Automattic’s headcount dropped 28 in under four weeks, plus AI plugin security, an agent-fixed bug, Multisite marketing and WordPress built for agents.
This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 62, where you get curated news about WordPress and the WordPress community all in one place.
Hi5 to the 21 WordPressers who joined us in the last 7 days! We are now 1143! Hip Hip Hurray!!!
AI shows up in most of this issue. You’ll find a security checklist for AI plugins, a plugin developer whose agents took a support ticket to a merged fix in just over two hours, and an argument that WordPress was ready for agents all along. We also look at why Multisite needs better marketing, and what Automattic’s public headcount says about its latest layoffs.
In this Issue:
- How to Vet AI Plugins Before They Reach Your Site
- Why WordPress Multisite Needs Better Marketing
- A FooGallery Bug Fixed in Two Hours by AI Agents
- Why WordPress Was Built for Machines
- Automattic’s Layoffs Hit a Smaller Team
WordPress Vulnerabilities Rose 42% Last Year, So Vet Your AI Plugins Carefully
Hesham Saad turns Patchstack’s 2026 security report into a checklist for adding AI plugins safely. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, up 42%, with 91% in plugins. For the most heavily exploited flaws, the median time to first exploitation was five hours. AI plugins add their own risks, such as prompt injection and tools that can publish or delete without approval.
The guide recommends a separate API key for each site with spending limits, a dedicated low-role user for outside AI assistants instead of an administrator, and human approval for publishing, deleting, and settings changes. It also suggests rate limits on public chatbots and deleting AI plugins you no longer use. Before you install any AI plugin, ask what it can see, what it can change, and who can trigger it.
Read the full blog on Hesham Saad →
Next, a different kind of WordPress feature that few people think to use.
WordPress Multisite Has Been in Core for 16 Years and Still Has a Marketing Problem
Adam W. Warner argues that WordPress Multisite has a marketing problem. Multisite has been part of core since WordPress 3.0 in June 2010, yet many people still run separate installations tied together with tools like ManageWP. He points out that no single company profits when someone turns Multisite on, so few promote it to universities, franchises, or hosting customers.
His fix is to market outcomes, such as 30 franchise sites sharing one structure, instead of network administration. He also lists limits. A bad plugin or update can affect every site, not every plugin supports Multisite well, and moving a site out takes extra work. Warner’s case is that Multisite needs people who will show what it can already do.
Read the full blog on Talking Human →
Next, a plugin developer shows what happens when AI agents handle a support ticket from start to finish.
Brought to you by
WP More Socials
I send this newsletter every week, but do you want to keep up with WordPress and the community?
Then follow WP More’s social profile.
X (formerly Twitter) – https://x.com/WPMoree
LinkedIn – https://www.linkedin.com/company/wordpress-more/
BlueSky – https://bsky.app/profile/wpmore.bsky.social
I post there every day. So, you are not going to miss anything.
Follow WP More, Stay Updated with WordPress!
A FooGallery Bug Went From Support Ticket to Merged Fix in Two Hours
Brad Vincent of FooPlugins shared how his AI agents handled a FooGallery bug report from WordPress.org. A user said lazy loading and paging had broken their gallery. The agents reproduced the bug on a fresh WordPress site, traced it to an old Internet Explorer check that strict Content Security Policy settings block, and opened a pull request with tests.
He merged it 28 minutes after the pull request went up, just over 2 hours after the report came in, and the fix shipped in v3.3.7 a week later. A cron job checks the support feeds every 4 hours, and tracking which tickets it has seen is plain code, so no LLM has to remember. Merging, releasing, and replying to customers stay with a human.
Next, a look at why WordPress may already be ready for agents like these.
WordPress Was Built for Machines Long Before AI Agents Arrived
Miriam Schwab, Head of WordPress at Elementor, argues that WordPress was ready for AI agents long before they existed. Agents need machine-readable sites, and WordPress has offered that for years: RSS feeds since 2003, a REST API since 4.7, block markers in post content since 5.0, and Application Passwords since 5.6, which give each agent its own login you can revoke.
Roles and capabilities, around since WordPress 2.0, can limit what an agent is allowed to do. The Abilities API is now in core, while the MCP Adapter remains a separate plugin. Her point is that most of what agents need from a website already ships in every WordPress install.
Read the full blog on Elementor →
Meanwhile, Automattic’s public headcount shows how quickly its latest layoffs are adding up.
Automattic’s Layoffs Hit a Workforce Already a Third Smaller Than Its 2022 Peak
The Repository tracked Automattic’s live employee count as a new round of layoffs began. The About page listed 1,413 people on October 1 and lists 1,385 now, a drop of 28 in under four weeks. That compares with 2,065 at the October 2022 peak, and the count includes people who leave by choice. Monthly drops have grown since July, from 9 to 13, 15, and 28 so far in October.
TechCrunch reported cuts in communications, social, WordPress.com, and WordPress VIP, with insiders saying more will follow.
Read the full report on The Repository →
WordPress Must Read
→ ‘If Anything Happens to This Guy … Everyone Is Screwed’ (theatlantic.com)
→ Automattic begins layoffs following board upheaval and executive departures (techcrunch.com) – TechCrunch reports the cuts have hit Automattic’s communications team, social team, WordPress.com, and WordPress VIP, and insiders expect more. Director of communications Megan Fox said her role was eliminated. Insiders say the layoffs will be spread over the coming months to improve Q4 revenue ahead of a debt renegotiation due in June.
→ Benchmarking our own AI assistant (happinessengineer.blog) – Automattic CXO Job Thomas ran its AI assistant Odie through a public support benchmark from Gorgias, using 71 conversations across WooCommerce.com and WordPress.com. The headline scores looked best in class, but WooCommerce pre-sale answer quality scored 58 against 85 for WordPress.com, and only 20% of WooCommerce shopping chats had no contradictions. He explains how the scoring weights flattered the results.
→ Automating all accessibility testing is a pipe dream (linkedin.com)
→ WordPress parent’s problematic plans for .php (pending primary-string payoff) (pub.roddie.digital) – Automattic applied for the .php top-level domain as a backup string for its .vibe application, which has eight other applicants including Identity Digital, GoDaddy, and LFG. The author says the PHP Foundation could object when the window opens November 17, and that Automattic could get a 65% refund on its $227k fee by withdrawing by November 27. The PHP Foundation’s Derick Rethans said it will discuss the application internally.
→ When site owners ask for help, do agents get it done? (wpab.view.fast) – WordPress Agent Benchmarks tests how AI agents handle WordPress. Two agents tried 21 site owner prompts with and without the MCP adapter. With the adapter, agents could only do what had been written as an ability, and WordPress core’s three abilities only read site, user, and server information. The project’s other benchmark found none of the sites agents built used WordPress.
→ Corporate WordPress Security Benchmark 2026: Data from 141 Corporate/Brand Site Respondents (melapress.com) – Melapress surveyed 141 people who work on corporate or brand WordPress sites. 72.1% had at least one security incident, and downtime was the most common result among them at 69.5%. 70.2% use activity logs, but only 31.9% have a breach recovery plan, and 58.2% manage security themselves.
On Other WordPress News
→ Monthly Education Buzz Report – September 2026 (make.wordpress.org) – September was the busiest month yet for WordPress Campus Connect, with 13 events across India, Indonesia, Pakistan, Bangladesh, Malaysia, Costa Rica, and Spain. Campus Connect now makes up 64 of the 138 community events on the 2026 calendar. WordPress Credits counts 45 partner institutions, 363 graduates, and 924 students joined across 17 countries.
→ WooCommerce 11.3 MCP Adaptor updates (developer.woocommerce.com) – WooCommerce 11.3 removes the /wp-json/woocommerce/mcp endpoint and the legacy abilities deprecated since 10.9. Core product and order abilities are now on by default but need the WordPress MCP Adapter plugin active. If your MCP client uses the old endpoint with a WooCommerce REST API key, switch it to the adapter and a WordPress application password before upgrading.
→ WordPress Credits is opening sponsorship tiers (make.wordpress.org) – WordPress Credits will pilot five sponsorship tiers in 2027, from in-kind Friend sponsors through Five for the Future to Partner at $30,000 or more a year. Supporter is $5,000, Backer $10,000, and Champion $15,000. Campus Connect events stay separate, and the program says it has reached over 900 students across 17 countries.
→ The WordPress books now update from GitHub (make.wordpress.org) – The two books on wordpress.org/book, Milestones and Building Blocks, now pull from WordPress/library on GitHub every hour, so a merged fix goes live within the hour. EPUB and PDF downloads rebuild on every change, and footnotes now display properly. The author archived the old wp20-book repo and published the 9 fixes that still applied.
→ WPCC event payment arrangement in Indonesia (make.wordpress.org) – Events in Indonesia cannot use CampTix, so WordPress Community Support funds are held locally by an Indonesian WPCC event mentor, who pays vendors in IDR on each event’s behalf. Organizers send invoices, the mentor pays, and each payment goes into a ledger the organization can access. New organizers no longer front costs from their own pockets.
→ Recap: WordPress 7.1 “Mary Lou” Retrospective (make.wordpress.org) – This post synthesizes feedback from the 7.1 release retrospective. Respondents want to keep security auditing and release parties, and add a squad kick-off call and earlier visibility into editor UI changes for documentation. They suggest rethinking a live launch at an event, bringing back the Docs role, and looking at more release automation. The post calls these suggestions, not action items.
→ Critical PHP Security Release (wordpress.org) – The PHP project fixed two critical vulnerabilities, and WordPress.org urges site owners to update PHP right away. They affect any server hosting a PHP application, so no WordPress update is planned. Versions before 8.2 no longer get security updates, and site owners who run their own hosting on those versions are told to consider taking the server offline while they update. You can check your version under Tools > Site Health > Info > Server.
→ WordPress Contributor Toolkit 2.0: A redesigned app, in your language (make.wordpress.org) – Contributor Toolkit 2.0 brings an interface rebuilt on the WordPress Design System, a settings dialog, a dark theme, and ten languages. It is about 350 MB smaller, and a new changed-files tree lets you revert a single file without losing the patch you are testing. You still do not need Git, Node.js, npm, or Docker installed.
→ AI Contributor Weekly Summary – 21 October 2026 (make.wordpress.org) – At the October 21 meeting, AI Team rep Jason Adams said Matt Mullenweg approved making MCP a de facto part of WordPress. How is still open, from bundling the plugin to building parts into core, with 7.3 as a possible target and no commitment. Contributors also cited benchmarks showing 0% task completion through the MCP Adapter alone, and discussed OAuth and PHP AI Client maintenance.
→ WordPress 7.2 Beta 1 is Ready for Download and Testing (wordpress.org) – Beta 1 adds a Secrets API for storing credentials, text shadow controls, emoji reactions on Notes, an On This Day dashboard widget, and client-side media processing in the Media Library. The final release is scheduled for December 8, 2026. It is meant for test sites only, not production.
→ WordPress Contributor Toolkit v2.0.0-beta.1 (github.com) – This is the first beta of Toolkit 2.0, released October 13 as a pre-release while v1.2.1 stayed stable. It introduced the Design System interface, settings dialog, dark theme, and seven bundled languages. Sites now run as a local environment so Application Passwords can be tested over HTTP. The final 2.0 shipped October 23.
→ Help Test WordPress 7.2 (make.wordpress.org) – A call for testers with steps for the Secrets API, the DataForm post inspector, Notes upgrades, the Ipsum default theme, responsive gallery controls, and client-side media processing. It suggests testing on Playground, a local site, WP-CLI, or a staging site, never a live one. Testers are credited in the final release.
→ WordPress AI Team Moves to Make MCP a Default Part of WordPress, With 7.3 Floated as a Target (therepository.email) – Jason Adams of the AI Team said Matt Mullenweg approved building MCP into core, two weeks after the MCP Adapter launched as a plugin on WordPress.org. The adapter has passed 50,000 active installs. WordPress 7.3 is the floated target after an exception for 7.2 was briefly considered, and authentication is still unresolved.
→ New Benchmarks Find AI Agents Overlook WordPress and Can’t Complete Tasks via the Official MCP Adapter (therepository.email) – Andy Peatling’s WordPress Agent Benchmarks gave seven agents 28 website prompts, and none of the 193 sites built for suitable requests used WordPress, though 50 to 74% named it as a good fit afterward. On existing sites, agents completed 79% of tasks without the MCP Adapter and none with it, since core has only three read-only abilities. Adding write abilities for pages, posts, settings, and media would let it handle 17 of the 21 prompts.
From WordPress Community
→ Accessibility at Scale: How Equalize Digital Helped WooCommerce Meet WCAG 2.2 AA Across 41 Extensions (equalizedigital.com) – Equalize Digital audited 43 WooCommerce extensions between June 2025 and August 2026 and found 519 issues failing 32 WCAG success criteria. Teams at Automattic and Fueled fixed 41 of the extensions, and 41 Accessibility Conformance Reports are now published. Issues in Amazon Pay and Affirm were reported to those vendors.
→ WordPress Youth Day Nicarargua 2026 – Evento tecnológico con enfoque juvenil (events.wordpress.org) – WordPress Youth Day Nicaragua 2026 was set for October 10 at TIGO Nicaragua in Managua, with tracks by age for ages 9 to 18 and a first-ever Valkirias workshop for young women aged 15 to 20 who run or help with a family business. Past editions ran in 2024 and 2025. Sponsors include Yoast, Woo, Hostinger, and Automattic.
→ Call for Contributor Stories – Share What You’ve Learned From Contributing to WordPress (asia.wordcamp.org) – WordCamp Asia 2027 wants short accounts of what you learned from contributing to WordPress, such as a first contribution, a lesson learned the hard way, or a better way to collaborate. A few paragraphs or bullet points are enough, since the team follows up, shapes selected stories with you, and has you fact-check before publication. The event runs April 9 to 11, 2027 in Penang.
→ Sunil Kumar Sharma receives the Yoast Care fund for his contributions to the WordPress community. (yoast.com) – Yoast gave its Care Fund to Sunil Kumar Sharma, nominated by Prathamesh Palve. Through WP Simplified he teaches WordPress in Hindi and Hinglish, and his WordPress Training Program drew more than 700 registrations. He also helped organize WordPress Campus Connect in Jaipur and was a media partner for WordCamp Asia 2026.
→ Is WordPress Dead? – No, still powering 39.6% of the internet. (iswpdead.com) – A one-page site that answers no and says WordPress powers 39.6% of all websites, citing W3Techs, with 58.4% share among known CMSs. It was built with WordPress by Tiny Plugin Labs.
Until Next Week
Automattic’s public headcount fell from 1,413 to 1,385 in under four weeks, and the company has not said how many people are affected. Does a smaller Automattic change how you think about relying on its products? or How it would impact it’s contribution to WordPress.org?
And which of Hesham Saad’s AI plugin checks will you apply to your own site first?
Hit reply with your take. If this issue was useful, pass it along.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply