Author: Nishat Shahriyar

---

Automattic’s headcount dropped 28 in under four weeks, plus AI plugin security, an agent-fixed bug, Multisite marketing and WordPress built for agents.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 62, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 21 WordPressers who joined us in the last 7 days! We are now 1143! Hip Hip Hurray!!!

AI shows up in most of this issue. You’ll find a security checklist for AI plugins, a plugin developer whose agents took a support ticket to a merged fix in just over two hours, and an argument that WordPress was ready for agents all along. We also look at why Multisite needs better marketing, and what Automattic’s public headcount says about its latest layoffs.

---

In this Issue:

• How to Vet AI Plugins Before They Reach Your Site
• Why WordPress Multisite Needs Better Marketing
• A FooGallery Bug Fixed in Two Hours by AI Agents
• Why WordPress Was Built for Machines
• Automattic’s Layoffs Hit a Smaller Team

---

WordPress Vulnerabilities Rose 42% Last Year, So Vet Your AI Plugins Carefully

Hesham Saad turns Patchstack’s 2026 security report into a checklist for adding AI plugins safely. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, up 42%, with 91% in plugins. For the most heavily exploited flaws, the median time to first exploitation was five hours. AI plugins add their own risks, such as prompt injection and tools that can publish or delete without approval.

The guide recommends a separate API key for each site with spending limits, a dedicated low-role user for outside AI assistants instead of an administrator, and human approval for publishing, deleting, and settings changes. It also suggests rate limits on public chatbots and deleting AI plugins you no longer use. Before you install any AI plugin, ask what it can see, what it can change, and who can trigger it.

Read the full blog on Hesham Saad →

Next, a different kind of WordPress feature that few people think to use.

---

WordPress Multisite Has Been in Core for 16 Years and Still Has a Marketing Problem

Adam W. Warner argues that WordPress Multisite has a marketing problem. Multisite has been part of core since WordPress 3.0 in June 2010, yet many people still run separate installations tied together with tools like ManageWP. He points out that no single company profits when someone turns Multisite on, so few promote it to universities, franchises, or hosting customers.

His fix is to market outcomes, such as 30 franchise sites sharing one structure, instead of network administration. He also lists limits. A bad plugin or update can affect every site, not every plugin supports Multisite well, and moving a site out takes extra work. Warner’s case is that Multisite needs people who will show what it can already do.

Read the full blog on Talking Human →

Next, a plugin developer shows what happens when AI agents handle a support ticket from start to finish.

---

---

A FooGallery Bug Went From Support Ticket to Merged Fix in Two Hours

Brad Vincent of FooPlugins shared how his AI agents handled a FooGallery bug report from WordPress.org. A user said lazy loading and paging had broken their gallery. The agents reproduced the bug on a fresh WordPress site, traced it to an old Internet Explorer check that strict Content Security Policy settings block, and opened a pull request with tests.

He merged it 28 minutes after the pull request went up, just over 2 hours after the report came in, and the fix shipped in v3.3.7 a week later. A cron job checks the support feeds every 4 hours, and tracking which tickets it has seen is plain code, so no LLM has to remember. Merging, releasing, and replying to customers stay with a human.

Read the full post on X →

Next, a look at why WordPress may already be ready for agents like these.

---

WordPress Was Built for Machines Long Before AI Agents Arrived

Miriam Schwab, Head of WordPress at Elementor, argues that WordPress was ready for AI agents long before they existed. Agents need machine-readable sites, and WordPress has offered that for years: RSS feeds since 2003, a REST API since 4.7, block markers in post content since 5.0, and Application Passwords since 5.6, which give each agent its own login you can revoke.

Roles and capabilities, around since WordPress 2.0, can limit what an agent is allowed to do. The Abilities API is now in core, while the MCP Adapter remains a separate plugin. Her point is that most of what agents need from a website already ships in every WordPress install.

Read the full blog on Elementor →

Meanwhile, Automattic’s public headcount shows how quickly its latest layoffs are adding up.

---

Automattic’s Layoffs Hit a Workforce Already a Third Smaller Than Its 2022 Peak

The Repository tracked Automattic’s live employee count as a new round of layoffs began. The About page listed 1,413 people on October 1 and lists 1,385 now, a drop of 28 in under four weeks. That compares with 2,065 at the October 2022 peak, and the count includes people who leave by choice. Monthly drops have grown since July, from 9 to 13, 15, and 28 so far in October.

TechCrunch reported cuts in communications, social, WordPress.com, and WordPress VIP, with insiders saying more will follow.

Read the full report on The Repository →

---

WordPress Must Read

→ ‘If Anything Happens to This Guy … Everyone Is Screwed’ (theatlantic.com)

→ Automattic begins layoffs following board upheaval and executive departures (techcrunch.com) – TechCrunch reports the cuts have hit Automattic’s communications team, social team, WordPress.com, and WordPress VIP, and insiders expect more. Director of communications Megan Fox said her role was eliminated. Insiders say the layoffs will be spread over the coming months to improve Q4 revenue ahead of a debt renegotiation due in June.

→ Benchmarking our own AI assistant (happinessengineer.blog) – Automattic CXO Job Thomas ran its AI assistant Odie through a public support benchmark from Gorgias, using 71 conversations across WooCommerce.com and WordPress.com. The headline scores looked best in class, but WooCommerce pre-sale answer quality scored 58 against 85 for WordPress.com, and only 20% of WooCommerce shopping chats had no contradictions. He explains how the scoring weights flattered the results.

→ Automating all accessibility testing is a pipe dream (linkedin.com)

→ WordPress parent’s problematic plans for .php (pending primary-string payoff) (pub.roddie.digital) – Automattic applied for the .php top-level domain as a backup string for its .vibe application, which has eight other applicants including Identity Digital, GoDaddy, and LFG. The author says the PHP Foundation could object when the window opens November 17, and that Automattic could get a 65% refund on its $227k fee by withdrawing by November 27. The PHP Foundation’s Derick Rethans said it will discuss the application internally.

→ When site owners ask for help, do agents get it done? (wpab.view.fast) – WordPress Agent Benchmarks tests how AI agents handle WordPress. Two agents tried 21 site owner prompts with and without the MCP adapter. With the adapter, agents could only do what had been written as an ability, and WordPress core’s three abilities only read site, user, and server information. The project’s other benchmark found none of the sites agents built used WordPress.

→ Corporate WordPress Security Benchmark 2026: Data from 141 Corporate/Brand Site Respondents (melapress.com) – Melapress surveyed 141 people who work on corporate or brand WordPress sites. 72.1% had at least one security incident, and downtime was the most common result among them at 69.5%. 70.2% use activity logs, but only 31.9% have a breach recovery plan, and 58.2% manage security themselves.

---

On Other WordPress News

→ Monthly Education Buzz Report – September 2026 (make.wordpress.org) – September was the busiest month yet for WordPress Campus Connect, with 13 events across India, Indonesia, Pakistan, Bangladesh, Malaysia, Costa Rica, and Spain. Campus Connect now makes up 64 of the 138 community events on the 2026 calendar. WordPress Credits counts 45 partner institutions, 363 graduates, and 924 students joined across 17 countries.

→ WooCommerce 11.3 MCP Adaptor updates (developer.woocommerce.com) – WooCommerce 11.3 removes the /wp-json/woocommerce/mcp endpoint and the legacy abilities deprecated since 10.9. Core product and order abilities are now on by default but need the WordPress MCP Adapter plugin active. If your MCP client uses the old endpoint with a WooCommerce REST API key, switch it to the adapter and a WordPress application password before upgrading.

→ WordPress Credits is opening sponsorship tiers (make.wordpress.org) – WordPress Credits will pilot five sponsorship tiers in 2027, from in-kind Friend sponsors through Five for the Future to Partner at $30,000 or more a year. Supporter is $5,000, Backer $10,000, and Champion $15,000. Campus Connect events stay separate, and the program says it has reached over 900 students across 17 countries.

→ The WordPress books now update from GitHub (make.wordpress.org) – The two books on wordpress.org/book, Milestones and Building Blocks, now pull from WordPress/library on GitHub every hour, so a merged fix goes live within the hour. EPUB and PDF downloads rebuild on every change, and footnotes now display properly. The author archived the old wp20-book repo and published the 9 fixes that still applied.

→ WPCC event payment arrangement in Indonesia (make.wordpress.org) – Events in Indonesia cannot use CampTix, so WordPress Community Support funds are held locally by an Indonesian WPCC event mentor, who pays vendors in IDR on each event’s behalf. Organizers send invoices, the mentor pays, and each payment goes into a ledger the organization can access. New organizers no longer front costs from their own pockets.

→ Recap: WordPress 7.1 “Mary Lou” Retrospective (make.wordpress.org) – This post synthesizes feedback from the 7.1 release retrospective. Respondents want to keep security auditing and release parties, and add a squad kick-off call and earlier visibility into editor UI changes for documentation. They suggest rethinking a live launch at an event, bringing back the Docs role, and looking at more release automation. The post calls these suggestions, not action items.

→ Critical PHP Security Release (wordpress.org) – The PHP project fixed two critical vulnerabilities, and WordPress.org urges site owners to update PHP right away. They affect any server hosting a PHP application, so no WordPress update is planned. Versions before 8.2 no longer get security updates, and site owners who run their own hosting on those versions are told to consider taking the server offline while they update. You can check your version under Tools > Site Health > Info > Server.

→ WordPress Contributor Toolkit 2.0: A redesigned app, in your language (make.wordpress.org) – Contributor Toolkit 2.0 brings an interface rebuilt on the WordPress Design System, a settings dialog, a dark theme, and ten languages. It is about 350 MB smaller, and a new changed-files tree lets you revert a single file without losing the patch you are testing. You still do not need Git, Node.js, npm, or Docker installed.

→ AI Contributor Weekly Summary – 21 October 2026 (make.wordpress.org) – At the October 21 meeting, AI Team rep Jason Adams said Matt Mullenweg approved making MCP a de facto part of WordPress. How is still open, from bundling the plugin to building parts into core, with 7.3 as a possible target and no commitment. Contributors also cited benchmarks showing 0% task completion through the MCP Adapter alone, and discussed OAuth and PHP AI Client maintenance.

→ WordPress 7.2 Beta 1 is Ready for Download and Testing (wordpress.org) – Beta 1 adds a Secrets API for storing credentials, text shadow controls, emoji reactions on Notes, an On This Day dashboard widget, and client-side media processing in the Media Library. The final release is scheduled for December 8, 2026. It is meant for test sites only, not production.

→ WordPress Contributor Toolkit v2.0.0-beta.1 (github.com) – This is the first beta of Toolkit 2.0, released October 13 as a pre-release while v1.2.1 stayed stable. It introduced the Design System interface, settings dialog, dark theme, and seven bundled languages. Sites now run as a local environment so Application Passwords can be tested over HTTP. The final 2.0 shipped October 23.

→ Help Test WordPress 7.2 (make.wordpress.org) – A call for testers with steps for the Secrets API, the DataForm post inspector, Notes upgrades, the Ipsum default theme, responsive gallery controls, and client-side media processing. It suggests testing on Playground, a local site, WP-CLI, or a staging site, never a live one. Testers are credited in the final release.

→ WordPress AI Team Moves to Make MCP a Default Part of WordPress, With 7.3 Floated as a Target (therepository.email) – Jason Adams of the AI Team said Matt Mullenweg approved building MCP into core, two weeks after the MCP Adapter launched as a plugin on WordPress.org. The adapter has passed 50,000 active installs. WordPress 7.3 is the floated target after an exception for 7.2 was briefly considered, and authentication is still unresolved.

→ New Benchmarks Find AI Agents Overlook WordPress and Can’t Complete Tasks via the Official MCP Adapter (therepository.email) – Andy Peatling’s WordPress Agent Benchmarks gave seven agents 28 website prompts, and none of the 193 sites built for suitable requests used WordPress, though 50 to 74% named it as a good fit afterward. On existing sites, agents completed 79% of tasks without the MCP Adapter and none with it, since core has only three read-only abilities. Adding write abilities for pages, posts, settings, and media would let it handle 17 of the 21 prompts.

---

From WordPress Community

→ Accessibility at Scale: How Equalize Digital Helped WooCommerce Meet WCAG 2.2 AA Across 41 Extensions (equalizedigital.com) – Equalize Digital audited 43 WooCommerce extensions between June 2025 and August 2026 and found 519 issues failing 32 WCAG success criteria. Teams at Automattic and Fueled fixed 41 of the extensions, and 41 Accessibility Conformance Reports are now published. Issues in Amazon Pay and Affirm were reported to those vendors.

→ WordPress Youth Day Nicarargua 2026 – Evento tecnológico con enfoque juvenil (events.wordpress.org) – WordPress Youth Day Nicaragua 2026 was set for October 10 at TIGO Nicaragua in Managua, with tracks by age for ages 9 to 18 and a first-ever Valkirias workshop for young women aged 15 to 20 who run or help with a family business. Past editions ran in 2024 and 2025. Sponsors include Yoast, Woo, Hostinger, and Automattic.

→ Call for Contributor Stories – Share What You’ve Learned From Contributing to WordPress (asia.wordcamp.org) – WordCamp Asia 2027 wants short accounts of what you learned from contributing to WordPress, such as a first contribution, a lesson learned the hard way, or a better way to collaborate. A few paragraphs or bullet points are enough, since the team follows up, shapes selected stories with you, and has you fact-check before publication. The event runs April 9 to 11, 2027 in Penang.

→ Sunil Kumar Sharma receives the Yoast Care fund for his contributions to the WordPress community. (yoast.com) – Yoast gave its Care Fund to Sunil Kumar Sharma, nominated by Prathamesh Palve. Through WP Simplified he teaches WordPress in Hindi and Hinglish, and his WordPress Training Program drew more than 700 registrations. He also helped organize WordPress Campus Connect in Jaipur and was a media partner for WordCamp Asia 2026.

→ Is WordPress Dead? – No, still powering 39.6% of the internet. (iswpdead.com) – A one-page site that answers no and says WordPress powers 39.6% of all websites, citing W3Techs, with 58.4% share among known CMSs. It was built with WordPress by Tiny Plugin Labs.

---

Until Next Week

Automattic’s public headcount fell from 1,413 to 1,385 in under four weeks, and the company has not said how many people are affected. Does a smaller Automattic change how you think about relying on its products? or How it would impact it’s contribution to WordPress.org?

And which of Hesham Saad’s AI plugin checks will you apply to your own site first?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

A 6-year-old accessibility fix was reverted in 19 hours, plus WordPress plugin sales down 48%, an open letter to Matt Mullenweg, an MCP server guide, and 47.6% of Europe on WordPress.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 61, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 22 WordPressers who joined us in the last 7 days! We are now 1122! Hip Hip Hurray!!!

This week’s biggest story starts on a Trac ticket about accessible admin notices and ends with a long-time core committer losing his WordPress.org positions. We also have a plugin founder on why new sales are down 48% in two years, an open letter to Mullenweg on accessibility in WordPress, a hands-on MCP server tutorial, and data on WordPress across 32 European countries.

Thanks for reading WP More! Subscribe for free to receive new posts and support my work.

---

In this Issue:

• Why WordPress Plugin Sales Are Falling
• An Open Letter to Matt Mullenweg on Accessibility
• How to Build an MCP Server in WordPress
• WordPress Across 32 European Countries
• Mullenweg Orders an Accessibility Revert

---

Why WordPress Plugin Sales Are Falling and What to Do About It

Katie Keith of Barn2 explains why new plugin sales have dropped for about two years. Over two years to September 2026, her company’s new sales revenue fell 48% while renewals rose 32%. Paid Memberships Pro and GravityKit saw drops of 48% and 47%. She names five causes: collapsing search traffic, a smaller market, plugins AI can replace, a category leader, and features added to core. Some of the lost traffic is not coming back, so she is leaning on partnerships, email, marketplaces, and platforms beyond WordPress.

Read the full blog on WP Product Talk →

Next, an open letter to Matt Mullenweg puts accessibility in WordPress under the spotlight.

---

An Open Letter to Matt Mullenweg on Accessibility in WordPress

Darrell Hilliker, a blind screen reader user and publisher of Blind Access Journal, has published an open letter to Matt Mullenweg about Trac ticket #50486. He says reverting an imperfect change is normal, but he objects to how the decision was made, since no technical reasoning accompanied the comment removing Andrea Fercia’s roles. He also points to Mullenweg’s August declaration that the Accessibility Team overstepped and the 2025 idea of a canonical accessibility plugin. The letter asks five questions, including whether accessibility is a core requirement, what the timeline is for accessible admin notices, and what process governs removals. Hilliker says Blind Access Journal will publish any response from Mullenweg in full and without edits.

Read the full blog on Blind Access Journal →

Now for something hands-on: how to give AI tools a way into your site.

---

---

How to Build an MCP Server in WordPress with the Abilities API

WS Form’s Mark Westguard walks through building an MCP server in WordPress so AI clients like Claude can work with your site. He registers a simple ability that returns the site title, exposes it as an MCP tool, and locks it behind a permission check. Testing runs through MCP Inspector, VS Code, and Claude Desktop. The guide covers Abilities API 0.4.0 and MCP Adapter 0.3.0. It is meant for local experiments only, and Westguard warns both tools are still in development and may break your code.

Read the full blog on WS Form →

Next, a data report on the hosts, versions, and plugins behind Europe’s WordPress sites.

---

Nearly Half of European Homepages Run WordPress

Nettingale, a WordPress host, analyzed 4,096,194 homepages across 32 European countries using Common Crawl data from September 2026. WordPress runs 47.6% of them, from 59.4% in Estonia to 34.5% in Czechia among countries with at least 3,500 WordPress sites. In Lithuania, Hostinger serves 74.3% of WordPress sites, while the Netherlands’ largest host serves just 8.8%. 21.6% of sites run a version older than 6.9, and 23.0% of those showing a PHP version use PHP 7, which stopped getting security fixes in November 2022.

Read the full blog on Nettingale →

Finally, a dispute over accessibility work that played out on a Trac ticket.

---

Matt Mullenweg Orders an Accessibility Revert and Removes a Core Committer

Matt Mullenweg told long-time core committer Andrea Fercia he no longer holds any WordPress.org positions, titles, or authority. The comment came on Trac ticket #50486, a six-year-old effort to make admin notices accessible, where Mullenweg wrote, “Please revert all of this.” The ticket aimed to alert screen reader users when an admin notice appears. Core committer Joe Dolson had committed the change days earlier, then reverted it about 19 hours after Mullenweg’s comment, saying the complexity of notices in the admin made it premature.

Fercia, who got commit access in 2015 and has contributed to 33 releases, saw his WordPress.org account locked, then restored. The admin notices work now moves to a future release, possibly through the Feature Notifications project. Mullenweg later said in Slack the removal was no mistake because he was no longer interested in Fercia’s contributions.

Read the full blog on The Repository →

---

WordPress Must Read

→ Inside the 33-hour failed boardroom coup to overthrow WordPress founder Matt Mullenweg (fortune.com) – Fortune reports that on September 9, Automattic’s six-member board voted to put Matt Mullenweg on paid leave and named CFO Mark Davies interim CEO. About 33 hours later, Mullenweg was back in control, directors Toni Schneider and Sue Decker had resigned, Ann Dunwoody was removed, and Davies and chief legal officer Andy Missan were fired. The piece ties the vote to months of division over the WP Engine lawsuit, including evidence problems in court filings.

→ Shopify vs WooCommerce market share: Who’s really winning? (barn2.com) – Katie Keith uses HTTP Archive data to show the winner depends on which sites you count. Shopify leads the biggest 100,000 sites 4.7 to 1, while WooCommerce leads across all crawled sites, 6.39% to 5.06% in August 2026, down from 6.94% a year earlier. She projects Shopify passing it around the end of 2027 if the recent trend holds.

→ Pushing Standards (ma.tt) – Matt Mullenweg says WordPress 7.1’s client-side media processing relies on Chrome’s Document Isolation Policy, which worked only in Chromium-based browsers at launch. Mozilla has since expressed support and WebKit withdrew its initial concerns, with WordPress contributor Adam Silverstein driving the standards work.

→ Automattic’s New Lawyers Lose Bid for More Time in Legal Fight With WP Engine (therepository.email) – Judge Araceli Martínez-Olguín denied Automattic’s request for two more months, so expert witness questioning must finish by November 17 and the first major arguments are due three days later. Susman Godfrey, which replaced Gibson Dunn, filed the request about two weeks after being hired. The jury trial is still set for October 19, 2027.

---

On Other WordPress News

→ What’s new for developers? (October 2026) (developer.wordpress.org) – Justin Tadlock’s monthly guide covers the WordPress 7.2 roadmap, with Beta 1 on October 20 and the final release on December 8. It also covers the wp_kses() rebuild on the HTML API, the new Ipsum default theme, and an automated security review for plugin releases.

→ What’s new in Gutenberg 24.2? (14 October) (make.wordpress.org) – Notes now float in a margin beside the content, the Navigation block’s link search covers every content type at once, and the Gallery block gets sorting and duotone. React 19 is also on by default unless an incompatible theme or plugin is detected.

→ Call for Code Review Help: Repairing Gutenberg GitHub Actions Workflows for wp/x.y Branches (make.wordpress.org) – Jonathan Desrosiers needs reviewers for “Operation Tall Stack,” roughly 500 pull requests across 20+ branches that restore broken CI on older Gutenberg release branches so security patches can be validated. He built the stacks with AI, and drafts stay unverified until a human reviews them. Reviewers claim a fix on GitHub issue GB-84853.

→ Call for feedback: the W and the site name in the Toolbar (make.wordpress.org) – A proposal would make the W always link to the Dashboard and the site name always link to the site, with the same menu in the admin, on the front end, and in the Post and Site editors. Feedback was requested by October 16, ahead of 7.2 Beta 1 on October 20.

→ Real-time Collaboration: A Guide to Sync Engines (make.wordpress.org) – Compares three sync engines being tested for server-side real-time collaboration: yjs-server, DE-RTC, and intent-log, all in the experimental gutenberg-sync-engines plugin. Each handles merge conflicts differently, and testers need WordPress 7.0+ and the Presence API plugin.

→ WordCamp Jinja 2026 Recap: Three Tracks, Two Days and Creative Currents on the Nile (central.wordcamp.org) – The fifth WordCamp Jinja ran September 19 and 20 in Uganda with more than 300 participants, nearly half of them students. It included a Charity Website Hackathon, hands-on labs, and an after-party on a double-decker boat on Lake Victoria that ended at the source of the Nile.

→ Our First WordPress Campus Connect Hackathon: What Worked, What Didn’t, and What’s Next? (make.wordpress.org) – Muhibul Haque reports on a hackathon at Stamford University Bangladesh that produced 40 websites and 82 WordPress profiles, though about half of registered students did not take part. He suggests a workshop, then a small challenge, then a hackathon, and asks the community for feedback.

→ WooCommerce 11.2.1: Release notes (developer.woocommerce.com) – A dot release that fixes two checkout regressions from 11.2.0: classic checkout on stores that remove address fields, and postcode validation on the checkout block for Argentina and a few other countries. It has no security or database update.

→ AI Literacy through WordPress (learn.wordpress.org) – A Learn WordPress course of about 10 hours for university students and early-career professionals, with no prerequisites. Four modules cover professional identity, using AI tools ethically, building a WordPress portfolio site, and career skills.

→ Meet Purple: A free low-code block theme for WooCommerce stores (woocommerce.com) – Purple is a free block theme with ready-made templates for the homepage, catalog, product pages, search, cart, checkout, and order confirmation, plus patterns you can edit in the Site Editor. It is available from the WooCommerce Marketplace, and the post links a demo store.

---

From WordPress Community

→ Rae Morey, Publisher & Editor-in-Chief of The Repository on Independent WordPress Journalism | E167 (youtube.com) – In WP Legends episode 167, Rae Morey traces her path from hand-laying out a 20-cent community newsletter at 14 in rural Tasmania to running The Repository full time after WordCamp Asia 2024. She also explains why she built it around up to 10 sponsors at once and why WordPress needs more serious journalism.

→ Eleonora Anzini on Music, Art, WordPress, and a Creative Life Beyond Design (seriouslybud.substack.com) – Bud Kraus talks with Eleonora Anzini, a longtime brand designer and WordCamp Europe contributor, about piano, playing bass in rock bands, photography exhibitions, and hand cross-stitched QR codes. They also cover her years in Berlin and her view that art should communicate emotion over technical perfection.

→ Thank you Elementor, but I’m moving on (youtube.com) – Rino de Boer says that after seven years of using Elementor almost every day, he is moving on, and points viewers to his new brand, Living With Prompts. The video runs 24 minutes.

→ WordPress Day for AI Faro 2026 | Faro, 24 de outubro (events.wordpress.org) – WordPress Day for AI runs October 24 at AP Eva Senses in Faro, Portugal, with two tracks, AI for Development and AI for Business, 16 speakers, and 100 seats. Talks are in Portuguese and English.

→ Agenda | CMS Conf 2026 (cmsconf.com) – CMS Conf 2026 runs November 12 to 14 in Gdynia, Poland, with workshops, a developer track, a creator track, and a Polish track. Sessions include Matt Kane on building the EmDash CMS, Robert Abela on WordPress security, Milana Cap on accessibility with the HTML API, and Tammie Lister on “The CMS Humans Need.”

→ WordPress Community Mourns Eric Binnion, Longtime Automattic Engineer and Core Contributor (therepository.email) – Eric Binnion, a longtime Automattic engineering leader and WordPress core contributor, has died months after writing publicly about his illness. Matt Mullenweg added an X-Remembering header to Automattic’s servers for 30 days in his honor. Binnion spent 12 years at Automattic across Jetpack, WordPress.com, and Woo, and is credited on seven core releases.

→ Who I Want on Stage to Show What Works in Marketing Today (checkoutsummit.com) – Rodolfo Melogli lists the people he wants to hear from at Checkout Summit 2027, April 28 to May 1 in Palermo, including Beau Lebens and Tamara Niesen of Woo, Bryce Adams of Metorik, and Syed Balkhi of Awesome Motive. The call for speakers is open, and selected speakers receive up to €1,000.

→ WP Accessibility Day 2026 Draws 2,210 Registered Attendees From 77 Countries (wp-content.co) – The sixth WP Accessibility Day ran October 7 and 8 as a 24-hour virtual conference with 24 sessions and a keynote from GitHub’s Ed Summers on generative AI and people with disabilities. Organizer Amber Hinds said earlier that sponsorships were hard to get this year and the event was running at a loss.

→ Greyd Conversations #19 – How Can Product Companies Grow in WordPress Right Now (youtu.be) – Greyd COO Sandra talks with Katie Keith of Barn2, Aurelio Volle of WP Umbrella, and Matt Cromwell of Roots & Fruit about growing a WordPress product company. Topics include Elementor’s 30% layoff, falling new sales, raising prices, defining an ICP, sharing numbers publicly, and diversifying beyond WordPress.

→ One Year at Automattic: The Ups, the Downs, and What’s Next for Jetpack (devin.org) – Devin Walker marks one year leading Jetpack at Automattic. He found Jetpack work spread across about a dozen teams, unified the admin interface, and launched a rebuilt jetpack.com in August. He says a late-July reorg added too much structure too fast, reports Jetpack AI up about 12x this year, and lists modular features, smarter onboarding, and clearer pricing as year-two goals.

---

Until Next Week

A six-year-old ticket to make WordPress admin notices accessible was reverted about 19 hours after Matt Mullenweg asked for it. Who should have the final say on accessibility changes in core? What would a clear process look like to you?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

---

Mary Hubbard asks 30+ companies to fund WordPress security, plus the MCP Adapter is out, September plugin data in, how a patch ships and WordCamp Asia 2027.

---

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 60, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 29 WordPressers who joined us in the last 7 days! We are now 1100! Hip Hip Hurray!!!

This week brings a funding request from WordPress’s Executive Director to more than 30 companies, and a new plugin that lets AI agents connect to your site. We also cover how a security fix gets from report to release, September’s plugin download numbers, and why WordCamp is worth a visit.

In this Issue:

• What WordCamp Is and Why You Should Go
• The MCP Adapter Plugin Arrives on WordPress.org
• September Plugin Download Numbers
• How a WordPress Security Release Happens
• The Call to Fund WordPress Security

---

What a WordCamp Is and Why You Should Go

A WordCamp is a community-organized event for people who use, build, design, write for, and contribute to WordPress. Local communities run them, and they range from small gatherings to larger regional events. You don’t need to be a WordPress expert or a contributor to attend. Site owners, bloggers, freelancers, agency staff, students, and beginners are all welcome.

Expect talks on topics like accessibility, performance, security, design, and online business, plus workshops and networking between sessions and over lunch. Some events also run a Contributor Day, where newcomers can help with code, documentation, translation, testing, or support.

WordCamp Asia 2027 runs April 9 to 11 in Penang, Malaysia, and ticket availability is limited.

Read the full blog on WordCamp Asia →

Next, a new plugin from the WordPress AI team.

---

The MCP Adapter Plugin Is Now on WordPress.org

The WordPress AI team has released MCP Adapter 0.7.0, the first version of the plugin on the WordPress.org Plugin Directory. It gives your site a way to expose functionality to AI agents through the Model Context Protocol (MCP). The plugin ships a default MCP server and bridges the Abilities API, introduced in WordPress 6.9, so publicly exposed abilities can be discovered and run through it. Developers can also build custom MCP servers.

Version 0.7.0 adds support for the new stateless 2026-07-28 MCP spec. If you installed an earlier version from GitHub or Composer, check the 0.7.0 migration guide first.

The plugin is still experimental, and the team is working toward a stable 1.0 release. It provides server infrastructure only, with no MCP client or user-facing interface.

Read the full blog on Make WordPress AI →

Plugin downloads had a few big swings in September.

---

---

Plugin Downloads Held Flat in September While a Few Plugins Swung Hard

Rivale’s latest plugin market report tracks the top 12,500 WordPress plugins, and September was nearly flat. Downloads totaled 226.7 million over 30 days, against 232.0 million over 31 days in August, a 1.0% rise per day. Two plugins in three had more daily downloads than in August.

The movement came from a few plugins. Elementor rose 54% per day, from 11.3 million to 16.9 million, and Yoast SEO gained 29%. Akismet fell 81%, from 8.8 million to 1.6 million, and Contact Form 7 fell 66%.

The 110 plugins tagged AI had a median daily download gain of 28.4%, against 8.5% across all of the top 12,500. Of the 4,575 plugins with no release since September 2025, 3,928 still gained daily downloads.

Read the full blog on Rivale →

Next, how a WordPress security fix gets from a researcher’s report to your site.

---

How a WordPress Security Release Goes From Report to Patch

Human Made walks through what happens after a researcher reports a vulnerability. Reports arrive privately through WordPress’s HackerOne program or directly to the Security Team. The team verifies the issue, assesses severity in a private workspace, writes a fix, and tests it.

For serious issues, major hosts, CDNs, and web application firewall vendors get advance notice so protections can go in before the public release. Critical issues get an immediate standalone release, while minor ones wait for the next scheduled release. An advisory then goes up on WordPress.org News, and severe issues may get a CVE.

Keep automatic updates on for minor and security releases unless you have a reason to turn them off. They can protect many sites within hours of a fix shipping, and you get a confirmation email when an update finishes. If they’re off, apply security updates when your dashboard prompts you.

Read the full blog on Human Made →

That process takes time and money, and WordPress’s Executive Director now wants more companies to chip in.

---

Mary Hubbard Asks Hosts and Plugin Companies to Fund WordPress Security

WordPress Executive Director Mary Hubbard has emailed more than 30 of the biggest companies in WordPress, including GoDaddy, Newfold Digital, and Hostinger, and asked them to help fund the project’s security program. She wrote that the program received nearly 2,000 reports in 90 days. WordPress’s HackerOne page shows 2,004 reports and more than $90,000 in bounties paid in that window, out of just over $200,000 since 2017. Hubbard wrote that Automattic has funded 100% of it.

She suggested a shared bounty pool or sponsored help with triage and release work. “One company can’t carry this alone,” she wrote. Kinsta and Awesome Motive asked for a clearly defined program, and Hostinger said it is exploring dedicating its own people. Patchstack’s CEO said proven contributors should be able to take part in security decisions.

Read the full blog on The Repository →

---

WordPress Must Read

→ Automattic interim CFO resigns just weeks after boardroom shakeup (techcrunch.com) – Jeremy Klaperman left his interim CFO role at Automattic less than a month after taking it, following a demotion back to his old post running the VIP Enterprise unit amid reported friction with CEO Matt Mullenweg. Automattic is still searching for a permanent CFO.

→ Automattic Wants .wordpress. It Doesn’t Own WordPress. (medium.com) – Kellie Peterson argues that Automattic’s ICANN application for a closed .wordpress domain depends on presenting WordPress as a brand, even though the nonprofit WordPress Foundation holds the trademark. She urges the public to comment before the window closes on March 16, 2027.

→ Judge Says He’s Leaning Toward Denying WP Engine’s Bid to Sanction Automattic Over Disappearing Messages (therepository.email) – At a Wednesday hearing, Magistrate Judge Ajay Krishnan said he tentatively favors denying WP Engine’s motion to sanction Automattic and Matt Mullenweg over messages WP Engine says were destroyed. He acknowledged that Mullenweg’s September 2024 X post was problematic but said he wasn’t seeing enough to find spoliation. The jury trial is set for October 19, 2027.

---

On Other WordPress News

→ What’s new in AI 1.4.0 (5 OCTOBER 2026)? (make.wordpress.org) – AI 1.4.0 adds a Markdown Feeds experiment that serves site content in Markdown for AI systems and other tools, plus a 0-to-1 score that rates how substantive each comment is during moderation. It also expands embedding and vector storage and raises the minimum WordPress version to 7.0.3.

→ Making space for the next generation of WordPress builders (make.wordpress.org) – Isotta Peira proposes a repeatable 2027 framework that brings WordPress Credits students into flagship events, starting with WordCamp Asia 2027, after Kraków students presented their sites at WordCamp Europe 2026. It calls for one to three reserved slots per event, and feedback is requested by October 30.

→ Spacefast for WordPress (github.com) – A WordPress plugin that publishes your site to Spacefast, either as a static export from the free Simply Static plugin or as a headless CMS that feeds an Astro or other project. In headless mode, public content changes trigger a rebuild of the connected project.

→ WordPress 7.2 Release Party Schedule (make.wordpress.org) – Beta parties run on October 20, October 27, November 3, and November 10, followed by release candidates on November 17, November 24, and December 1. A dry run is set for December 7 and the final release for December 8, all at 15:00 UTC.

→ WordPress MCP Adapter Now Available as a Canonical Plugin on WordPress.org (therepository.email) – The MCP Adapter passed 40,000 active installs less than a week after launch, and it lets assistants like Claude and ChatGPT use the abilities a site exposes. It is not going into core for now, with GoDaddy’s Nik McLaughlin saying MCP’s volatility makes it a poor fit for the core package at this time.

→ WordPress 7.1.3 Patches Seven Vulnerabilities as Bug Bounty Payouts Top $90,000 in 90 Days (therepository.email) – WordPress 7.1.3 fixes seven security vulnerabilities and four bugs, with Anthropic credited for three of the security reports. Patchstack’s Chazz Wolcott says only two of the flaws can be triggered by unauthenticated visitors and says it isn’t a drop-everything emergency.

→ Automattic Applies for Closed .wordpress Domain in ICANN’s First Application Round Since 2012 (therepository.email) – Automattic’s registry subsidiary, Knock Knock WHOIS There, applied for .wordpress as a closed, single-registrant namespace that would bar unaffiliated third parties from registering domains. The application seeks a Code of Conduct exemption instead of brand TLD status and does not mention the WordPress Foundation, which owns the WordPress trademarks.

---

From WordPress Community

→ Be the Voice of WordCamp Asia 2027 – Apply as an Emcee (asia.wordcamp.org) – WordCamp Asia 2027 is taking emcee applications for the April 9 to 11 event in Penang. The call asks for people who enjoy engaging crowds, communicate well, and can keep energy up through the day. Applications are due November 27.

→ Charleen Mullenweg (seriouslybud.com) – Host Bud Kraus talks with professional genealogist Charleen Mullenweg on Seriously, BUD? about her genealogy work, including volunteer forensic genetic genealogy projects and documenting eligibility for lineage societies. The conversation also covers her views on AI and her long involvement in the WordPress community.

→ liberate.sh: take your website anywhere (liberate.sh) – An open-source tool from the makers of WordPress Studio that converts a Wix, Squarespace, Shopify, or Webflow site into a WordPress site you own. You download the packaged site, with its pages, images, and design, and host it anywhere you choose.

→ Checkout Summit 2027 | 28 Apr-1 May | WooCommerce Conference (checkoutsummit.com) – An independent in-person event for WooCommerce founders, developers, agencies, and merchants, held in Palermo, Sicily. It has 12 single-track talks, roundtables, and about 150 attendees.

→ Behind the scenes of PressConf: the business-focused WordPress event coming to Europe (wpbuilds.com) – Raquel Manriquez, Jaume Freixa, and Carol Stambaugh discuss PressConf, a small business-focused event that revives the spirit of PressNomics and debuts in Barcelona from October 27 to 30, 2026. It runs single-track sessions with no sponsor sales pitches at one hotel venue.

→ Agenda – CloudFest Americas (cloudfest.com) – CloudFest Americas runs November 11 and 12, 2026 at ICE Palace Studios in Miami, with an agenda covering cloud, hosting, AI, security, and internet infrastructure. The detailed session schedule is members-only.

→ WordPress.com Education: How Two Design Students Built a Nonprofit’s Website (wordpress.com) – UX design master’s students Constanza Diaz and Axcel Paucar Garcia built a live site for Odón Solar, a Spanish clean-energy nonprofit, during an internship. They spent 125 hours on research, design, and client work, and built the site with Studio Code, WordPress Studio’s AI agent.

→ ACF Is Getting an AI Upgrade, But It’s Not What You Think (thewpminute.com) – ACF 6.8 lays groundwork for AI through support for the Abilities API, MCP, AI agents, and JSON-LD structured data. The team plans focused tasks, such as suggesting likely fields when you create a field group, and says its AI features will be opt-in.

→ We Moved Five WordPress Sites to EmDash the Week 1.0 Shipped (vapvarun.com) – The author’s team moved five WordPress content sites to Cloudflare’s free, MIT-licensed EmDash CMS between September 24 and 28, then upgraded to 1.0.1 on September 29. Enabling D1 read replication fixed slow uncached pages and brought one home page from 10 to 13 seconds down to under one second.

→ WordCamp Kathmandu 2026 Experience (wpmore.net) – My recap of WordCamp Kathmandu 2026 on September 18 and 19, where I joined my first official Contributor Day at the Core table and gave a marketer’s view on a few Trac tickets, including the Site Icon helper text. I also sat in on sessions about WordPress education programs, using AI for augmentation, and building a free classroom platform with WordPress.

→ My WordCamp Sylhet 2026 Experience (wpmore.net) – My recap of WordCamp Sylhet 2026 on October 2 and 3, the event’s third edition, with nearly 400 attendees. It covers the organizers’ no-swag policy, the marketing table at Contributor Day, and sessions on measuring results when search stops sending traffic and on AI and plugin security.

---

Until Next Week

WordPress security reports ran 20 to 30 a month for a decade, then hit 773 in August, and Hubbard says Automattic has paid for all of it so far. Should hosts and plugin companies split the cost? What would a fair split look like to you?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

With 7 security fixes landed, update your WordPress right now. Checkout Summit numbers, plugin pricing, AI dev jobs, and Automattic’s new board.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 59, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 47 WordPressers who joined us in the last 7 days! We are now 1071! Hip Hip Hurray!!!

WordPress 7.1.3 fixes seven security issues, so update your sites before anything else. After that, a first-time conference organizer shares his real numbers, a plugin developer explains why the old pricing playbook is failing, and Remkus de Vries asks developers to rethink their job description. We finish with the people Matt Mullenweg picked for Automattic’s new board.

---

In this Issue:

• WordPress 7.1.3 Patches Seven Security Flaws
• Checkout Summit Drew 101 People and Plans a 2027 Return
• Plugin Pricing Can’t Work Like a Car Lot Anymore
• Remkus de Vries Tells WordPress Developers to Learn Agents
• Automattic’s New Board Leans on Mullenweg’s Longtime Ties
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WordPress 7.1.3 Patches Seven Security Flaws

WordPress 7.1.3 landed on October 6 with 7 security fixes and 4 bug fixes, and Jake Spurlock led the release. Because it is a security release, WordPress recommends updating your sites right away.

The fixes cover a stored XSS on the Comments admin page, a second-order SQL injection in WXR export, unauthenticated disclosure of comments on private and unpublished posts, and XSS in Imgur embeds. Anthropic reported three of the seven. The rest came from Trail of Bits, Patchstack, three researchers who found the Imgur issue, and a member of the WordPress security team.

Update from the Dashboard under Updates, or download 7.1.3 from WordPress.org. Sites with automatic background updates will start on their own. The fixes are also being backported to every branch that gets security fixes, currently back to 4.7, though only the latest version is actively supported.

Read the full blog on WordPress.org →

Next, a first-time conference organizer opens his books.

---

Checkout Summit Drew 101 People and Plans a 2027 Return

Rodolfo Melogli wanted WooCommerce developers to have a conference of their own, and in April 2026 101 people showed up in Sicily, with another 107 joining online a couple of weeks later for Reloaded. His goal for the in-person event was 150.

He points to two problems. Flights were disrupted by conflicts in the Middle East, and agencies and WordPress companies cut budgets and stopped sending people to events. Sponsors were slow too. WooCommerce took the headline spot and two companies took booths, but many other promises never turned into payments. A group of Founding Contributors filled the gap, and the event turned a small profit.

His fix list includes starting sponsor talks earlier, not organizing alone, and adding workshops and more networking. Tickets for the April 2027 edition in Palermo are on sale now.

Read the full blog on Checkout Summit →

The next story asks why plugin buyers have stopped haggling.

---

---

Plugin Pricing Can’t Work Like a Car Lot Anymore

Russell Aaron says plugin pricing used to work like a car lot. Buyers installed the free version, came back months later for Pro, and waited for a sale. Buyers now give you about ten minutes after activation, and if the plugin fails on first install, they ask for a refund and never return.

AI changes the math too. People paste a sales page into Claude or ChatGPT and ask whether they can build it themselves. A reading-time counter that costs $49 a year can become a snippet in ten minutes. A plugin listed at $500 that drops to $199 every Black Friday teaches buyers to learn the calendar and wait.

His advice is to sell what people need, make it work on first install, build what an AI chat cannot copy, and price it as you would want to pay for it.

Read the full blog on Russell Envy →

Pricing is one place AI is changing the work, and Remkus de Vries thinks developers should change with it.

---

Remkus de Vries Tells WordPress Developers to Learn Agents

Remkus de Vries has worked in WordPress for more than 20 years, and he says your experience has not expired, but your job description has to change. WordPress already has the Abilities API and an incoming MCP Adapter, and plugins like Albert and Novamira connect AI assistants to live sites.

Many developers read each AI announcement, save it for later, and keep building the same way. He points to David Heinemeier Hansson, who described 37signals going “pencils down” on handwritten code at Rails World 2026.

He suggests giving an agent a complete task in a project where you can experiment, defining the behavior, supplying context, and reviewing the result until you understand it. If your work week has no room for this, invest a bounded amount of time outside it. He also wants developers to use agents on problems they could never justify before.

Read the full blog on Remkus de Vries →

Finally, Automattic’s board changed again, and the new names have a lot in common.

---

Automattic’s New Board Leans on Mullenweg’s Longtime Ties

Automattic’s new board is made up largely of people with long-standing personal ties to CEO Matt Mullenweg. The directors are author Hugh Howey, relationship expert Amy Chan, and Henry Khachatryan and Krutal Desai, co-founders of the defunct social app IRL. Desai is the only one who worked at Automattic, as Head of Special Projects from January 2012 to September 2020.

Jaime Waydo, Matt Van Horn, and Stephen Wolfram serve as advisors, and Hiten Shah takes on an expanded role. IRL shut down in June 2023 after its board found that 95% of users were automated or bots, and the SEC later charged founder Abraham Shafi with fraud. Neither Khachatryan nor Desai has been accused of wrongdoing.

An Automattic spokesperson did not say whether the board is complete or what happens to two former executives’ severance agreements. The board page still lists three old directors.

Read the full report on The Repository →

---

WordPress Must Read

→ ChatGPT ads don’t work yet. Here’s the proof (barn2.com) – Katie Keith shares what Barn2 got from $477 in ChatGPT ads over six weeks: 370 clicks, zero conversions, and no revenue. The ads ran 19,154 impressions, far more than the 1,370 US searches for related terms, and ad visitors stayed 37 seconds compared with 443 for people who followed links in ChatGPT answers.

→ For Love or Money: Open Source’s Labor Law Problem (sereed.media) – Sé Reed asks whether open source contributors still count as volunteers when their work is scheduled, directed, and benefits a single for-profit company. She walks through how the Fair Labor Standards Act treats volunteering and says she is not a lawyer or making claims about any entity.

→ Bringing WordPress AI to the Market (briancoords.com) – Brian Coords argues WordPress needs a Core Abilities feature plugin, a more discoverable MCP, and AI landing pages on WordPress.org. He treats it as a go-to-market question and favors outside-in agent access over more AI features in the dashboard.

→ WordPress plugins: should a PRO add-on auto-install its free version? (blog.wonderm00n.com) – Marco Almeida found a core bug where the upload screen offers an Activate button for a PRO add-on, then WordPress blocks it with an error page when the free plugin is missing. He weighs auto-installing the free plugin but keeps the Requires Plugins header for now, citing zero support tickets.

→ WP Engine v. Automattic, Two Years On: Where the WordPress Drama Stands (therepository.email) – Rae Morey recaps the case since the September 2024 keynote and the 8% royalty demand, about $32 million a year on WP Engine’s roughly $400 million in revenue. It covers the revived antitrust claims, the sanctions fight over Mullenweg’s messages, and a jury trial still set for October 19, 2027.

→ Meet the Female Lead WordCamp Organizers Shaping 2027 WordCamps (mumtahinafaguni.com) – Faguni introduces the women leading five 2027 WordCamps in Asia: Nepal in Nepalgunj, Kolkata, Mumbai, Pune, and Kathmandu. Pune is scheduled for February 6 to 7 and Mumbai for February 13.

→ Spacefast: Automattic’s New Static Hosting (Cloudflare/Vercel Alternative?) (youtube.com)

---

On Other WordPress News

→ Presence API: What’s new (make.wordpress.org) – The Presence API feature plugin is at version 0.14.0 and now shows who is online across a whole multisite network. Post locks moved into the presence table, and AI agents editing over REST or MCP appear with an Agent badge.

→ Heads up: HelpScout to FreeScout Migration (make.wordpress.org) – WordPress.org is moving about 20 mailboxes and 86 accounts from HelpScout to a self-hosted FreeScout after HelpScout shifted from contact-based to user-based pricing. Photos and Jobs go first, and Plugins is last, with phase five planned for October 19.

→ Month in Test: October 05, 2026 (make.wordpress.org) – The Test Team’s roundup lists 19 tickets with patches that need testers and 128 that need bug reproduction. It also says the Test Handbook is now synced with GitHub.

→ Training Team Update – October 4th, 2026 (make.wordpress.org) – Learn WordPress DACH finished its first German-language course cohort, “Starten mit WordPress,” across seven weeks and seven live sessions. A new course on AI literacy through WordPress is also live.

→ Proposal: Minor updates to the WordPress Core CSS Coding Standards (make.wordpress.org) – Andrea Fercia proposes small changes needed to bring Stylelint into Core, including one blank line between sections and blocks and avoiding the order property and reverse values for accessibility. Comments stay open for one week.

→ Accessibility-ready directory changes coming! (make.wordpress.org) – The accessibility-ready tag in the theme directory is becoming conditional. No themes will be delisted, adding the tag will not delay approval, and themes that miss the guidelines can have the tag removed.

→ What’s new in Gutenberg 24.1? (30 September) (make.wordpress.org) – The release focuses on design tool consistency, with about 140 PRs adding background, shadow, color, and typography controls to core blocks. It also adds a text shadow panel in Global Styles and media selection in the Cover and Media & Text blocks.

→ Test Scrub Schedule for WordPress 7.2 (make.wordpress.org) – With 7.2 targeted for December 8, 2026, Test Scrubs on 7.2 milestone tickets will run on the 2nd and 4th Thursday of each month at 3:00 PM UTC, in place of patch testing sessions.

→ Themes team update September 29, 2026 (make.wordpress.org) – The Themes team had 98 new tickets waiting for review and closed 609 tickets in a week, with 56 new themes and 517 updates going live. Twelve reviewers handled the queue.

→ Documentation Team Update – October 5, 2026 (make.wordpress.org) – The Documentation team has 479 open issues and 1,822 closed ones, and it closed 87 issues in the past month. It also introduced a new meeting schedule that mixes Slack chats and video calls.

→ Plugins Team: 5 Oct 2026 (make.wordpress.org) – The plugin review queue holds 4,611 plugins. The team approved 915 plugins, rejected 300, and closed 150 while 1,119 were requested.

→ Who is “anyone” who can organize meetup? (make.wordpress.org) – Mayo Moriyama of Tokyo WordPress Meetup points out that three handbook pages seem to contradict each other on who can organize a Meetup. The Community Team’s answer is that any member can run an event but should coordinate with the co-organizers, who confirm the organizer is trustworthy.

→ Increased security on Hosting team repositories (make.wordpress.org) – After spammy pull requests and premature merges, Hosting team repositories now require two approvals, resolved change requests, re-review of new pushes, and passing tests. New GitHub accounts also wait 24 hours before they can interact.

→ Automattic has a new board after failed attempt to put CEO on leave (techcrunch.com) – Sarah Perez reports that the new board includes Hugh Howey, Amy Chan, and IRL co-founders Henry Khachatryan and Krutal Desai. Mullenweg confirmed the appointments and said the next six months will shape the next 20 years of Automattic.

→ Test WordPress emails in Playground with the new Email tool (make.wordpress.org) – Playground’s new Dev Tools → Email panel captures messages sent through wp_mail() so you can inspect the recipient, subject, and body without a mail server. Captured emails clear on reload, and the tool does not prove delivery.

→ Update on the WordPress community groups on events.wordpress.org (make.wordpress.org) – About 700 meetup groups are moving off Meetup.com to events.wordpress.org, built on GatherPress. A migration tool will import upcoming events as drafts but not member lists, so members will need WordPress.org accounts to join.

→ Call for feedback: Real-time Collaboration (RTC) server-aware approach (make.wordpress.org) – Hosts are asked to test three server-aware sync engine candidates, Yjs-server, Distributed Editing, and Intent log, with a focus on performance. RTC was removed from WordPress 7.0, and host feedback will shape its direction.

→ WP A11y docs update September 2026 (make.wordpress.org) – The update adds docs on tables, color contrast for text and non-text content, and infinite scroll. The Accessibility Team Handbook is also moving to GitHub so more people can contribute.

→ The Experimental WooCommerce Dual API is now a plugin (developer.woocommerce.com) – WooCommerce 11.2 removes the experimental Dual API engine from core and offers it as a separate plugin that requires WooCommerce 11.2 and PHP 8.1. The proof-of-concept products and coupons API is removed, and the feature stays experimental.

→ WordPress 7.2 Roadmap Includes New Security Features, Suggestion Mode for Notes, and Ipsum Default Theme (therepository.email) – Notes gets suggestion mode and emoji reactions, and the security work includes a Secrets API, early sudo mode work, and hardened Application Passwords. Real-time collaboration is deliberately left off, and Beta 1 is expected between October 20 and 22.

---

From WordPress Community

→ Quill: Native WordPress App for macOS (quill.siolon.com) – Quill is a free native Mac app by Chris Poteet for writing and publishing to a self-hosted WordPress site. It supports offline local drafts and a media library, plus an optional Claude-powered writing assistant that needs your own Anthropic API key.

→ Alright Our Kid? – WordCamp Manchester 2026 (manchester.wordcamp.org) – WordCamp Manchester returns for the first time since 2018, on November 6, 2026, at Whitworth Locke. It is a barcamp-style day with no traditional talks or sponsors and a surprise keynote in the morning.

→ 1 billion downloads: The people and stories behind Yoast SEO (yoast.com) – Yoast marks one billion downloads with user stories, including a Montreal agency that has installed Yoast by default for clients for more than a decade. The post also says AI tools surfaced the same themes users named: easier SEO, helpful guidance, and handling technical work.

→ Jill Binder Launches Tech Differently, a Speaker Accelerator and Conference for People Who Build Differently (therepository.email) – Tech Differently is an online conference on October 27 where speakers from a six-month accelerator present their talks. Regular tickets cost $19, rising to $27 from October 15, and a $5 community tier stays available.

→ How do we get Agents to use WordPress (youtube.com)

→ I’m turning our most popular plugin into a chat plugin (ciorici.com) – Pavel Ciorici says Social Icons Widget fell from about 135,000 installs in June 2025 to just under 100,000, and its Pro version made about $8,900 from 223 sales in four years. He is turning it into WPZOOM Connect, a chat plugin that leads to his Yamidoo AI chat service.

→ Call for WordCamp Asia 2027 Wapuu Submissions Now Open! (asia.wordcamp.org) – WordCamp Asia 2027 runs April 9 to 11 in Penang, Malaysia, and the Wapuu design call is open until December 8, 2026, at 23:59 (UTC+8). Professional illustrators and first-time designers can both submit.

→ Aditya Shah receives the Yoast Care fund for his contributions to the WordPress community. (yoast.com) – Aditya Shah leads the WordPress Bhopal community, now in its 11th year, and was nominated by Kripesh Adwani. He works at WPMU DEV as a Hosting Support Manager and DevOps Engineer.

→ Black Friday Has Changed. Has Your WooCommerce Strategy? (youtube.com)

→ Hidden Multipliers: The New Book for Every WordPress Business Owner (publishpress.com) – On the PublishPress Podcast, Jason Cohen, who built WP Engine, talks with Steve Burge about his new book on pricing, customer research, and profitability. He explains his pricing framework of more for more, less for less, and more for less, plus the “profit whale” idea.

---

Until Next Week

Three of the seven security fixes in WordPress 7.1.3 came from reports by Anthropic. Have you updated your sites yet? And how do you feel about AI labs reporting bugs in WordPress core?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Update to WordPress 7.1.2 now. Plus the WordPress 7.2 roadmap, AI agents and WordPress, a plugin developer trust checklist, and the WP Engine antitrust ruling.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 58, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 45 WordPressers who joined us in the last 7 days! We are now 1024! Hip Hip Hurray!!!

A critical security fix shipped, the WordPress 7.2 roadmap is out, and a federal judge put WP Engine’s antitrust claims against Automattic back on the table. We also look at how WordPress could welcome AI agents and what plugin developers can do to earn a cautious buyer’s trust.

---

In this Issue:

• WordPress 7.1.2 Patches a Critical Security Vulnerability
• The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List
• Should WordPress Open the Door for AI Agents?
• A Trust Checklist for WordPress Plugin Developers
• WP Engine’s Antitrust Claims Against Automattic Are Back On
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WordPress 7.1.2 Patches a Critical Security Vulnerability

WordPress 7.1.2 is a security-only release, and it fixes one critical vulnerability. John Blackbourn led the release, which shipped on September 22.

The bug lets an unauthenticated attacker, under certain conditions, make page template resolution include a chosen readable local PHP file from outside the active theme directories. If the server environment and the active theme meet the right pre-conditions, that can lead to remote code execution. Robert Ressl reported it responsibly, and the advisory is tracked as CVE-2026-87902.

WordPress recommends updating your sites immediately, either from the Dashboard under Updates or by downloading 7.1.2 from WordPress.org. Sites with automatic background updates will start the process on their own. The fix was also backported to every branch eligible for security fixes, currently back to 4.7. Only the latest WordPress version is actively supported, so an older site is worth a look this week.

Read the full blog on WordPress.org →

Once your sites are patched, the next question is where WordPress is heading.

---

The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List

WordPress 7.2 is planned for early December 2026, and the roadmap is out. Notes gets a suggestion mode, so you can leave edits for others to accept or reject, plus emoji reactions.

The security list includes a “sudo mode” that asks you to re-authenticate before sensitive actions, a Secrets API for storing credentials safely, and hardening for Application Passwords. Sudo mode is still at the early-work stage.

For site builders, you can style form elements in Global Styles, and two blocks are coming: Description List and the Table of Contents block. Admin icons move from dashicons to SVGs, and error messages get clearer wording with a copy button. A new default theme called Ipsum is a minimal blank canvas.

Collaborative editing is not on the 7.2 list. The post also says these items are being actively pursued but may not all make the final release.

Read the full blog on Make WordPress Core →

Beyond the release itself, one writer wants WordPress to prepare for a new kind of visitor.

---

Should WordPress Open the Door for AI Agents?

Nick at Teddy argues that WordPress already has what agents need: structured block content, a REST API, feeds, and metadata. It needs to present them more clearly.

He proposes serving Markdown when a client sends the Accept: text/markdown header, and offering a .md version for clients that don’t. In Checkly’s tests, three of seven agents sent that header: Claude Code, Cursor, and OpenCode. He also suggests a small read-only public menu at a predictable address like /.well-known/wordpress, listing the search route and the site’s stated AI policy.

Reading a public post should never quietly grant permission to change one. He points out that robots.txt is a request to crawlers, not authorization, and that llms.txt belongs last on the list. Ahrefs found that 97% of the files it observed got no requests in the month it measured.

Read the full blog on Teddy →

Trust matters for plugin authors too, and one guide lays out how to earn it.

---

A Trust Checklist for WordPress Plugin Developers

David McCan at WebTNG turns what cautious buyers look for into a checklist for plugin developers. It covers three areas.

In the Plugin Directory, keep the “tested up to” field recent, answer support threads (the negative ones too), reply politely to critical reviews, and keep an honest changelog that mentions security fixes. WordPress.org now lets you update “Tested up to” without releasing a new version.

On your own site, show who you are, be plain about where your company operates, and write real privacy and terms pages. Spell out pricing, renewals, and licensing. He recommends a clear refund window, with 14 or 30 days being typical, and a published vulnerability disclosure policy.

Most items are a few hours of work, and they mean fewer refund requests and fewer one-star reviews. Over time, join the community, show which feedback you acted on, and avoid overpromising.

Read the full blog on WebTNG →

Finally, the WP Engine case just changed direction.

---

WP Engine’s Antitrust Claims Against Automattic Are Back On

A federal judge has reversed course on WP Engine’s antitrust claims against Automattic. In a 17-page order, U.S. District Judge Araceli Martínez-Olguín revived four counts against Automattic and Matt Mullenweg: monopolization, attempted monopolization, and two illegal tying claims. The same judge dismissed them in September 2025.

The turn followed an August 13 Ninth Circuit ruling in an unrelated surgical-robot repair case, which undercut Automattic’s central argument. The court also pointed to allegations that Automattic demanded fees for access that used to be free, and tied WordPress.org login to a checkbox denying any affiliation with WP Engine.

Successful federal antitrust plaintiffs are entitled to triple damages plus attorneys’ fees. WP Engine’s extortion claim was dismissed for good, and its attempt to toss Automattic’s counterclaims mostly failed. Summary judgment motions are due November 20, with a 10-day jury trial set for October 19, 2027.

Read the full report on The Repository →

---

---

WordPress Must Read

→ WordPress Takes Its Turn Leading the Open Website Alliance (wordpress.org) – Mary Hubbard became president of the Open Website Alliance on September 21, 2026, representing the WordPress Foundation. The role rotates among the alliance’s members, which also include the Drupal, Joomla!, and TYPO3 communities.

→ AI Agents for WordPress: What Helps and What Still Fails (abulkhoyer.com) – A Tourfic booking bug fix shows agents do well with clear goals and access to code, WP-CLI, browser tools, and MCP, with 31 regression scripts passing. They still fail when goals are vague, when they edit generated code without updating the source, or when they skip testing plugin combinations.

→ Zero clean: 72 WooCommerce stores (merchlint.com) – Merchlint’s 2026 WooCommerce report, which looked at 72 stores under the headline “Zero clean.”

→ Five ways Claude Code failed on a 240,000-line WordPress plugin (sleevesupai.com) – Five failures from using Claude Code on Easy Digital Downloads, including patching a symptom instead of the root cause, adding 25 lines when 3 were requested, and a test that bypassed the method it covered. The author’s five-question review caught all of them in under four minutes.

---

On Other WordPress News

→ Iterating from live events to livestreamed releases (make.wordpress.org) – WordPress releases move from in-person events to livestreamed Zoom webinars, starting with 7.2 in early December 2026. Release squad members and others involved can share without geographic barriers.

→ WooCommerce 11.1.2 Release Notes (developer.woocommerce.com) – Released September 22, it tightens validation on email-based product reviews and fixes a regression in rendering product variation galleries that could cause infinite recursion when themes call get_available_variations.

→ WordPress Contributor Toolkit 1.2: One app for your first Core or Gutenberg contribution (make.wordpress.org) – A desktop app that removes setup friction for first-time contributors. Version 1.2 adds a full Gutenberg workflow, from creating a site and linking a GitHub issue to applying pull requests and submitting changes without leaving the app.

→ WordPress Trac MCP server (make.wordpress.org) – A free, public MCP server that lets AI assistants like Claude and ChatGPT read tickets, changesets, and timeline history from WordPress.org Trac instances. It needs no authentication or API key.

→ Call for Media Partners for Wordcamp Asia 2027 (asia.wordcamp.org) – WordCamp Asia 2027 runs April 9 to 11 at the Penang Waterfront Convention Centre in Malaysia. Media partners get complimentary passes and media area access, and applications close November 24, 2026.

→ WooCommerce 11.2.0 Pre-release notes (developer.woocommerce.com) – The beta is ready for testing ahead of an October 6, 2026 release. Highlights include configurable withdrawal request emails, more block styling options, a CSV importer that matches products by GTIN, UPC, EAN, or ISBN, and date fields in the Additional Checkout Fields API.

→ Gutenberg’s JavaScript unit and integration tests now use Vitest (make.wordpress.org) – Gutenberg moves from Jest to Vitest for native ESM support and real-browser testing. @wordpress/scripts 36.0.0 makes Vitest the default, and Jest stays available through test-unit-jest with no removal date.

→ New public repo: core release tools (make.wordpress.org) – The public core-release-utils repo holds six CLI tools that automate release chores such as drafting HelpHub pages, generating SVN tag commands, verifying GitHub mirrors, and building contributor lists. Minor releases can touch 20+ branches, so the tools cut manual errors.

→ CVE-2026-87902: A working PoC for WordPress’s critical path traversal (hadrian.io) – A working proof of concept for CVE-2026-87902 uses a double-encoded traversal payload in the pagename parameter to escape the theme directory. It needs a published page and a page-templates directory in the active theme, and it scores 9.2 on CVSS.

→ WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE (patchstack.com) – The flaw affects versions 4.7.0 to 7.1.1 and comes from weak validation of the pagename query parameter. Exploitation needs a theme with a page- prefixed directory and PHP with register_argc_argv enabled, which is common in Docker and cPanel setups.

→ Moving to a server-aware approach for collaboration (make.wordpress.org) – Collaboration moves from browser-only syncing to a model where the server takes part. That lets WordPress record who made each edit, check permissions, and merge updates coming from REST API or CLI tools.

→ Dev Chat Agenda – September 23, 2026 (make.wordpress.org) – The September 23 agenda covers the new Ipsum default theme for 7.2, calls for testing on the DataForm editor inspector, the server-aware collaboration approach, and the recently completed 7.1.1 and 7.1.2 releases.

→ Luganda Translation Workshop at WordCamp Jinja 2026 (make.wordpress.org) – Eleven contributors, two of them newcomers, translated 156 strings and reviewed 43 while learning GlotPress tools. Moses Cursor was table lead for the Luganda Translation Team.

---

From WordPress Community

→ The Page Builder Summit will be back in November 2026 (pagebuildersummit.com) – Page Builder Summit 8.0 runs November 2 to 6, 2026, for designers, developers, and agency owners working across WordPress, Shopify, Squarespace, and AI platforms. Registration opens soon through a waiting list.

→ Auctioning off my WordPress release albums (nomad.blog) – Anne McCarthy is auctioning the framed WordPress release albums she received as a sponsored contributor since 2020. Bidding starts at $500 at release-auction.blog, and proceeds go to Stimpunks, which supports neurodivergent and disabled people.

→ PressConf EU: WordPress Needs to Stop Playing Defense (thewpminute.com) – Organizer Raquel explains why PressConf is coming to Barcelona for the first time, October 27 to 30. She says WordPress businesses face growing uncertainty and need deliberate choices, and the sessions will be unrecorded to keep talks candid.

→ WordCamp Kathmandu 2026 Recap: What We Saw, Learned & Loved (sitesaga.com) – The event drew over 350 attendees on Conference Day and 220+ on Contributor Day, with 17 speakers. The Photos team added 200+ images to the repository, and the Polyglots team recruited 360+ Nepali translators.

→ Meet Wapuu Sa: All Dressed Up for WordCamp Rajasthan (rajasthan.wordcamp.org) – The event mascot wears a colorful pagdi and traditional Rajasthani attire, with a decorated camel companion. WordCamp Rajasthan takes place October 3 to 4, 2026, in Jaipur.

---

Until Next Week

A judge who dismissed WP Engine’s antitrust claims in September 2025 has now revived four of them, and triple damages are possible. Did one Ninth Circuit ruling about surgical-robot repairs just change the shape of this case? And what will the September 30 sanctions hearing over Matt Mullenweg’s WhatsApp, Signal, and Telegram messages turn up?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Automattic’s board crisis explained, WordPress security survey 2026 results, agency profitability data, and why WooCommerce devs keep losing to their own to-do lists.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 57, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 68 WordPressers who joined us in the last 7 days! We are now 979!

I’m writing you this issue from wonderful country Nepal. I traveled last week to join WordPress Kathmandu and it’s now one of my top favorite WordCamp experiences!

WordPress had a full week. A security survey landed with numbers worth knowing. A data-backed piece on agency profitability settled an old argument. Building plugins isn’t the hard part anymore. Selling them is. And Automattic’s boardroom imploded, with four departures, a golden parachute, and employees reading about it in TechCrunch.

---

In this Issue:

• WooCommerce Plugin Devs Have a Marketing Problem
• WordPress Security in 2026: The Numbers Are Not Reassuring
• What Separates Profitable WordPress Agencies From the Rest
• Automattic’s Board Crisis: What Really Happened
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WooCommerce Plugin Devs Have a Marketing Problem

AI has made shipping a WooCommerce plugin faster than ever. Building used to be the bottleneck. Now it’s getting people to buy.

Most WooCommerce developers aren’t bad at marketing, they just never get to it. The demo video has been on the to-do list for months. The outreach email is always next week. The real blocker is motivation, not skill. Free advice and free courses haven’t changed that.

Rodolfo Melogli’s answer is Save The Plugin: twenty marketing tasks across four weeks, inside a private Slack group with him directly involved. Finish all 20 and you get a reward worth $400 to $500. The sprint costs $297 for the first 10 seats and starts October 5, 2026.

Read the full blog on Business Bloomer →

Next: a security survey that puts a number on how unprepared most WordPress sites actually are.

---

WordPress Security in 2026: The Numbers Are Not Reassuring

Melapress surveyed 319 WordPress professionals for their annual security report. The gap between concern and preparation has barely moved.

Security concern averaged 7.85 out of 10, nearly identical to 2025’s 7.8. Yet only 27.9% have a breach recovery plan in place, and just 26% have team security training. Both figures are unchanged from last year.

67.7% of respondents have experienced at least one known security incident. Website downtime hit 68.4% of those who did. 42.6% of incident victims only found out when someone noticed something looked wrong on the site. Only 38.4% were alerted by logs or monitoring first.

When a search engine flagged the problem before the site owner did, outcomes were significantly worse: 45.9% of those incidents involved a loss of search rankings.

Read the full blog on Melapress →

Now, a word from our sponsor. Start building your WordPress WooCommerce store sites using AI chat!

---

---

What Separates Profitable WordPress Agencies From the Rest

GravityKit analyzed two major 2026 surveys of 832 WordPress agencies. Profitability has almost nothing to do with how long you have been running. It comes down to what you charge and whether revenue recurs.

Agencies charging $5,000 or more per project are consistently profitable 57% of the time. Below that, only 33% are. The most common price band sits at $2,500 to $4,999, just under where things change.

Recurring revenue also matters. Agencies with at least 25% of income on retainers or care plans jump from 30% to 47% consistent profitability. Going further than 25% barely moves the needle.

Meet both conditions and profitability hits 60.3%. With neither, it’s 22.6%. A five-year agency charging $5,000 outperforms a sixteen-year veteran who doesn’t.

Read the full blog on GravityKit →

The biggest WordPress story of the week has nothing to do with code.

---

Automattic’s Board Crisis: What Really Happened

On September 9, Automattic’s board placed Matt Mullenweg on paid leave and installed CFO Mark Davies as interim CEO. Thirty-three hours and 20 minutes later, Mullenweg posted in company Slack he was back, linking to LL Cool J’s “Mama Said Knock You Out.” He then published a blog post about buying a houseboat.

Four people are out. CFO Mark Davies, CLO Andy Missan, and board members Toni Schneider and Sue Decker all departed. Leaked documents revealed Davies and Missan signed reciprocal severance agreements during the 33-hour window, totaling $8.15 million.

Employees learned everything from press coverage. A week later, staff still had no official explanation. Automattic also retained Susman Godfrey, known for the $787.5 million Fox News settlement, for the WP Engine case. A court hearing is scheduled for September 30.

Read the full report on The Repository →

---

WordPress Must Read

→ Sources say Automattic’s board is out after failed attempt to oust CEO Matt Mullenweg (techcrunch.com) – TechCrunch’s sourced breakdown of the board ousting attempt, the departures, and how Mullenweg regained control.

→ Ideas for WordPress in an agentic world (apeatling.com) – What should WordPress look like when AI agents become the primary interface? This piece sketches out some concrete answers.

→ AI SEO Myths and Facts (kb.theseoframework.com) – No jargon, no hype. Just what AI actually changes about SEO and what you can ignore.

→ Preparing an Established Freemium Plugin for Modern WordPress.org Review (abulkhoyer.com) – A practical first-person account of what it takes to get a mature freemium plugin ready for today’s WordPress.org review standards.

---

On other WordPress News

→ WooCommerce 11.1.1 Release Notes (developer.woocommerce.com) – Patch release notes covering the latest fixes shipped in WooCommerce 11.1.1.

→ Proposal: Identifying WPCC Participants through WordPress.org Profiles (make.wordpress.org) – A proposal to make WordPress community contributor recognition visible directly on WordPress.org profiles.

→ WordPress 7.1.1 Maintenance and Security Release (wordpress.org) – The official release post for WordPress 7.1.1, covering what was patched and why you should update.

→ The AI-Powered WordPress course is now live on Learn WordPress! (make.wordpress.org) – The WordPress training team has published a new AI-focused course on Learn WordPress.

→ AI Contributor Weekly Summary – 16 September 2026 (make.wordpress.org) – A weekly roundup of what the WordPress AI contributor group has been working on.

→ Call for testing: Purple, a WooCommerce block theme (developer.woocommerce.com) – WooCommerce is reviving Purple, a block theme previously shelved, and wants community testing feedback.

→ Introducing Ipsum, the new default theme (make.wordpress.org) – The core team introduces Ipsum, the proposed next WordPress default theme, ending the sixteen-year Twenty- naming convention.

→ What’s new in Gutenberg 24.0? (16 September) (make.wordpress.org) – The full changelog for Gutenberg 24.0, covering new block features, editor improvements, and contributor updates.

→ WordPress 7.1.1 Ships 11 Security Fixes, Credits Anthropic and pwn.ai Again (therepository.email) – The Repository’s detailed look at what the 11 security fixes in 7.1.1 actually addressed.

→ Explore the WordPress Playground Terminal with the new Dev Tools Dock (make.wordpress.org) – WordPress Playground gets a new Dev Tools Dock giving developers terminal access directly in the browser.

→ Call for testing: DataForm editor inspector (make.wordpress.org) – The core team is asking for community testing on the new DataForm editor inspector before it ships.

→ A Note on Figma access (make.wordpress.org) – The WordPress design team shares an update on how Figma access is being managed across contributors.

→ Events in the US and Canada: the plan through 2027 (make.wordpress.org) – The community team lays out the WordPress events roadmap for North America through the end of 2027.

---

From WordPress Community

→ WP Shipyard (wpshipyard.com) – Austin Ginder launched WP Shipyard, a tool that lets site administrators browse their site in a different installed theme while visitors keep seeing the live one. Handy for previewing a new theme without spinning up a full sandbox.

→ WPAcquire (wpacquire.com) – Cagdas Dag launched WPAcquire, a marketplace to buy and sell WordPress businesses. Plugin listings are free; paid members can browse and contact sellers directly.

→ WP Suomi Full Schedule (wpsuomi.fi) – WP Suomi, the independent Nordic WordPress conference, has published its full schedule for October 16 in Oulu, Finland.

→ Portuguese Community to Host First WordPress Event Dedicated Entirely to AI (therepository.email) – The Portuguese WordPress community is organizing a first-of-its-kind event focused entirely on AI and its impact on WordPress.

→ How GatherPress Grew From a Road Trip Idea to WordPress’ Meetup.com Replacement (therepository.email) – The origin story behind GatherPress, now positioned as the open-source replacement for WordPress meetup management.

→ New Proposal Targets 20+ WordPress Events Across North America in 2027 (therepository.email) – A new proposal outlines a flexible, menu-style approach to running 20+ WordPress events across North America in 2027.

→ ‘Ipsum’ Proposed as Next WordPress Default Theme, Ending 16 Years of the Twenty- Naming Convention (therepository.email) – The Repository’s coverage of the Ipsum default theme proposal and what it means for the long-running Twenty-* tradition.

→ Back in WordPress core (fullstackleader.blog) – A personal account from a developer returning to WordPress core contribution.

→ Day one at Pantheon: good docs, good company (courtneyr.dev) – Courtney Robertson shares her first-day experience joining Pantheon, with notes on onboarding and documentation culture.

→ How GoDaddy’s Airo Handles WooCommerce Store Setup Through Conversation (godaddy.com) – Airo installs WooCommerce, creates core store pages and generates product descriptions from a single prompt; with deeper store management on the roadmap.*

^*Sponsored

---

Until Next Week

Automattic’s board tried to remove its founder. The attempt lasted 33 hours and 20 minutes, cost at least $8.15 million in severance, and left employees learning the details from TechCrunch. What does that kind of internal communication breakdown cost a company in the longer run? And with a WP Engine court hearing on September 30, is the drama actually behind us?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Automattic’s board tried and lost. Mullenweg’s back as CEO. Plus 7.2 squad, Grok malware find, and auto plugin security news.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 56, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 87 WordPressers who joined us in the last 7 days! We are now 878!

Automattic’s board tried to remove Matt Mullenweg as CEO. He refused to leave. Thirty-three hours later the board was gone and Mullenweg was back. That story dominated the week, but WordPress 7.2 also named its release squad, a Grok bot caught live malware sitting in a 40,000-install plugin on WordPress.org, and the plugin directory added automated security reviews that can block bad updates before they ship.

---

In this Issue:

• The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.
• WordPress 7.2 Release Squad Is Here
• A Grok Bot Found Live Malware on WordPress.org During a Routine Check
• WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.

On September 9, Automattic’s board voted to put Mullenweg on paid leave, naming CFO Mark Davies interim CEO. Mullenweg posted to company Slack that board members had “conspired” behind his back, that he received the resolution 50 minutes before the meeting, and that requests to consult a lawyer were denied.

What followed was 33 hours and 20 minutes of chaos. He declined to leave, removed Slack admins, posted “I’m a pirate now,” and swore for what he called the first time in 42 years. He posted a hiring call for sysadmins to move “my stuff” off Automattic servers, raising questions about WordPress.org, which he personally owns. By Friday he said he was back in control. Automattic confirmed it Saturday. Davies, CLO Andy Missan, Toni Schneider, and Sue Decker are all reported out. What triggered the original vote has not been explained.

Read the full blog on The Repository →

With the leadership drama still fresh, the WordPress 7.2 release squad was announced the same week, and Mullenweg himself is on it.

---

WordPress 7.2 Release Squad Is Here

The WordPress 7.2 release squad has been announced. Matt Mullenweg is Release Lead, with David Baumwald on coordination, George Mamadashvili and Peter Wilson as Tech Leads, and a full team covering triage, testing, and the Twenty Twenty-Seven default theme.

The structure follows the lean squad model in use since WordPress 6.7. Make Team Reps coordinate inside their teams rather than routing through a central group. Twenty Twenty-Seven has dedicated design and development leads, plus a mentor role built specifically to get new contributors into the default theme work. The release date is December 9, 2026, during State of the Word. If you weren’t selected, triage, bug scrubs, testing, and documentation are all still open for contribution throughout the cycle.

Read the full blog on Make WordPress Core →

While the 7.2 squad gets to work, a security story from the plugin directory showed just how fast a threat can move through WordPress.org.

---

---

A Grok Bot Found Live Malware on WordPress.org During a Routine Check

Austin Ginder at Anchor Hosting runs a morning Grok bot that reviews plugin diffs from the WP Beacon catalog. After two weeks of quiet, it flagged something: the tailwind.config.js file in instawp-connect had grown from 2.2 KB to 9.8 KB. The extra bytes contained a Node.js dropper pulling command-and-control IPs from Ethereum transactions, then decrypting and executing a remote payload.

The plugin has 40,000 active installs, but no one got hit. The attacker pushed to trunk rather than cutting a tagged release, which is what the update API actually serves. Wordfence showed zero hits overnight because the payload only runs during a Node build, not on PHP page loads. Ginder emailed the plugins team, who closed the listing that afternoon. Trunk was infected for about 23 hours before the author cleaned and restored it.

Read the full blog on Anchor Hosting →

That attack was caught by one developer’s morning routine. WordPress.org is now building the same kind of check into every plugin update before it ships.

---

WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship

WordPress.org has added automated security reviews to every plugin release. New plugins get reviewed before listing, but every update after that used to ship without any scrutiny between commit and distribution. That gap is now closed.

Every release sits in a six-hour cooldown window while several AI models and Jetpack Scan analyze the changes, producing a risk score. High-risk releases are automatically blocked before they reach the WordPress.org update API. Committers get an email with the findings. A high score doesn’t mean malicious intent, since an accidental vulnerability can score as high as deliberate malware. The InstaWP Connect incident described above was the system’s first confirmed interception: the Plugins Team closed that plugin 26 minutes after Wordfence flagged it, and the compromised version never shipped. If it runs cleanly, the cooldown window may shrink over time.

Read the full report on The Repository →

---

WordPress Must Read

→ Sources Say Automattic’s Board Is Out After Failed Attempt to Oust CEO Matt Mullenweg (techcrunch.com) – Davies, Missan, and Schneider are all reported out after the board’s attempt to remove Mullenweg collapsed in under 34 hours.

→ How to Model Data You Need to Query in Modern WordPress (remkusdevries.com) – A practical breakdown of how to structure custom data in WordPress for clean, efficient querying without fighting the platform.

→ WordPress 7.2 Release Squad Announced With Matt Mullenweg Back as Release Lead (therepository.email) – The Repository’s full coverage of the 7.2 squad announcement, with context on what Mullenweg’s return as Release Lead means for the December cycle.

→ Matt Mullenweg Tells Automattic Staff He’s Back in Control After CEO Ouster (techcrunch.com) – TechCrunch’s reporting on the 48 hours from ousted to reinstated, including the Slack messages and the “pirate” moment.

→ Automattic Board Forces Matt Mullenweg on Leave, Names CFO Mark Davies as Interim CEO (therepository.email) – The Repository’s original breaking story on the board vote, Davies’s appointment, and what Mullenweg posted company-wide.

→ Automattic’s Board Forces CEO Matt Mullenweg Into Leave of Absence (techcrunch.com) – TechCrunch’s initial September 9 report on the board vote and the Slack messages that followed.

→ Automattic CEO Matt Mullenweg Placed on Leave (theverge.com) – The Verge’s coverage of the leave announcement and what it means for Automattic and WordPress.com.

→ Students Built 108 Websites in Two Weeks in Bangladesh (wordpress.org) – Students in Bangladesh built 108 WordPress sites in two weeks as part of a learning program tied to the WordPress Credits initiative.

---

On Other WordPress News

→ Bringing Four Flagship Budgets Into One View (make.wordpress.org) – The Community team consolidates budget reporting across four flagship WordCamp events for clearer oversight.

→ Monthly Education Buzz Report: August 2026 (make.wordpress.org) – The Community team’s monthly roundup on WordPress education programs and what moved in August.

→ WordPress 7.1.1 RC1 Is Now Available (make.wordpress.org) – The first release candidate for the 7.1.1 maintenance release is out and ready for testing.

→ Planning for the Accessibility Lab Plugin (make.wordpress.org) – The Accessibility team’s plans for a dedicated lab plugin to test and develop accessibility improvements.

→ Updating WordPress to Use Node.js 24 and npm 11 (make.wordpress.org) – WordPress core is moving to Node.js 24 and npm 11, with details on what developers need to know.

→ Proposal: WordCamp Education Sponsor Fund for Flagships (make.wordpress.org) – A proposal to create a dedicated sponsor fund for education programming at flagship WordCamp events.

→ Automattic Fires Back at WP Engine Customer Class Action, Claims Small Business Owners Caused Their Own Losses (therepository.email) – Automattic’s legal response to the WP Engine customer class action, arguing the plaintiffs’ losses were self-inflicted.

→ Automated Security Review for Plugin Releases (make.wordpress.org) – The official Make WordPress Plugins post on how the new automated review works, what triggers a block, and what plugin authors should do if a release is flagged.

→ Proposed Change: Requiring PHP 8.1 or Newer for WooCommerce 11.5 and Beyond (developer.woocommerce.com) – WooCommerce is proposing to drop PHP 7.4 support starting with version 11.5, requiring PHP 8.1 as the new minimum.

→ WordPress 7.1 Release Retrospective (make.wordpress.org) – The core team’s post-release look at what worked and what didn’t in the 7.1 cycle.

---

From WordPress Community

→ Why WebMCP Is Going to Be Big for WordPress, and How to Try It Today (linkedin.com) – Jamie Marsland on why WebMCP matters for WordPress developers and how to get started with it today.

→ CloudFest Americas Returns to Miami With More Space, an Agency Focus, and a New Name (therepository.email) – CloudFest Americas is back in Miami with a larger venue, a sharper agency focus, and a new name for the event.

→ LoopConf Postponed to June 2027 After Lead Sponsor Pulls Out Six Weeks Before the Event (therepository.email) – LoopConf is pushed to June 2027 after its lead sponsor withdrew six weeks out, leaving no time to find a replacement.

→ AI-Generated Websites vs. WordPress: An Honest Comparison From a WordPress Agency (webdevstudios.com) – WebDevStudios on where AI site builders actually stand versus WordPress for real client work.

→ Six Solutions for WordPress Plugin Distribution, Each With a Different Philosophy (deploytroy.org) – A side-by-side look at six approaches to distributing WordPress plugins, from the official directory to self-hosted and commercial options.

→ Chris Reynolds on Building Trust With Project Contracts for Reliable AI Development (wptavern.com) – WP Tavern’s podcast with Chris Reynolds on how project contracts make AI-assisted development more predictable.

→ Did WordPress Just Lose? (youtube.com) – A video essay on where WordPress stands as the web shifts around it.

→ Benefit of the Doubt (crossword.fm) – The latest Crossword podcast episode on WordPress and the broader open source community.

→ Full WordPress, Full Control: How Airo Builds on Open-Source Without the Lock-in (godaddy.com) – Unlike proprietary AI builders, Airo generates a live WordPress installation. Full plugin access, full data ownership, no platform cage.*

_^*Sponsored

---

Until Next Week

Mullenweg was gone for 33 hours and 20 minutes. The board that voted him out is now out themselves. Three of Automattic’s top executives are reportedly gone, and the composition of the new board is still unclear as of today.

What actually triggered the vote? And with Mullenweg now also serving as WordPress 7.2 Release Lead, does his return to full control accelerate the project or complicate it?

Hit reply with your take. If this issue was interesting, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

---

WordPress launches a Core Security Initiative, WooCommerce 11.1 speeds up REST APIs, Miriam Schwab on the agentic web gap, WordCamp US recap, and CMS Conf launches in Poland.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 55, where you get curated news about WordPress and the WordPress community all in one place.

Security is getting a serious upgrade this week, WooCommerce 11.1 ships faster APIs and native variation galleries, Miriam Schwab calls out the gap between WordPress core’s AI plumbing and what the plugin ecosystem is actually delivering, and a Polish organizing team just launched a cross-platform CMS conference to break out of the WordPress bubble.

---

In this Issue:

• The WordPress Core Security Initiative: A Response to AI-Driven Vulnerabilities
• WooCommerce 11.1: Faster APIs, Variation Galleries, and More
• WordPress Is Ready for the Agentic Web, but the Ecosystem Isn’t
• 31 WordCamps Later: One Contributor’s Experience in Phoenix
• Polish WordCamp Organizers Launch CMS Conf, a New Cross-Platform Conference

---

The WordPress Core Security Initiative: A Response to AI-Driven Vulnerabilities

AI-powered security research is flooding WordPress’s bug bounty inbox. Monthly reports to the HackerOne program held steady at 20-30 for a decade, then jumped to 450 in July and hit 773 in August alone. The WordPress Security Team has responded with the Core Security Initiative, a coordinated effort built around three pillars: a tighter, more automated release process for fixes; a push to clear the backlog of open reports by bringing on more volunteers; and AI-assisted scanning to catch vulnerabilities before they get reported at all.

The scope of the HackerOne program has also been tightened. Vulnerabilities that require an administrator-granted role, like Contributor, will generally no longer qualify unless they demonstrate a high-severity escalation. Bugs where one authenticated role does something normally available to another won’t be enough on their own. If you do find something, report it at hackerone.com/wordpress and review the updated guidelines first.

Read the full blog on Making WordPress Secure →

Security is just one part of what’s been a busy few weeks for WordPress. The WooCommerce team has been shipping too.

---

WooCommerce 11.1: Faster APIs, Variation Galleries, and More

WooCommerce 11.1, released September 1, brings a real speed bump alongside features store owners have been waiting on. The headline change: Store API and REST requests are now 30-42% faster, by skipping block registration on requests that don’t need it. No code changes required on your end.

Variation image galleries are now a native WooCommerce feature, with no extra extension needed. The Additional Variation Images plugin is being retired, and the gallery is on by default for all stores. Virtual-only orders no longer show a shipping address in admin, clearing up display clutter that served no purpose. Video support in product galleries lands in beta, disabled by default, for locally uploaded videos. Developers also get a unified block editor asset system as an experimental feature, and a fix to remove_order_items() that stops replacement items from being accidentally deleted on save.

Read the full blog on The WooCommerce Developer Blog →

While WooCommerce ships performance wins, one WordPress voice is asking harder questions about what the platform still needs to deliver for the next wave of the web.

---

WordPress Is Ready for the Agentic Web, but the Ecosystem Isn’t

Miriam Schwab gave a talk at WordCamp US called “The Agentic Web Is Coming: Is WordPress Ready?” Core has the plumbing, she found. The plugin ecosystem hasn’t shown up. WordPress since version 7 ships the Abilities API and the MCP Adapter, giving agents a defined way to interact with a site. But core only registers three abilities out of the box.

On Miriam’s own site, 67 abilities are registered. Three come from core. She built 41 herself. She also tested whether agent-ready features like llms.txt and markdown page versions were being used. They mostly weren’t. Claude went straight for the HTML and converted it to markdown itself, ignoring the dedicated files. Bots want what humans want. Clean semantics, stable URLs, structured data, markup without junk. Build for people and agents follow.

Read the full blog on MiriamSchwab.me →

The plugin ecosystem gap Miriam describes was a real conversation topic at WordCamp US itself, where contributors gathered for four days in Phoenix.

---

---

31 WordCamps Later: One Contributor’s Experience in Phoenix

Mainul Kabir Aion flew from Kuala Lumpur for his 31st WordCamp, this time also organizing on the Attendee Communications team. WordCamp US 2026 ran August 16-19 at the Phoenix Convention Center with 425 contributors on Day 1, including 29 first-timers across 26 teams.

His highlight was a hackathon where his group built an AI-powered site architecture tool for service-area businesses, designed to map out which service pages to create, how they connect, and which thin pages to skip. They finished the day with a concrete workflow and pitched it as a rap. Beyond the hackathon, he scored 995 out of 1000 at the Community Booth quiz to take home a LEGO Wapuu, then spent an hour painting his own mascot. His post is an honest account of how much WordCamp work happens out of sight, and why that effort matters.

Read the full blog on MKAion.com →

WordCamp US wasn’t the only community event making news this week. In Poland, a WordCamp organizing team is building something different entirely.

---

Polish WordCamp Organizers Launch CMS Conf, a New Cross-Platform Conference

The team behind WordCamp Gdynia has launched CMS Conf, a three-day conference for CMS creators and developers, scheduled November 12-14 in Gdynia, Poland. Lead organizer Maciek Palmowski said 15 years in WordPress left him with almost no picture of what was happening on the other 58% of the web. CMS Conf is the fix.

The event received around 120 speaker submissions for roughly 30 slots, with talks covering WordPress, Drupal, Joomla, TYPO3, Astro, Payload, and Cloudflare’s EmDash. Speakers are coming from Figma, the Drupal Association, Automattic, Cloudflare, and Zendesk. Two parallel tracks run, one for developers and one for creators, borrowed directly from the WordCamp format. The team had to form a company to run independently, since the WordPress Foundation only handles WordCamp finances. Tickets are €150 at cmsconf.com.

Read the full blog on The Repository →

---

WordPress Must Read

→ 6 WordCamp US 2026 Sessions Worth Your Time (and What I Actually Took Away From Each) (wpmore.net) – WordCamp US 2026 had 60+ sessions. Most of them I won’t remember in a week. These six stayed with me.

→ Security Stories from the People Who Experienced Real Incidents (melapress.com) – Melapress’s Wall of Security Stories collects first-hand accounts of website hacks, their financial impact, and the recovery work that the vulnerability numbers never show.

→ WordPress Tightens Bug Bounty Scope After Monthly Security Reports Nearly Double to 773 (therepository.email) – Reports to WordPress’s HackerOne program jumped from a decade-long baseline of 20-30 a month to 773 in August alone, driven by AI-assisted security research tools.

→ Bringing Together Our Various Responsive Tooling (nomad.blog) – Anne McCarthy maps out the current state of WordPress responsive controls ahead of 7.2, covering fluid typography, viewport-based block visibility, and the gaps that still need solving.

---

On Other WordPress News

→ Telex Has Been Retired (telex.automattic.ai) – Automattic’s AI-assisted authoring environment for WordPress has been shut down.

→ Transparency Report Update: January – June 2026 (transparency.automattic.com) – Automattic’s mid-year transparency report covers content takedown requests, government demands, DSA compliance, and the difficult balance between user expression and reporter rights.

→ WordCamp US 2026 Contributor Day Recap (make.wordpress.org) – The Hosting team’s write-up from Contributor Day in Phoenix, covering what the team worked on across 425 participants and 26 contributing teams.

→ Themes Team Update September 1, 2026 (make.wordpress.org) – The latest weekly status update from the WordPress Themes team.

→ WordCamp US 2026: PHP Conversation (make.wordpress.org) – Notes from the PHP discussion held at WordCamp US, covering the project’s approach to PHP version support and compatibility decisions.

→ Announcing the 2026 Kim Parsell Memorial Scholarship Recipient: Jeanherline Santiago (wordpressfoundation.org) – The WordPress Foundation names this year’s scholarship recipient, awarded annually in memory of community contributor Kim Parsell.

→ Replacing Dashicons in the Admin Bar and Menu (make.wordpress.org) – A look at the ongoing effort to move WordPress admin icons away from the aging Dashicons icon font.

→ WordPress 7.1.1 Release Schedule (make.wordpress.org) – The core team has published the schedule for the upcoming 7.1.1 maintenance release.

→ AI Contributor Weekly Summary – 2 September 2026 (make.wordpress.org) – The WordPress AI team’s weekly summary covering contributor activity and progress in the AI working group.

→ Accessibility Team Meeting Notes: Aug 27, 2026 (make.wordpress.org) – Notes from the WordPress Accessibility team’s most recent meeting.

→ Agenda: Weekly Polyglots Chat – September 2, 2026 (7:00 UTC) (make.wordpress.org) – The agenda for the weekly Polyglots team chat, covering locale stats, the WordPress 7.1.1 release schedule, and open help and feedback items.

→ Emoji Locale (art-xemoji): How Would You Translate Weekdays and Months? (make.wordpress.org) – The Polyglots team opens a discussion on how to handle weekday and month names in the emoji locale, which has no spoken language to fall back on.

→ A Week in Openverse: 2026-08-24 – 2026-08-31 (make.wordpress.org) – The Openverse team’s weekly update covering development work and progress from the last week of August.

→ What’s New in Gutenberg 23.9? (2 September) (make.wordpress.org) – A full rundown of the changes and improvements shipping in the latest Gutenberg release.

→ Updates to the WordPress Vulnerability Disclosure Program (make.wordpress.org) – The Security Team’s formal update on the scope changes to the HackerOne disclosure program, with guidance for researchers on what now qualifies.

→ WooCommerce 11.1 Delivers Faster REST and Store API Requests by Skipping Block Registration (developer.woocommerce.com) – A deeper technical look at how WooCommerce 11.1 cuts Store API and REST response times by 30-42% by skipping block registration on non-rendering requests.

→ WordPress Announces Core Security Initiative as AI-Driven Vulnerability Reports Hit Record Levels (therepository.email) – The Repository’s full coverage of the Core Security Initiative announcement, with context on the AI-assisted research surge driving the record report volumes.

---

From WordPress Community

→ WordCamp Belgrade Returns With a New Bilingual Format to Bring the Community Together (therepository.email) – WordCamp Belgrade is back and running both Serbian and English tracks to widen who can participate and benefit.

→ Aaron D Campbell on Navigating WordPress Security in the AI Era (wptavern.com) – WP Tavern’s podcast episode with longtime WordPress security contributor Aaron D Campbell on what AI means for vulnerability research and the project’s defenses.

→ WordPress Is Eating Itself Alive (youtube.com) – A candid video essay on the tensions inside the WordPress project and the community dynamics that have built up over recent years.

→ Why Real-Time WordPress Is the Future (thewpminute.com) – The WP Minute makes the case for real-time, collaborative WordPress editing and what needs to change for it to get there.

→ Enqueue Returns to Sydney to Explore What AI Means for WordPress Developers (therepository.email) – The Enqueue developer event is coming back to Sydney with AI and its practical implications for WordPress development as its central theme.

---

Until Next Week

WordPress’s HackerOne inbox went from 450 reports in July to 773 in August, driven almost entirely by AI-assisted security research tools. That volume prompted a structural response: tighter scope rules on the bug bounty program, more volunteers to clear the backlog, and AI-assisted scanning to catch vulnerabilities before researchers do.

Is your site’s security posture keeping up with how fast the threat surface is changing? And if you’re a developer, are you paying attention to what the scope changes mean for the reports you might submit?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community