Author: Nishat Shahriyar

5 WordPress updates: new dev tools, 6.9.1 release, AI infrastructure plans, community goals, and FAIR’s roadmap.

---

Hello WordPressers!

Welcome to this week’s WPMore roundup — WPMore newsletter issue 36, where you get curated news about WordPress and the WordPress community all in one place.

WordPress is evolving fast in 2026, and this week brings updates that touch every part of the ecosystem. From new AI development tools to community-building efforts and infrastructure debates, these stories show where WordPress is headed and what it means for you as a site owner, developer, or community member.

Thanks for reading WPMore!! Subscribe for free to receive new posts and support my work.

---

In this Issue:

• AI Agents Get a WordPress Testing Playground
• WordPress 6.9.1 Fixes 49 Bugs Across Core and Block Editor
• WordPress 7.0 May Bundle AI Infrastructure (But No AI by Default)
• WordPress Meetups Are Getting a Major Revamp in 2026
• FAIR Plans to Rebundle Top 10,000 WordPress Plugins by Year’s End

---

AI Agents Get a WordPress Testing Playground

AI code agents are getting better at writing WordPress plugins and themes, but testing has been the bottleneck. WordPress contributor Brandon Payton just released wp-playground, a new AI agent skill that uses the Playground CLI to give AI agents a fast, repeatable way to run WordPress and verify their code as they build.

The skill automatically detects where code belongs, mounting plugins into wp-content/plugins or themes into wp-content/themes by recognizing file signatures like plugin headers. This cuts the “ready to test” time from about a minute down to just a few seconds. Agents can now alternate between tools like curl and Playwright to interact with WordPress, verify results, apply fixes, and re-test quickly.

• Install via: npx openskills install WordPress/agent-skills
• New repo launched at github.com/WordPress/agent-skills for community contributions
• Future plans include persistent Playground sites and wp-cli command support

Read the full official blog on WordPress.org here.

This development tool might seem niche, but it signals how AI is becoming part of the WordPress development workflow.

---

WordPress 6.9.1 Fixes 49 Bugs Across Core and Block Editor

WordPress 6.9.1 is now available as a short-cycle maintenance release. This minor update addresses 49 bugs affecting the block editor, mail functionality, and classic themes. Sites with automatic background updates enabled will update automatically, or you can manually update through your WordPress Dashboard.

The release was led by Aaron Jorbin and Aki Hamano, with contributions from over 80 community members. It’s a testament to the WordPress community’s ability to coordinate asynchronous fixes into stable releases.

• Next major version: WordPress 7.0, scheduled for April 9, 2026 at WordCamp Asia
• Download available at WordPress.org or via Dashboard > Updates
• Full bug fix list in the release candidate announcement

Read the full blog on WordPress.org here.

Speaking of WordPress 7.0, there’s a significant proposal on the table for that release.

---

WordPress 7.0 May Bundle AI Infrastructure (But No AI by Default)

A proposal is on the table to merge the WP AI Client into WordPress 7.0, providing developer infrastructure for AI features without actually enabling any AI functionality by default. This is about laying groundwork, not shipping AI to every WordPress site.

The WP AI Client is a provider-agnostic API that lets WordPress code call generative AI models through a consistent interface. It includes WordPress integrations for HTTP transport, event handling, caching, credentials, and a REST/JS layer. Crucially, without explicit configuration and explicit calling code, WordPress won’t send any prompts or data to external services.

What this means for you: WordPress won’t automatically use AI. Site owners will install plugins to enable specific AI providers, and plugins can detect whether AI is configured before offering AI features. The goal is to reduce duplicated SDKs and settings pages while giving the ecosystem a stable foundation.

• Security: REST/JS execution is capability-gated; secrets won’t leak
• Privacy: No outbound AI calls by default
• Performance: Minimal footprint when unused

Feedback is being collected via comments and a Trac ticket. Testing instructions will be available when a pull request opens.

Read the full official blog on Make WordPress here.

While WordPress Core explores AI infrastructure, the community team is focusing on something more human.

---

WordPress Meetups Are Getting a Major Revamp in 2026

Meetups have been explicitly called out as “the primary front door to the WordPress community” in the 2026 Big Picture Goals, and the Community Team is planning a significant evolution. With WordPress Credits and Campus Connect scaling quickly, meetups need to be ready to welcome newcomers and turn curiosity into active participation.

The focus is on adding hands-on, issue-focused sessions alongside the presentations and social gatherings meetups already do well. This means working together on real WordPress problems, expanding learning opportunities tied to actual WordPress needs, and providing clear paths from meetup participation to contribution on Make teams.

The Community Team’s Q1-Q2 priorities include:

• Auditing the Meetup Organizer Handbook for guidance on hands-on sessions
• Reaching out to all existing meetup groups to assess activity and offer support
• Creating templates for contribution-focused meetup formats
• Highlighting meetups already running successful hands-on sessions

They’ll also work to strengthen the meetup-to-contribution pipeline by coordinating with Make team reps and improving visibility of “good first issues” that groups can tackle together.

Read the official blog on Make WordPress here.

While WordPress.org strengthens its community infrastructure, an alternative distribution network continues to gain momentum.

---

FAIR Plans to Rebundle Top 10,000 WordPress Plugins by Year’s End

The FAIR project has published its 2026 roadmap with an ambitious plan: rebundle the top 5,000 to 10,000 WordPress.org plugins by December, reformatted to meet FAIR Protocol specifications with added metadata and cryptographic package signing.

FAIR’s roadmap is structured around three quarterly milestones. The first (April 26) focuses on trust systems and verification infrastructure. The second (August 16) targets direct engagement with commercial plugin publishers to build authenticated API endpoints for payment gateways and license validation, letting site admins purchase licenses and manage subscriptions from within their WordPress dashboard. The third (December 6) shifts to infrastructure scaling and sustainability.

What this means: FAIR is positioning itself as a viable alternative to WordPress.org’s centralized repository, with federated distribution and a focus on security verification. The project acknowledges it will need significantly more contributors to handle package vetting at this scale.

• Six months after launch, FAIR has nine software projects in active development
• November 2025 hackathon with Patchstack delivered vulnerability information directly to WordPress dashboards
• Board and committee member announcements are underway but not yet scheduled

Read the full report on The Repository here.

Other reports from The Repository you might like to read:

• WordPress 6.9.1 Released with Fixes for 49 Bugs in Core and Block Editor
• WordPress AI Experiments Plugin Tests Eight New Features, Including Type-Ahead and Comment Moderation
• WP Engine Wins Approval to Add WooCommerce as Defendant as Court Signals Frustration with Lengthy Filings
• WordPress Meetups to Add Hands-On Contribution Sessions Alongside Traditional Formats

Don’t forget to subscribe & support them, they do some amazing, hard-hitting WordPress journalism.

---

WordPress Must Read

→ How We Waste Great Talks at WordCamps (And How to Fix This) (checkoutsummit.com)

→ Wordfence Bug Bounty Program Monthly Report – December 2025 (wordfence.com)

→ My 7-Year-Old Wanted to Build a Website. Should I Still Teach Him WordPress? (wpmayor.com)

→ Marketing Lessons from WordCamp Asia (make.wordpress.org)

→ Content Guidelines: A Gutenberg Experiment (make.wordpress.org)

→ In the past week, there has been an explosion of visible AI progress in the WordPress project (j.cv)

---

On other WordPress News

→ Hosting Team Reps 2026 (make.wordpress.org)

→ Automattic Backs University of Illinois Chicago Program Set to Pay Students for WordPress-Based AI Training (therepository.email)

→ It’s official: WordPress.com has a Claude Connector (wordpress.com)

→ WordCamp Asia 2026 WP Campus Connect Scholarship Sponsor Applications Now Open (wp-content.co)

→ New concept: National Championships at WordCamps (make.wordpress.org)

→ Proposal: Monthly Office Hour Meeting for Make WordPress Training (make.wordpress.org)

→ WordPress Studio 1.7.0: Meet the New Studio CLI (wordpress.com)

→ Call for testing: Experimental REST API Caching in WooCommerce 10.5 (developer.woocommerce.com)

→ Apply for Scholarships to Attend WordCamp Asia 2026 (asia.wordcamp.org)

→ Recap: WordPress 6.9 “Gene” Retrospective (make.wordpress.org)

→ Call for Testing – Customizable Navigation (“Mobile”) Overlays (make.wordpress.org)

→ Call for Scholarship Sponsors: Support Student Participation through WordPress Campus Connect (make.wordpress.org)

---

From WordPress Community

→ The right time: Leaving Automattic (nickdiego.com)

→ WP Engine Launches Newsroom, a Publishing Platform Built on Big Bite’s Newsroom Expertise (therepository.email)

→ #202 – Charly Leetham on Using WordPress to Enable a Digital Nomad Life (wptavern.com)

→ Luke and Jonathan catch up with Jeff Paul, VP of Open Source Solutions at Fueled and an active contributor to the WordPress project for the past decade. They discuss Jeff’s contribution journey, their shared agency experiences, and thoughts on the upcoming 7.0 release. (crossword.fm)

→ Hackathons and jam sessions for WordPress builders (pluginjam.com)

→ Underfunded PHP Tools: A Global Business Threat (openchannels.fm)

→ Excerpt Talks Episode #6 – WP Credits Panel Discussion (wpbakery.com)

---

Conclusion

WordPress in 2026 is shaping up to be a year of foundational changes, some technical, some cultural, all significant. Whether you’re building sites, writing code, or just keeping up with the ecosystem, these shifts will affect how you work with WordPress.

Have thoughts on any of these stories? Hit reply, I’d love to hear what you think.

Nishat, WP More

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

AI features, meetup priorities, security gaps, and ongoing drama—here’s what’s shaping WordPress this week.

---

Hello WordPress enthusiasts!

Welcome to this week’s WPMore roundup — WPMore newsletter issue 35, where you get curated news about WordPress and the WordPress community all in one place.

WordPress is stepping into 2026 with ambitious plans and unresolved tensions. This week brought clarity on where the project is headed: real-time collaboration, AI integration, and revitalized meetups, but also reminders of the challenges it still faces. From security gaps that should worry every site owner to community friction that won’t seem to fade, here’s what you need to know.

Thanks for reading WPMore!! Subscribe for free to receive new posts and support my work.

---

In this Issue:

• WordPress 7.0 Aims for Google Docs-Style Collaboration
• AI Experiments Plugin Adds Excerpt Generation and Developer Tools
• Official WordPress.org X Account Mocks FAIR Project, Draws Backlash
• Most Hosts Can’t Block WordPress Vulnerabilities—74% of Attacks Succeed
• WP Engine Customers Refile Class Action After Court Dismissal

---

WordPress 7.0 Aims for Google Docs-Style Collaboration

WordPress Executive Director Mary Hubbard outlined the project’s 2026 roadmap, and WordPress 7.0 is the centerpiece. Set to coincide with WordCamp Asia, the release will focus on Phase 3: Collaboration, bringing real-time co-editing directly into the block editor; think Google Docs, but for WordPress.

Beyond collaboration, 7.0 will introduce a Command Palette powered by the Abilities API, client-side media processing to reduce server load and speed up uploads, and responsive editing controls that let you customize mobile menus and hide blocks by viewport. New blocks like Tabs and Icon round out the creative toolkit.

The update also continues WordPress’s intentional push into AI. Hubbard emphasized AI will remain opt-in and plugin-based, with no automatic features injected into sites. The Core AI team is developing project-wide guidelines focused on transparency, user control, and data responsibility; guardrails designed to keep AI helpful without overstepping.

• Key takeaway: WordPress 7.0 aims to make the editor more collaborative, faster, and smarter, without forcing AI on anyone.
• For site owners: Expect smoother uploads and better mobile customization tools once 7.0 drops.

Hubbard also stressed the importance of revitalizing meetups as the “primary front door” to the WordPress community, encouraging hands-on learning and clearer onboarding for new contributors, especially students arriving through programs like Campus Connect and WordPress Credits.

Read the full blog on Make WordPress Here.

---

AI Experiments Plugin Adds Excerpt Generation and Developer Tools

The AI Experiments plugin hit version 0.2.0, bringing AI-powered excerpt generation to WordPress editors. Instead of leaving excerpts blank or writing them last, authors can now generate a first draft directly from post content, then review and edit as needed.

The release also introduces the Abilities Explorer, a new admin screen that surfaces all registered AI capabilities within the plugin. It’s designed to help developers understand what AI-powered actions are available and how they’re exposed in the system, a foundation for making the Abilities framework more extensible as new features roll out.

Looking ahead, version 0.3.0 is already in progress with content summarization, featured image generation, alt text generation, and a refactored Abilities Explorer built on TypeScript and DataViews. These experiments are meant to inform future core AI discussions, not replace editorial judgment.

• Key takeaway: AI in WordPress is evolving carefully, with tools that assist rather than automate away editorial control.
• For editors: Excerpt generation could save time on archives and feeds, but you’re still in charge of what gets published.

The plugin remains experimental, but the direction is clear: practical, optional, and transparent AI features that fit into existing workflows.

Read the full blog on Make WordPress here.

---

Official WordPress.org X Account Mocks FAIR Project, Draws Backlash

The official WordPress.org X account sparked backlash last week after posting a mocking reply about the FAIR project, a federated, independent repository initiative launched by developers who were previously banned from WordPress.org.

The controversy started when Nicholas Garofalo, Director of Marketing for WordPress.org at Automattic, mentioned his personal site got stuck in maintenance mode after updating a FAIR Connect plugin. The WordPress.org account replied: “Looks like the Federated and Independent Repository project is going great… Maybe they need some REST.” The “REST” reference was widely interpreted as a jab at Ryan McCue, creator of the WordPress REST API and a FAIR co-chair who was among those banned in 2024.

Community reaction was swift. Several developers and leaders criticized the post as unprofessional and out of step with WordPress leadership’s stated goal of rebuilding trust after last year’s moderation controversies. Some critical replies were later hidden by the account, raising further concerns about how dissent is handled on official channels.

• Key takeaway: The post felt like a return to last year’s drama, at a time when the community wants to move forward.
• For the community: It’s unclear who authored the post, but it highlighted ongoing tensions around governance, moderation, and tone.

WordPress Executive Director Mary Hubbard outlined moderation reforms in May, but this episode suggests the reset is still a work in progress.

Read the full report on The Repository Here.

Share

---

Most Hosts Can’t Block WordPress Vulnerabilities—74% of Attacks Succeed

A new security study from Patchstack tested 30 known WordPress vulnerabilities across multiple hosting companies and the results are alarming. Even after expanding the experiment to include more hosts and more generic attack types, 74% of exploit attempts still succeeded.

The study found that hosts performed better against non-WordPress-specific vulnerabilities like SQL injection or directory traversal, but struggled badly with WordPress-specific attacks like privilege escalation (blocked only 12% of the time). Once an attacker gains admin privileges, they can access customer data, edit content, or upload malicious files, often bypassing other protections entirely.

Even hosts advertising commercial web application firewalls showed inconsistent results. The best performers were hosts with in-house firewall solutions, suggesting that investing in custom security infrastructure matters more than relying on third-party tools. Notably, the study also retested 10 vulnerabilities from an earlier experiment and many hosts still hadn’t addressed them months later.

• Key takeaway: “Secure hosting” marketing doesn’t guarantee protection against WordPress vulnerabilities.
• For site owners: Don’t assume your host has you covered. Layer your security with a dedicated plugin like Patchstack, Wordfence, or Sucuri.
• For hosts: If you’re serious about WordPress security, generic WAFs won’t cut it.

The study confirms what many security researchers already knew: WordPress vulnerability mitigation remains largely unsolved, and vibe-coding practices are only making it worse.

Read the full report on Patchstack here.

---

WP Engine Customers Refile Class Action After Court Dismissal

WP Engine customers Ryan Keller and Sharon Schanzer have filed an amended class action lawsuit against Automattic and CEO Matt Mullenweg, seeking to revive claims a judge dismissed last month for insufficient detail.

The original lawsuit alleged Automattic intentionally interfered with their WP Engine contracts during the late-2024 standoff, when WordPress.org access was cut off and the Advanced Custom Fields plugin was taken over. Judge Araceli Martínez-Olguín ruled they hadn’t shown Automattic knew about their specific contracts or pointed to concrete lost business opportunities.

The amended complaint adds fresh evidence, including the WordPress Engine Tracker website, which publicly listed over 842,000 WP Engine-hosted sites alongside promotional links to competing hosts like Automattic-owned Pressable. A 6,584-page CSV of those sites is filed with the complaint as proof Automattic could identify specific customers. The filing also details technical impacts, arguing that WordPress.org access is hard-coded into the software and couldn’t simply be rerouted.

• Key takeaway: The legal battle over last year’s WP Engine conflict is far from over.
• For WP Engine users: This case could have implications for how disputes between platform owners and third-party hosts are handled in the future.

A hearing date hasn’t been set, but the case continues to unfold as a central piece of fallout from 2024’s most contentious WordPress dispute.

Read the full report on The Repository here.

Other reports from The Repository you might like to read:

• Matías Ventura Named WordPress 7.0 Release Lead as Contributors Close In on Real-Time Collaboration Approach
• Inside WordCamp Europe 2026: Lead Organizers on Getting More People to Kraków and This Year’s Education Focus
• WordPress.org Launches New Education Hub Highlighting Campus Connect, Credits, and Student Clubs
• WordPress 7.0 Planning Continues With Call for Release Squad Volunteers
• WordPress Plugins Team Reviewed Record 12,713 Plugins in 2025 as Submissions Doubled
• Misunderstandings Over AI Use Fuel Confusion Around WordPress.org Plugin Reviews
• WordPress to Drop PHP 7.2 and 7.3 Support With WordPress 7.0

Don’t forget to subscribe & support them, they do some amazing hard-hitting WordPress journalism.

---

WordPress Must Read

→ PHP can AI: WordPress.com Agentic Infrastructure (piszek.com)

→ Why WordPress Needs to Plug Into the Agentic Web (wpengine.com)

→ I Dug Through 6,162 WordPress Plugins From 2025. Let’s Talk About What’s Missing—And Why 2026 Could Be Different (regionallyfamous.com)

→ Market analysis: WordPress in 2026 (humanmade.com)

→ Matt Mullenweg on WooCommerce’s Existential Threat, AI Hype, and Why Breaking Sites Makes Him Furious (therepository.email)

→ Happy Birthday Drupal! (jonathandesrosiers.com)

Share

---

On other WordPress News

→ WordPress Community Team Encourages Women-Centric Events for International Women’s Day 2026 (therepository.email)

→ New: Request a video message from Matt for your WordCamp (make.wordpress.org)

→ What’s new in Gutenberg 22.4? (20 January) (make.wordpress.org)

→ WordPress 6.9.1 Release Schedule (make.wordpress.org)

→ Three New UI Updates to WordPress Playground from December 2025 (make.wordpress.org)

→ Nominations for Core Team Reps: 2026 Edition (make.wordpress.org)

→ WordPress Studio 1.7.0: Meet the New Studio CLI (wordpress.com)

→ Product Permalink Changes Coming in WooCommerce 10.5 (developer.woocommerce.com)

→ What’s new for developers? (January 2026) (developer.wordpress.org)

→ Introducing WP-Bench: A WordPress AI Benchmark (make.wordpress.org)

→ WC REST API fixes for product variation attributes with special characters in WooCommerce 10.5 (developer.woocommerce.com)

→ A New Home for WordPress Education Programs (wordpress.org)

→ Sample text Five (domain.com)

---

From WordPress Community

→ Exploring work in progress for WordPress 7.0 (nomad.blog)

→ Ohia ᚛ᚈᚐᚂᚐᚋᚆ᚜ receives the Yoast Care fund for her contribution to the WordPress community (yoast.com)

→ $3 Millions in Sales Later – 2025 Review (seopress.org)

→ Funding Open Source for Digital Sovereignty (dri.es)

→ Overall adoption HTTP Archive measurements show that CMS-driven sites account for over 54% of observed websites in 2025, reinforcing CMSs as the default infrastructure for the web. (almanac.httparchive.org)

→ WordPress is moving fast on AI, and plugin builders need to keep up. WP Product Talk sits down with Jason Adams, Core AI Team Lead at Automattic, to unpack how plugins WordPress AI efforts are shaping what’s possible right now. (youtube.com)

→ Is There a WordPress Replacement in 2026? I Went Looking (jeangalea.com)

→ BuddyPress Is Fading: Why We Must Act Now to Save It (vapvarun.com)

→ The Future of The Web, What does the Open Web look like in an AI future? How will websites change? (j.cv)

→ Closing the door (for now) on Content Creators slack channel (nomad.blog)

→ The silence is deafening: Google’s “agentic” future leaves the WordPress economy behind (joost.blog)

→ Aditya Kane reflects on his 11 years of WordPress contribution journey (bombaypirate.com)

→ Matt Mullenweg on WooCommerce’s Future and Competitive Strengths in Online Commerce (openchannels.fm)

→ Product Thinking in Practice: The Choices Behind Synced Pattern Popups (mattcromwell.com)

→ Checkout Summit: A Conference for WooCommerce Devs ft. Rodolfo Melogli (webmasters.fm)

→ Growing Agency Success with People-Centric Values and Open Source Education (openchannels.fm)

---

Conclusion

That’s the week in WordPress: big plans, real risks, and unresolved tensions. Whether you’re excited about 7.0’s collaboration features or concerned about security gaps and governance drama, one thing is clear: 2026 is shaping up to be a pivotal year.

Got thoughts? Hit reply, I’d love to hear from you. And if you found this useful, share it with a fellow WordPress user who could use the update.

Nishat, WPMore

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

PHP 7.2/7.3 support ends in April, plugin sales down 80%, security deep-dive, and Make WordPress team updates.

---

Hello WordPressers!

Welcome to this week’s WPMore roundup — WPMore newsletter issue 34, where you get curated news about WordPress and the WordPress community all in one place.

We’re covering some major moves in the WordPress ecosystem: a long-awaited PHP version bump, the sobering reality of plugin sales in 2025, and practical security insights you can use today. Plus, updates from the Plugins and Test teams on how AI is reshaping workflows. Let’s dive in.

Thanks for reading WPMore!! Subscribe for free to receive new posts and support my work.

---

In this Issue:

• WordPress 7.0 Waves Goodbye to PHP 7.2 and 7.3
• Plugin Sales Took a Hit in 2025, Here’s What the Data Shows
• The Plugins Team Doubled Its Workload And Leveled Up With AI
• The Test Team Is Rebuilding With Training and Clearer Expectations
• A Deep Dive Into WordPress Security: From Foundations to Hardening

---

WordPress 7.0 Waves Goodbye to PHP 7.2 and 7.3

WordPress 7.0, scheduled for April 2026, will drop support for PHP 7.2 and 7.3. The new minimum supported version will be PHP 7.4.0, while the recommended version remains PHP 8.3. Usage of PHP 7.2 and 7.3 has fallen below 4% of monitored WordPress installs, well under the project’s 5% threshold for retirement.

This shift aims to keep WordPress maintainable for the long haul. Over time, raising the minimum PHP version benefits the plugin and theme ecosystem, improves tooling and libraries (including AI integrations), and strengthens the project’s developer relations. WordPress core is already fully compatible with PHP 8.0–8.3 and beta compatible with PHP 8.4 and 8.5.

Sites still running PHP 7.2 or 7.3 will stay on the WordPress 6.9 branch once 7.0 launches. Security fixes will be backported to WordPress 4.7 when possible, even though only one branch officially receives updates. The Gutenberg plugin will also bump its minimum PHP version to 7.4.

• Key takeaway: If you’re still on PHP 7.2 or 7.3, now’s the time to upgrade. Contact your host if you need help.
• What’s next: No set schedule for future PHP bumps, usage and the 5% threshold will guide decisions going forward.

Read from the Official Make WordPress Blog here.

This move keeps WordPress modern and sustainable, but it also means plugin developers and site owners need to stay current.

---

Plugin Sales Took a Hit in 2025, Here’s What the Data Shows

Plugin sales were tough in 2025. Katie Keith at Barn2 saw new plugin sales drop 17.8%, with revenue up only 0.65% thanks to renewals. A poll of plugin companies revealed that 80% experienced flat or declining sales compared to 2024. A follow-up survey dug deeper, and the patterns were striking.

Replaceability mattered most. Plugins that are hard to replace saw two-thirds reporting growth, regardless of how “essential” they were. Partially replaceable plugins struggled, with many down 15–29% or worse. Easy-to-replace plugins were hit hardest; competition, AI-generated alternatives, and theme features are pulling customers away.

Organic search took a beating. Companies relying heavily on SEO saw the biggest declines. AI tools are changing how people discover plugins, and fewer clicks are converting into sales. Freemium and marketplace listings showed mixed results, but partnerships and affiliates held steadier; being embedded in someone else’s workflow provided a buffer.

What founders can do in 2026:

• Make your plugin irreplaceable, own a clear outcome and solve a problem no one else does quite as well.
• Reduce dependence on SEO by diversifying into YouTube, partnerships, email, and direct outreach.
• Be explicit about why paying is worth it; support alone isn’t enough; emphasize reliability, updates, and peace of mind.
• Market consistently, not occasionally. Growth stories came from deliberate visibility, not passive discovery.

Read the full report on WP Product Talk Here.

The WordPress plugin market is shifting fast, and adapting now will separate the winners from the rest.

---

The Plugins Team Doubled Its Workload And Leveled Up With AI

The WordPress Plugins Team reviewed 12,713 plugins in 2025, a 40.6% increase over 2024. Weekly submissions surged from 150 to over 330, and the team kept the queue under one week despite the volume. How? By heavily upgrading their tools with AI-assisted checks and automation.

The Internal Scanner now tackles repetitive tasks like verifying plugin names, checking branding compliance, and confirming ownership, adding over 80 new features and 100 improvements in 2025. The Plugin Check Plugin (PCP) evolved into a security-focused tool, with five major releases adding nonce verification, forbidden function checks, localhost detection, and enhanced PHP 8.1+ compatibility. In October, PCP started running automatic security scans on every plugin update, reports are internal for now, but authors will soon receive feedback to improve their plugins proactively.

Despite the progress, challenges remain. Nearly 39% of reviewed plugins received no reply from authors, a drop from 2024 but still a drain on volunteer time. Approvals rose to 69.5% (up from 63.4% in 2024), and the average number of issues per plugin declined, showing submissions are better prepared. AI is lowering barriers to entry without compromising quality, the approval bar hasn’t dropped, but more people are building plugins than ever before.

• Key takeaway: The team is scaling through smarter tools, not just more people. Plugin authors should use PCP in their workflows to catch issues early.
• What’s ahead: Scaling the team and processes in 2026 to handle record-breaking submissions while maintaining standards.

The Plugins Team is proving that AI can amplify human effort without sacrificing quality.

Read from the Official Make WordPress Blog here.

---

The Test Team Is Rebuilding With Training and Clearer Expectations

The WordPress Test Team is restructuring in 2026 to address resource bottlenecks and clarify what it means to be a team member. Historically, joining was either easy (as a yearly representative, often without real contribution) or extremely hard (through exceptional effort like triaging hundreds of tickets). Moving forward, earning “emeritus” status will require sustained, consistent contribution over time, not short-term or symbolic involvement.

The new approach lowers the barrier to join “the hard way” while phasing out representatives as the sole entry path. Representatives were meant to support the team for a year, but the role often attracted badge-seekers rather than committed contributors. The new system emphasizes duty over accomplishment, and non-emeritus members who don’t meet consistent expectations will be removed.

To support this shift, the Test Team is launching a four-week Training Program starting in January 2026. It covers handbook development, collaboration, testing fundamentals, and meeting management. Participants need to invest at least 20 hours (two-hour live sessions plus three hours of weekly practice). Graduating doesn’t guarantee a team spot, but it provides clear guidance on how to get there. The program is capped at five participants, selected by technical skill level if demand exceeds capacity.

• Key takeaway: The Test Team is prioritizing active, long-term contributors over short-term participation.
• Sign up: Live sessions start January 8 or 15, held around 3–4 PM GMT on Tuesdays and Thursdays.

This restructuring aims to build a more sustainable, engaged team that can handle WordPress testing at scale.

Read from the Official Make WordPress Blog here.

---

A Deep Dive Into WordPress Security: From Foundations to Hardening

Tài Hoàng published a comprehensive handbook on WordPress security, covering everything from the platform’s layered security model to actionable hardening techniques. The guide emphasizes that WordPress itself isn’t insecure, 96% of vulnerabilities in 2025 were found in plugins and themes, not core. The real problem is mismanagement: outdated plugins, weak server configs, poor passwords, and neglected maintenance.

The security model visualizes WordPress as four layers: server/infrastructure (foundation), WordPress core (application), plugins/themes (extension), and edge/network (CDN/WAF like Cloudflare). Each layer reinforces the others, but a failure in one—like a vulnerable plugin—weakens the whole system.

Best practices include choosing a reliable VPS host, reducing your attack surface by keeping your plugin stack lean, controlling access with proper file permissions and 2FA, disabling unnecessary features (XML-RPC, file editor, WP-Cron), and building a long-term security culture with regular audits and documentation. The handbook also covers practical steps like hiding PHP and Nginx versions, blocking direct IP access to bypass Cloudflare, securing wp-config.php, changing the default login URL, limiting login attempts, and using Nginx rules to block malicious requests.

Key tools mentioned:

• Admin and Site Enhancements (ASE) plugin for login URL changes and login attempt limits
• Two-Factor plugin for 2FA
• UpdraftPlus for backups following the 3-2-1 rule (three copies, two media types, one offsite)
• Key takeaway: Security isn’t a plugin you install, it’s a discipline. Harden every layer, from server to edge, and maintain it consistently.

Read the Full Guide here.

This guide is a must-read for anyone serious about keeping their WordPress sites secure in 2026 and beyond.

---

WordPress Must Read

→ From installation to integration: Making plugins “agent-ready” (joost.blog)

→ When a WordPress Site Needs a Rehab Instead of a Full Redesign (speckyboy.com)

→ Automattic AI, 2025 (j.cv)

Share

---

On other WordPress News

→ WordPress 7.0 Call for Volunteers (make.wordpress.org)

→ Plugin teams’ eviews are not AI generated (reddit.com)

→ Introducing new Themes Team representatives for the 2026 (make.wordpress.org)

→ WordPress Vulnerability Report — December 31, 2025 (solidwp.com)

→ WP Engine Acquires Big Bite (wp-content.co)

→ Seahawk Media Partners with Patchstack to Strengthen WordPress Security (patchstack.com)

---

From WordPress Community

→ Support Inclusion in Tech (SiNC) Opens Applications for 2026 WordPress Contributor Funding Program (wp-content.co)

→ Matt 4.2 (ma.tt)

→ My 2025 recap (by the Numbers) (pootlepress.com)

→ On Being Vegetarian (sunitarai.com.np)

→ 2025 year in review & transparency report (barn2.com)

→ 2025: My Year in Review (elliotsowersby.com)

→ Wombat Plugins 2025 Year in Review (studiowombat.com)

---

Conclusion

That’s a wrap for this edition of WPMore. Whether you’re upgrading PHP, rethinking your plugin strategy, or tightening security, there’s no shortage of work ahead, but the tools and knowledge are there to help you succeed.

Have thoughts on any of these stories? Hit reply and let me know. And if you found this useful, share it with a fellow WordPress user who could benefit. See you next time!

Nishat, WPMore

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

Major updates planned, contributor dashboard arriving, and why bot traffic matters for your site.

---

Hello WordPressers!

Welcome to this year’s final WPMore newsletter, issue 33, where you get curated news about WordPress and the WordPress community all in one place. I hope your holidays are going great and that your New Year’s plans are still intact.

WordPress is gearing up for a busy 2026. The project has announced three major releases timed with flagship WordCamps, launched a pilot dashboard to track contributor engagement, and shipped Gutenberg 22.3 with a dedicated Fonts page. Meanwhile, new data reveals how bot traffic and security practices are reshaping website performance across the globe. Here’s what you need to know.

Thanks for reading WPMore!! Subscribe for free to receive new posts and support my work.

---

WordPress In this Issue:

• WordPress 7.0, 7.1, and 7.2: Your 2026 Release Roadmap
• A New Dashboard to Track Contributor Journeys
• Gutenberg 22.3 Brings a Dedicated Fonts Page and Better Image Editing
• Bots Now Drive Up to 70% of Web Traffic (and Why That Matters)
• The WordPress Stories That Shaped 2025

---

WordPress 7.0, 7.1, and 7.2: Your 2026 Release Roadmap

WordPress is returning to a three-releases-per-year cadence in 2026, with each major version launching during a flagship WordCamp event. WordPress 7.0 is scheduled for April 9th during WordCamp Asia, 7.1 lands August 19th at WordCamp US, and 7.2 wraps up the year around December 8–10th during State of the Word.

The four-month spacing gives contributors enough time to build quality features while encouraging iterative shipping over chasing perfection. It also creates unique teaching opportunities; newer contributors can watch or even help with live releases at WordCamps, learning the process firsthand.

A few practical notes: you don’t need to attend in person to be involved, all coordination happens in Slack, and the 7.0 Release Squad call for volunteers goes out the week of January 4th. The dates may shift slightly based on community feedback, but the overall rhythm is set.

This schedule also leaves room for minor releases between major ones, giving teams breathing space to deliver improvements with confidence.

Read the official Make WordPress blogpost here.

---

A New Dashboard to Track Contributor Journeys

WordPress is piloting a Contributor Dashboard to map how people join, participate, and grow across Make teams. The dashboard uses a five-stage ladder – Connect, Contribute, Engage, Perform, Lead- to describe participation patterns without ranking contributors or suggesting that some work matters more than others.

The goal is simple: help teams understand engagement, spot where support is needed, and improve the contributor experience over time. Right now, contribution activity is scattered across many tools, and non-code work often lacks visibility. This pilot aims to change that.

The dashboard will launch at the end of February 2026 with a limited multi-team pilot. It uses a custom plugin to map existing activity from WordPress.org systems to ladder stages, so it won’t require new infrastructure or place new demands on contributors. It also respects privacy—no personal or sensitive information gets displayed.

If you’re interested in helping test or refine the dashboard, you can comment on the project thread or join the conversation in the #five-for-the-future Slack channel.

This work builds on years of community requests for better contributor recognition and visibility.

Read the official Make WordPress blogpost here.

---

Gutenberg 22.3 Brings a Dedicated Fonts Page and Better Image Editing

The latest Gutenberg release, 22.3, introduces a dedicated Fonts page under the Appearance menu for block themes. Until now, managing fonts meant digging through several panels inside Global Styles. The new page centralizes typography management, letting you browse, install, and preview fonts in one place. Support for classic themes is coming next.

The image cropper also got a rebuild. It works the same way, but now aspect ratios and zoom levels stay put when you rotate images – a small fix that clears up a long-standing frustration. This update also sets the stage for more image-editing improvements down the road.

Other highlights include email notifications for Notes (so collaborators get alerts when someone leaves feedback), alignment support for the Breadcrumbs block, and a responsive Grid block that adapts layouts across screen sizes. The editor also now shows clearer error messages when you lose connection.

• Fonts page simplifies typography management for block themes
• Image cropper improvements fix rotation issues
• Grid block now responds to different screen sizes automatically

These changes make everyday editing smoother without forcing you to rethink your workflow.

Read the official Make WordPress blogpost here.

---

Bots Now Drive Up to 70% of Web Traffic (and Why That Matters)

WP Engine’s 2025 Website Traffic Trends Report reveals that automated, non-human traffic now accounts for nearly one in three web requests globally. AI-driven bots consume up to 70% of the most resource-heavy operations like hosting and performance, turning traffic management into a financial priority. Unverified bot traffic is growing 76% worldwide, yet only 38% of sites use dedicated bot-mitigation tools.

Security practices now directly affect speed and cost. Sites that fully adopt HTTPS and proactive bot mitigation load 1–5 seconds faster in Largest Contentful Paint (LCP) than those using HTTP. Larger organizations show near-universal use of two-factor authentication and HTTPS, while smaller teams lag by about 25%.

Geography and mobile also matter more than ever. North America and Europe still post the strongest performance, while high-growth regions like Asia and Latin America are slowing down because traffic is rising faster than optimization efforts. About 50% of the top 10 million sites still don’t use a CDN, even though doing so improves LCP by roughly 20%. Mobile performance consistently trails desktop despite mobile being the dominant traffic source.

• Bot traffic now represents nearly 1 in 3 web requests
• HTTPS adoption improves LCP by 1–5 seconds
• 50% of top sites still lack a CDN, missing 20% performance gains

If your site feels slower or you’re seeing unusual traffic patterns, these trends might explain why.

Read the full report on WP Engine here.

---

The WordPress Stories That Shaped 2025

The Repository wrapped up the year by revisiting the most-read WordPress stories of 2025. The list reflects a year marked by conflict, but also by grassroots efforts to move the project forward. The top story was the abrupt shutdown of the WordPress Sustainability Team in January, which sparked backlash over how volunteer work was dismissed. Other highly read stories included the launch of the FAIR project to decentralize WordPress.org services, a class action lawsuit against Automattic over the WP Engine dispute, and Automattic’s layoffs affecting 16% of its workforce.

But 2025 wasn’t only about friction. Quieter developments like WordPress Campus Connect, WordPress Credits, and the launch of the WordPress AI Team showed contributors continuing to build, organize, and experiment despite the tension. One bright spot was Ollie’s Menu Designer being flagged for potential inclusion in WordPress core, with Automattic developers offering to help guide the work forward.

As 2026 begins, most people have moved on from the conflicts to focus on their work, teams, and businesses. Long-time contributors say they’re glad tensions have eased so they can contribute again, while new contributors are already getting involved through initiatives like Credits.

The year was messy, but it also showed that people keep showing up to build, even when things get hard.

Read the full report on The Repository here.

Don’t forget to subscribe & support them, they do some amazing, hard-hitting WordPress journalism.

---

On other WordPress News

→ WooCommerce 10.4.3: Dot Release (developer.woocommerce.com)

→ WordPress 6.9 Release Retrospective (make.wordpress.org)

→ WordPress 7.0 – What to Expect in 2026 (Current Situation and Possibilities) (fluentforms.com)

→ WooWeekly #579: Traffic Down, Community Up (wcwkly.com)

→ Introducing CSS Grid Lanes (webkit.org)

→ WordPress Vulnerability Report — December 24, 2025 (solidwp.com)

→ Bringing Back Women-Centric WordPress Events for International Women’s Day (make.wordpress.org)

→ WP Plugin Info Card 6.2.0 Released with WordPress.org Profile Badges and Screenshots Block Improvements (dlxplugins.com)

→ Plugin Check (PCP) got new update (wordpress.org)

---

From WordPress Community

→ SiteOrigin Page Builder is proof that steady progress can still win (X.com)

→ WordCamp Nepal 2026 is 24 days to go! The ticket is still available! (nepal.wordcamp.org)

→ Freemius 2025 Year in Review (freemius.com)

→ Lessons Learned, Course Building Edition (remkusdevries.com)

And just like that, the curtains fall on WordCamp Bhopal 2025

We came as developers, designers & creators—and leave as a stronger family. Because the best thing we build isn’t just websites or apps, it’s community🤍

Huge thanks to every attendee, speaker, volunteer & sponsor!! pic.twitter.com/tUFOL4lxr8

— WordPress Bhopal | (@wcbhopal) December 22, 2025

→ InfluenceWP December Journal (influencewp.com)

→ Etch Review: My Web Dev Journey from Angelfire, to WordPress to Etch. (youtube.com)

---

Conclusion

That’s the latest from WordPress as we head into 2026.

Whether you’re planning for new releases, tracking contributor growth, or just trying to keep your site fast and secure, there’s a lot to keep an eye on.

Got thoughts on any of these updates? Hit reply, we’d love to hear from you. And if you found this useful, share it with someone who’d appreciate it.

— Nishat, WPMore

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

Thanks for reading WPMore!! This post is public so feel free to share it.