Update to WordPress 7.1.2 now. Plus the WordPress 7.2 roadmap, AI agents and WordPress, a plugin developer trust checklist, and the WP Engine antitrust ruling.
This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 58, where you get curated news about WordPress and the WordPress community all in one place.
Hi5 to the 45 WordPressers who joined us in the last 7 days! We are now 1024! Hip Hip Hurray!!!
A critical security fix shipped, the WordPress 7.2 roadmap is out, and a federal judge put WP Engine’s antitrust claims against Automattic back on the table. We also look at how WordPress could welcome AI agents and what plugin developers can do to earn a cautious buyer’s trust.
In this Issue:
- WordPress 7.1.2 Patches a Critical Security Vulnerability
- The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List
- Should WordPress Open the Door for AI Agents?
- A Trust Checklist for WordPress Plugin Developers
- WP Engine’s Antitrust Claims Against Automattic Are Back On
- WordPress Must Read
- On Other WordPress News
- From WordPress Community
WordPress 7.1.2 Patches a Critical Security Vulnerability
WordPress 7.1.2 is a security-only release, and it fixes one critical vulnerability. John Blackbourn led the release, which shipped on September 22.
The bug lets an unauthenticated attacker, under certain conditions, make page template resolution include a chosen readable local PHP file from outside the active theme directories. If the server environment and the active theme meet the right pre-conditions, that can lead to remote code execution. Robert Ressl reported it responsibly, and the advisory is tracked as CVE-2026-87902.
WordPress recommends updating your sites immediately, either from the Dashboard under Updates or by downloading 7.1.2 from WordPress.org. Sites with automatic background updates will start the process on their own. The fix was also backported to every branch eligible for security fixes, currently back to 4.7. Only the latest WordPress version is actively supported, so an older site is worth a look this week.
Read the full blog on WordPress.org →
Once your sites are patched, the next question is where WordPress is heading.
The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List
WordPress 7.2 is planned for early December 2026, and the roadmap is out. Notes gets a suggestion mode, so you can leave edits for others to accept or reject, plus emoji reactions.
The security list includes a “sudo mode” that asks you to re-authenticate before sensitive actions, a Secrets API for storing credentials safely, and hardening for Application Passwords. Sudo mode is still at the early-work stage.
For site builders, you can style form elements in Global Styles, and two blocks are coming: Description List and the Table of Contents block. Admin icons move from dashicons to SVGs, and error messages get clearer wording with a copy button. A new default theme called Ipsum is a minimal blank canvas.
Collaborative editing is not on the 7.2 list. The post also says these items are being actively pursued but may not all make the final release.
Read the full blog on Make WordPress Core →
Beyond the release itself, one writer wants WordPress to prepare for a new kind of visitor.
Should WordPress Open the Door for AI Agents?
Nick at Teddy argues that WordPress already has what agents need: structured block content, a REST API, feeds, and metadata. It needs to present them more clearly.
He proposes serving Markdown when a client sends the Accept: text/markdown header, and offering a .md version for clients that don’t. In Checkly’s tests, three of seven agents sent that header: Claude Code, Cursor, and OpenCode. He also suggests a small read-only public menu at a predictable address like /.well-known/wordpress, listing the search route and the site’s stated AI policy.
Reading a public post should never quietly grant permission to change one. He points out that robots.txt is a request to crawlers, not authorization, and that llms.txt belongs last on the list. Ahrefs found that 97% of the files it observed got no requests in the month it measured.
Trust matters for plugin authors too, and one guide lays out how to earn it.
A Trust Checklist for WordPress Plugin Developers
David McCan at WebTNG turns what cautious buyers look for into a checklist for plugin developers. It covers three areas.
In the Plugin Directory, keep the “tested up to” field recent, answer support threads (the negative ones too), reply politely to critical reviews, and keep an honest changelog that mentions security fixes. WordPress.org now lets you update “Tested up to” without releasing a new version.
On your own site, show who you are, be plain about where your company operates, and write real privacy and terms pages. Spell out pricing, renewals, and licensing. He recommends a clear refund window, with 14 or 30 days being typical, and a published vulnerability disclosure policy.
Most items are a few hours of work, and they mean fewer refund requests and fewer one-star reviews. Over time, join the community, show which feedback you acted on, and avoid overpromising.
Read the full blog on WebTNG →
Finally, the WP Engine case just changed direction.
WP Engine’s Antitrust Claims Against Automattic Are Back On
A federal judge has reversed course on WP Engine’s antitrust claims against Automattic. In a 17-page order, U.S. District Judge Araceli Martínez-Olguín revived four counts against Automattic and Matt Mullenweg: monopolization, attempted monopolization, and two illegal tying claims. The same judge dismissed them in September 2025.
The turn followed an August 13 Ninth Circuit ruling in an unrelated surgical-robot repair case, which undercut Automattic’s central argument. The court also pointed to allegations that Automattic demanded fees for access that used to be free, and tied WordPress.org login to a checkbox denying any affiliation with WP Engine.
Successful federal antitrust plaintiffs are entitled to triple damages plus attorneys’ fees. WP Engine’s extortion claim was dismissed for good, and its attempt to toss Automattic’s counterclaims mostly failed. Summary judgment motions are due November 20, with a 10-day jury trial set for October 19, 2027.
Read the full report on The Repository →
Brought to you by
WP More Socials
I send this newsletter every week, but do you want to keep up with WordPress and the community?
Then follow WP More’s social profile.
X (formerly Twitter) – https://x.com/WPMoree
LinkedIn – https://www.linkedin.com/company/wordpress-more/
BlueSky – https://bsky.app/profile/wpmore.bsky.social
I post there every day. So, you are not going to miss anything.
Follow WP More, Stay Updated with WordPress!
WordPress Must Read
→ WordPress Takes Its Turn Leading the Open Website Alliance (wordpress.org) – Mary Hubbard became president of the Open Website Alliance on September 21, 2026, representing the WordPress Foundation. The role rotates among the alliance’s members, which also include the Drupal, Joomla!, and TYPO3 communities.
→ AI Agents for WordPress: What Helps and What Still Fails (abulkhoyer.com) – A Tourfic booking bug fix shows agents do well with clear goals and access to code, WP-CLI, browser tools, and MCP, with 31 regression scripts passing. They still fail when goals are vague, when they edit generated code without updating the source, or when they skip testing plugin combinations.
→ Zero clean: 72 WooCommerce stores (merchlint.com) – Merchlint’s 2026 WooCommerce report, which looked at 72 stores under the headline “Zero clean.”
→ Five ways Claude Code failed on a 240,000-line WordPress plugin (sleevesupai.com) – Five failures from using Claude Code on Easy Digital Downloads, including patching a symptom instead of the root cause, adding 25 lines when 3 were requested, and a test that bypassed the method it covered. The author’s five-question review caught all of them in under four minutes.
On Other WordPress News
→ Iterating from live events to livestreamed releases (make.wordpress.org) – WordPress releases move from in-person events to livestreamed Zoom webinars, starting with 7.2 in early December 2026. Release squad members and others involved can share without geographic barriers.
→ WooCommerce 11.1.2 Release Notes (developer.woocommerce.com) – Released September 22, it tightens validation on email-based product reviews and fixes a regression in rendering product variation galleries that could cause infinite recursion when themes call get_available_variations.
→ WordPress Contributor Toolkit 1.2: One app for your first Core or Gutenberg contribution (make.wordpress.org) – A desktop app that removes setup friction for first-time contributors. Version 1.2 adds a full Gutenberg workflow, from creating a site and linking a GitHub issue to applying pull requests and submitting changes without leaving the app.
→ WordPress Trac MCP server (make.wordpress.org) – A free, public MCP server that lets AI assistants like Claude and ChatGPT read tickets, changesets, and timeline history from WordPress.org Trac instances. It needs no authentication or API key.
→ Call for Media Partners for Wordcamp Asia 2027 (asia.wordcamp.org) – WordCamp Asia 2027 runs April 9 to 11 at the Penang Waterfront Convention Centre in Malaysia. Media partners get complimentary passes and media area access, and applications close November 24, 2026.
→ WooCommerce 11.2.0 Pre-release notes (developer.woocommerce.com) – The beta is ready for testing ahead of an October 6, 2026 release. Highlights include configurable withdrawal request emails, more block styling options, a CSV importer that matches products by GTIN, UPC, EAN, or ISBN, and date fields in the Additional Checkout Fields API.
→ Gutenberg’s JavaScript unit and integration tests now use Vitest (make.wordpress.org) – Gutenberg moves from Jest to Vitest for native ESM support and real-browser testing. @wordpress/scripts 36.0.0 makes Vitest the default, and Jest stays available through test-unit-jest with no removal date.
→ New public repo: core release tools (make.wordpress.org) – The public core-release-utils repo holds six CLI tools that automate release chores such as drafting HelpHub pages, generating SVN tag commands, verifying GitHub mirrors, and building contributor lists. Minor releases can touch 20+ branches, so the tools cut manual errors.
→ CVE-2026-87902: A working PoC for WordPress’s critical path traversal (hadrian.io) – A working proof of concept for CVE-2026-87902 uses a double-encoded traversal payload in the pagename parameter to escape the theme directory. It needs a published page and a page-templates directory in the active theme, and it scores 9.2 on CVSS.
→ WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE (patchstack.com) – The flaw affects versions 4.7.0 to 7.1.1 and comes from weak validation of the pagename query parameter. Exploitation needs a theme with a page- prefixed directory and PHP with register_argc_argv enabled, which is common in Docker and cPanel setups.
→ Moving to a server-aware approach for collaboration (make.wordpress.org) – Collaboration moves from browser-only syncing to a model where the server takes part. That lets WordPress record who made each edit, check permissions, and merge updates coming from REST API or CLI tools.
→ Dev Chat Agenda – September 23, 2026 (make.wordpress.org) – The September 23 agenda covers the new Ipsum default theme for 7.2, calls for testing on the DataForm editor inspector, the server-aware collaboration approach, and the recently completed 7.1.1 and 7.1.2 releases.
→ Luganda Translation Workshop at WordCamp Jinja 2026 (make.wordpress.org) – Eleven contributors, two of them newcomers, translated 156 strings and reviewed 43 while learning GlotPress tools. Moses Cursor was table lead for the Luganda Translation Team.
From WordPress Community
→ The Page Builder Summit will be back in November 2026 (pagebuildersummit.com) – Page Builder Summit 8.0 runs November 2 to 6, 2026, for designers, developers, and agency owners working across WordPress, Shopify, Squarespace, and AI platforms. Registration opens soon through a waiting list.
→ Auctioning off my WordPress release albums (nomad.blog) – Anne McCarthy is auctioning the framed WordPress release albums she received as a sponsored contributor since 2020. Bidding starts at $500 at release-auction.blog, and proceeds go to Stimpunks, which supports neurodivergent and disabled people.
→ PressConf EU: WordPress Needs to Stop Playing Defense (thewpminute.com) – Organizer Raquel explains why PressConf is coming to Barcelona for the first time, October 27 to 30. She says WordPress businesses face growing uncertainty and need deliberate choices, and the sessions will be unrecorded to keep talks candid.
→ WordCamp Kathmandu 2026 Recap: What We Saw, Learned & Loved (sitesaga.com) – The event drew over 350 attendees on Conference Day and 220+ on Contributor Day, with 17 speakers. The Photos team added 200+ images to the repository, and the Polyglots team recruited 360+ Nepali translators.
→ Meet Wapuu Sa: All Dressed Up for WordCamp Rajasthan (rajasthan.wordcamp.org) – The event mascot wears a colorful pagdi and traditional Rajasthani attire, with a decorated camel companion. WordCamp Rajasthan takes place October 3 to 4, 2026, in Jaipur.
Until Next Week
A judge who dismissed WP Engine’s antitrust claims in September 2025 has now revived four of them, and triple damages are possible. Did one Ninth Circuit ruling about surgical-robot repairs just change the shape of this case? And what will the September 30 sanctions hearing over Matt Mullenweg’s WhatsApp, Signal, and Telegram messages turn up?
Hit reply with your take. If this issue was useful, pass it along.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply