WordPress 7.3 Agents, eCommerce Security, & Is AI Killing WordPress? | WP More – Issue 63

---

WordPress targets 7.3 for native AI agents, plus 75.5% of ecommerce respondents hit by incidents, AI fears, WordPress static sites and a WP Engine arbitration bid.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 63, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 23 WordPressers who joined us in the last 7 days! We are now 1166! Hip Hip Hurray!!!

This issue starts with the WordPress AI Team’s plan to make WordPress ready for the AI agents you bring, then looks at how ecommerce site owners handle security. We also have one long-time WordPress user’s answer to whether AI is killing WordPress, a static site built without leaving WordPress, and Automattic’s latest move in the WP Engine customer lawsuit.

---

In this Issue:

• WordPress Targets 7.3 for Native AI Agent Connections
• Three in Four Ecommerce Respondents Report a Security Incident
• Is WordPress Dying Because of AI? One Daily User Says No
• A Static Site Built in WordPress and Hosted for $0
• Automattic and Mullenweg Ask Court to Move WP Engine Customer Case to Arbitration

---

WordPress Targets 7.3 for Native AI Agent Connections

The WordPress AI Team has a plan for people who want to manage their sites through the agent of their choice. In the post’s vision, you tell your agent to help with your site, it recognizes WordPress, sends you an authorization link, and you sign in. Today that means installing the MCP Adapter plugin, finding useful Abilities, and pasting Application Passwords, which the post calls not scalable.

The proposal has four workstreams: MCP, Abilities, OAuth, and the end-to-end experience. The 7.2 cycle lays the foundations, and 7.3 is the target for bringing MCP into core, either merged directly or bundled. OAuth would replace manually shared Application Passwords. The team wants a focus lead for each area, plus Core Committers to partner with them. Inclusion in core still depends on technical readiness, security, and normal review.

Read the full blog on Make WordPress AI →

Meanwhile, a new survey looks at how WordPress store owners handle security.

---

Three in Four Ecommerce Respondents Report a Security Incident

Melapress pulled out the 106 ecommerce respondents from its 2026 WordPress security survey of 319 people. They rated their security concern 8.37 out of 10, and they report every measured control more often than other respondents. Even so, 75.5% had at least one security incident, and 72.7% of those had two or more.

Downtime was the most common impact at 70.8%, while only 19.4% named revenue loss. Two-factor authentication led the controls at 77.4%, but only 35.8% had a breach recovery plan. Someone noticing strange site behavior was the top way incidents were found, at 48.1%. And 67.9% manage WordPress security themselves. Melapress suggests assigning an owner to alerts and testing your backups before something breaks.

Read the full blog on Melapress →

Next, a longtime WordPress user answers whether AI is killing WordPress.

---

---

Is WordPress Dying Because of AI? One Daily User Says No

David Risley works in WordPress every day and says the death talk is overblown. Some of the numbers back the talk. W3Techs shows WordPress at 39.5% of all websites, down from a 43.6% peak at the start of 2025, and Barn2’s new sales fell 48% over two years. His read is that simple brochure sites, which never needed a content manager, are leaving for AI-built and static options.

Sites that do real work, such as memberships running FluentCRM and WooCommerce, have little reason to move. He expects plugins to move upmarket, with AI covering small one-off needs. He also moved his own site’s front end to Astro while WordPress runs the back end. His conclusion is that WordPress will keep serving sites that do real work, while simple sites move elsewhere.

Read the full blog on Blog Marketing Academy →

Next, a site owner shows one way to ship static files and still build in WordPress.

---

A Static Site Built in WordPress and Hosted for $0

Matt Cromwell rebuilt Rootsandfruit.com as a static site and kept WordPress as the place where he builds it. He works in WordPress Studio on his own machine, uses Cursor to build pages from his design system, and exports static files with Simply Static. Those files go live on Cloudflare Pages’ free plan, so his hosting bill dropped from $14 a month on Cloudways to $0.

The site scored 100 on Performance, Accessibility, Best Practices, and SEO in PageSpeed Insights. Static sites have limits, so his newsletter form could not use a PHP form plugin, and he wrote an endpoint that sends submissions to Mailerlite’s API. His point is that your marketing site may need WordPress only in your workshop. He has also published a generic design system template you can fork.

Read the full blog on Roots & Fruit →

Finally, the WP Engine legal fight has a new filing.

---

Automattic and Mullenweg Ask Court to Move WP Engine Customer Case to Arbitration

Automattic and Matt Mullenweg want to end the WP Engine customer class action. They asked a federal judge in the Northern District of California to send plaintiffs Ryan Keller and Sharon Schanzer to individual arbitration and drop the class claims. Their argument is that WP Engine’s hosting contracts require individual arbitration and bar class actions, so the plaintiffs cannot sue over those contracts while ignoring that part.

Newly unsealed records also show 86 near-identical emails from October 2024 offering agencies $100 for each site migrated from WP Engine, up to $10,000. If the judge agrees, the case stops being a class action. Keller and Schanzer must respond by November 13, with a hearing set for February 4, 2027.

Read the full report on The Repository →

---

WordPress Must Read

→ Every self-hosted ecommerce platform is shrinking except one (barn2.com) – Katie Keith of Barn2 measured 29 self-hosted ecommerce platforms with HTTP Archive data, and 27 lost share of the web over three years. Only WooCommerce and OpenCart gained, though WooCommerce lost 7.9% of its share in the last 12 months. Shopify gained 129,820 sites while the 27 losing platforms gave up 63,996, and she points to the host-first signup as a big friction point.

→ Akismet turns 21. Spam isn’t invited. (akismet.com) – Akismet turned 21 on October 25 and says it has blocked over 570 billion pieces of spam. This year it released an official Drupal module and an official PHP SDK, and version 5.7 of the WordPress plugin added support for Abilities and Connectors.

→ PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most (wordfence.com)

---

On Other WordPress News

→ WordPress 7.1.4 (wordpress.org) – A security release that fixes multiple issues, including stored XSS in several blocks and the Interactivity API, and a weakness in the upgrade process that can lead to remote code execution during the upgrade window. WordPress recommends updating immediately. The fixes are being backported to branches through 4.7, and 7.2 Beta 3 includes them.

→ WordPress 7.2 Beta 2 (wordpress.org) – Beta 2 continues work on the Abilities API, including content querying, capability requirements, and schema and permissions improvements. It also adds server-side registration for DataViews and DataForm. It is for test sites only, and the final release is scheduled for December 8, 2026.

→ Exploring a design for Feature Notifications (make.wordpress.org) – The post shares a prototype of one notification bell for a site, its plugins, and WordPress.com, with four layouts, critical alerts that turn the bell’s count red, and an Alerts tab. Existing admin notices keep working. It asks for feedback on open questions like badges and severity levels, and says it will not ship soon since the 0.3.0 feature plugin comes first.

→ The Core Security Initiative: two months in (make.wordpress.org) – WordPress HackerOne reports went from 20 to 30 a month for about a decade to 450 in July and 773 in August. There have been seven core security releases since mid July, with more than 50 Critical or High vulnerabilities closed, and 73% of the 109 release steps now have automation. The post asks researchers, organizations, and contributors for help.

→ Help Us Review and Improve the Learn WordPress Learning Pathways (make.wordpress.org) – The Training Team wants feedback on the User, Developer, and Designer pathways, such as outdated instructions, missing topics, and old version references. Feedback on even one lesson helps. The team will group suggestions, and subject matter experts will review them before changes are prioritized.

---

From WordPress Community

→ Raitis Sevelis on Life in Latvia, Boxing, WPBakery, Family, and Finding Humor in Everything (seriouslybud.substack.com) – Bud Kraus talks with Raitis Sevelis from Riga about travel, family, and growing up during Latvia’s transition from Soviet rule. Raitis also explains how boxing helps him stay focused and touches on his work at WPBakery. The episode runs about 31 minutes.

→ Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem (wordfence.com)

---

Until Next Week

The WordPress AI Team is looking for a focus lead for each of its four agent-ready areas, with 7.3 as the target for MCP and OAuth in core. Would you connect an agent to your site through an authorization link?

And with 75.5% of ecommerce respondents reporting a security incident, who owns the alerts on your site?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow WP More → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---