Mary Hubbard asks 30+ companies to fund WordPress security, plus the MCP Adapter is out, September plugin data in, how a patch ships and WordCamp Asia 2027.
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 60, where you get curated news about WordPress and the WordPress community all in one place.
Hi5 to the 29 WordPressers who joined us in the last 7 days! We are now 1100! Hip Hip Hurray!!!
This week brings a funding request from WordPress’s Executive Director to more than 30 companies, and a new plugin that lets AI agents connect to your site. We also cover how a security fix gets from report to release, September’s plugin download numbers, and why WordCamp is worth a visit.
In this Issue:
- What WordCamp Is and Why You Should Go
- The MCP Adapter Plugin Arrives on WordPress.org
- September Plugin Download Numbers
- How a WordPress Security Release Happens
- The Call to Fund WordPress Security
What a WordCamp Is and Why You Should Go
A WordCamp is a community-organized event for people who use, build, design, write for, and contribute to WordPress. Local communities run them, and they range from small gatherings to larger regional events. You don’t need to be a WordPress expert or a contributor to attend. Site owners, bloggers, freelancers, agency staff, students, and beginners are all welcome.
Expect talks on topics like accessibility, performance, security, design, and online business, plus workshops and networking between sessions and over lunch. Some events also run a Contributor Day, where newcomers can help with code, documentation, translation, testing, or support.
WordCamp Asia 2027 runs April 9 to 11 in Penang, Malaysia, and ticket availability is limited.
Read the full blog on WordCamp Asia →
Next, a new plugin from the WordPress AI team.
The MCP Adapter Plugin Is Now on WordPress.org
The WordPress AI team has released MCP Adapter 0.7.0, the first version of the plugin on the WordPress.org Plugin Directory. It gives your site a way to expose functionality to AI agents through the Model Context Protocol (MCP). The plugin ships a default MCP server and bridges the Abilities API, introduced in WordPress 6.9, so publicly exposed abilities can be discovered and run through it. Developers can also build custom MCP servers.
Version 0.7.0 adds support for the new stateless 2026-07-28 MCP spec. If you installed an earlier version from GitHub or Composer, check the 0.7.0 migration guide first.
The plugin is still experimental, and the team is working toward a stable 1.0 release. It provides server infrastructure only, with no MCP client or user-facing interface.
Read the full blog on Make WordPress AI →
Plugin downloads had a few big swings in September.
Brought to you by
WP More Socials
I send this newsletter every week, but do you want to keep up with WordPress and the community?
Then follow WP More’s social profile.
X (formerly Twitter) – https://x.com/WPMoree
LinkedIn – https://www.linkedin.com/company/wordpress-more/
BlueSky – https://bsky.app/profile/wpmore.bsky.social
I post there every day. So, you are not going to miss anything.
Follow WP More, Stay Updated with WordPress!
Plugin Downloads Held Flat in September While a Few Plugins Swung Hard
Rivale’s latest plugin market report tracks the top 12,500 WordPress plugins, and September was nearly flat. Downloads totaled 226.7 million over 30 days, against 232.0 million over 31 days in August, a 1.0% rise per day. Two plugins in three had more daily downloads than in August.
The movement came from a few plugins. Elementor rose 54% per day, from 11.3 million to 16.9 million, and Yoast SEO gained 29%. Akismet fell 81%, from 8.8 million to 1.6 million, and Contact Form 7 fell 66%.
The 110 plugins tagged AI had a median daily download gain of 28.4%, against 8.5% across all of the top 12,500. Of the 4,575 plugins with no release since September 2025, 3,928 still gained daily downloads.
Read the full blog on Rivale →
Next, how a WordPress security fix gets from a researcher’s report to your site.
How a WordPress Security Release Goes From Report to Patch
Human Made walks through what happens after a researcher reports a vulnerability. Reports arrive privately through WordPress’s HackerOne program or directly to the Security Team. The team verifies the issue, assesses severity in a private workspace, writes a fix, and tests it.
For serious issues, major hosts, CDNs, and web application firewall vendors get advance notice so protections can go in before the public release. Critical issues get an immediate standalone release, while minor ones wait for the next scheduled release. An advisory then goes up on WordPress.org News, and severe issues may get a CVE.
Keep automatic updates on for minor and security releases unless you have a reason to turn them off. They can protect many sites within hours of a fix shipping, and you get a confirmation email when an update finishes. If they’re off, apply security updates when your dashboard prompts you.
Read the full blog on Human Made →
That process takes time and money, and WordPress’s Executive Director now wants more companies to chip in.
Mary Hubbard Asks Hosts and Plugin Companies to Fund WordPress Security
WordPress Executive Director Mary Hubbard has emailed more than 30 of the biggest companies in WordPress, including GoDaddy, Newfold Digital, and Hostinger, and asked them to help fund the project’s security program. She wrote that the program received nearly 2,000 reports in 90 days. WordPress’s HackerOne page shows 2,004 reports and more than $90,000 in bounties paid in that window, out of just over $200,000 since 2017. Hubbard wrote that Automattic has funded 100% of it.
She suggested a shared bounty pool or sponsored help with triage and release work. “One company can’t carry this alone,” she wrote. Kinsta and Awesome Motive asked for a clearly defined program, and Hostinger said it is exploring dedicating its own people. Patchstack’s CEO said proven contributors should be able to take part in security decisions.
Read the full blog on The Repository →
WordPress Must Read
→ Automattic interim CFO resigns just weeks after boardroom shakeup (techcrunch.com) – Jeremy Klaperman left his interim CFO role at Automattic less than a month after taking it, following a demotion back to his old post running the VIP Enterprise unit amid reported friction with CEO Matt Mullenweg. Automattic is still searching for a permanent CFO.
→ Automattic Wants .wordpress. It Doesn’t Own WordPress. (medium.com) – Kellie Peterson argues that Automattic’s ICANN application for a closed .wordpress domain depends on presenting WordPress as a brand, even though the nonprofit WordPress Foundation holds the trademark. She urges the public to comment before the window closes on March 16, 2027.
→ Judge Says He’s Leaning Toward Denying WP Engine’s Bid to Sanction Automattic Over Disappearing Messages (therepository.email) – At a Wednesday hearing, Magistrate Judge Ajay Krishnan said he tentatively favors denying WP Engine’s motion to sanction Automattic and Matt Mullenweg over messages WP Engine says were destroyed. He acknowledged that Mullenweg’s September 2024 X post was problematic but said he wasn’t seeing enough to find spoliation. The jury trial is set for October 19, 2027.
On Other WordPress News
→ What’s new in AI 1.4.0 (5 OCTOBER 2026)? (make.wordpress.org) – AI 1.4.0 adds a Markdown Feeds experiment that serves site content in Markdown for AI systems and other tools, plus a 0-to-1 score that rates how substantive each comment is during moderation. It also expands embedding and vector storage and raises the minimum WordPress version to 7.0.3.
→ Making space for the next generation of WordPress builders (make.wordpress.org) – Isotta Peira proposes a repeatable 2027 framework that brings WordPress Credits students into flagship events, starting with WordCamp Asia 2027, after Kraków students presented their sites at WordCamp Europe 2026. It calls for one to three reserved slots per event, and feedback is requested by October 30.
→ Spacefast for WordPress (github.com) – A WordPress plugin that publishes your site to Spacefast, either as a static export from the free Simply Static plugin or as a headless CMS that feeds an Astro or other project. In headless mode, public content changes trigger a rebuild of the connected project.
→ WordPress 7.2 Release Party Schedule (make.wordpress.org) – Beta parties run on October 20, October 27, November 3, and November 10, followed by release candidates on November 17, November 24, and December 1. A dry run is set for December 7 and the final release for December 8, all at 15:00 UTC.
→ WordPress MCP Adapter Now Available as a Canonical Plugin on WordPress.org (therepository.email) – The MCP Adapter passed 40,000 active installs less than a week after launch, and it lets assistants like Claude and ChatGPT use the abilities a site exposes. It is not going into core for now, with GoDaddy’s Nik McLaughlin saying MCP’s volatility makes it a poor fit for the core package at this time.
→ WordPress 7.1.3 Patches Seven Vulnerabilities as Bug Bounty Payouts Top $90,000 in 90 Days (therepository.email) – WordPress 7.1.3 fixes seven security vulnerabilities and four bugs, with Anthropic credited for three of the security reports. Patchstack’s Chazz Wolcott says only two of the flaws can be triggered by unauthenticated visitors and says it isn’t a drop-everything emergency.
→ Automattic Applies for Closed .wordpress Domain in ICANN’s First Application Round Since 2012 (therepository.email) – Automattic’s registry subsidiary, Knock Knock WHOIS There, applied for .wordpress as a closed, single-registrant namespace that would bar unaffiliated third parties from registering domains. The application seeks a Code of Conduct exemption instead of brand TLD status and does not mention the WordPress Foundation, which owns the WordPress trademarks.
From WordPress Community
→ Be the Voice of WordCamp Asia 2027 – Apply as an Emcee (asia.wordcamp.org) – WordCamp Asia 2027 is taking emcee applications for the April 9 to 11 event in Penang. The call asks for people who enjoy engaging crowds, communicate well, and can keep energy up through the day. Applications are due November 27.
→ Charleen Mullenweg (seriouslybud.com) – Host Bud Kraus talks with professional genealogist Charleen Mullenweg on Seriously, BUD? about her genealogy work, including volunteer forensic genetic genealogy projects and documenting eligibility for lineage societies. The conversation also covers her views on AI and her long involvement in the WordPress community.
→ liberate.sh: take your website anywhere (liberate.sh) – An open-source tool from the makers of WordPress Studio that converts a Wix, Squarespace, Shopify, or Webflow site into a WordPress site you own. You download the packaged site, with its pages, images, and design, and host it anywhere you choose.
→ Checkout Summit 2027 | 28 Apr-1 May | WooCommerce Conference (checkoutsummit.com) – An independent in-person event for WooCommerce founders, developers, agencies, and merchants, held in Palermo, Sicily. It has 12 single-track talks, roundtables, and about 150 attendees.
→ Behind the scenes of PressConf: the business-focused WordPress event coming to Europe (wpbuilds.com) – Raquel Manriquez, Jaume Freixa, and Carol Stambaugh discuss PressConf, a small business-focused event that revives the spirit of PressNomics and debuts in Barcelona from October 27 to 30, 2026. It runs single-track sessions with no sponsor sales pitches at one hotel venue.
→ Agenda – CloudFest Americas (cloudfest.com) – CloudFest Americas runs November 11 and 12, 2026 at ICE Palace Studios in Miami, with an agenda covering cloud, hosting, AI, security, and internet infrastructure. The detailed session schedule is members-only.
→ WordPress.com Education: How Two Design Students Built a Nonprofit’s Website (wordpress.com) – UX design master’s students Constanza Diaz and Axcel Paucar Garcia built a live site for Odón Solar, a Spanish clean-energy nonprofit, during an internship. They spent 125 hours on research, design, and client work, and built the site with Studio Code, WordPress Studio’s AI agent.
→ ACF Is Getting an AI Upgrade, But It’s Not What You Think (thewpminute.com) – ACF 6.8 lays groundwork for AI through support for the Abilities API, MCP, AI agents, and JSON-LD structured data. The team plans focused tasks, such as suggesting likely fields when you create a field group, and says its AI features will be opt-in.
→ We Moved Five WordPress Sites to EmDash the Week 1.0 Shipped (vapvarun.com) – The author’s team moved five WordPress content sites to Cloudflare’s free, MIT-licensed EmDash CMS between September 24 and 28, then upgraded to 1.0.1 on September 29. Enabling D1 read replication fixed slow uncached pages and brought one home page from 10 to 13 seconds down to under one second.
→ WordCamp Kathmandu 2026 Experience (wpmore.net) – My recap of WordCamp Kathmandu 2026 on September 18 and 19, where I joined my first official Contributor Day at the Core table and gave a marketer’s view on a few Trac tickets, including the Site Icon helper text. I also sat in on sessions about WordPress education programs, using AI for augmentation, and building a free classroom platform with WordPress.
→ My WordCamp Sylhet 2026 Experience (wpmore.net) – My recap of WordCamp Sylhet 2026 on October 2 and 3, the event’s third edition, with nearly 400 attendees. It covers the organizers’ no-swag policy, the marketing table at Contributor Day, and sessions on measuring results when search stops sending traffic and on AI and plugin security.
Until Next Week
WordPress security reports ran 20 to 30 a month for a decade, then hit 773 in August, and Hubbard says Automattic has paid for all of it so far. Should hosts and plugin companies split the cost? What would a fair split look like to you?
Hit reply with your take. If this issue was useful, pass it along.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply