile, on the site WordPress.org Forums:
Fixed in 2.4.11 thanks for reporting!!