Automattic’s board crisis explained, WordPress security survey 2026 results, agency profitability data, and why WooCommerce devs keep losing to their own to-do lists.
This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 57, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 68 WordPressers who joined us in the last 7 days! We are now 979!
I’m writing you this issue from wonderful country Nepal. I traveled last week to join WordPress Kathmandu and it’s now one of my top favorite WordCamp experiences!
WordPress had a full week. A security survey landed with numbers worth knowing. A data-backed piece on agency profitability settled an old argument. Building plugins isn’t the hard part anymore. Selling them is. And Automattic’s boardroom imploded, with four departures, a golden parachute, and employees reading about it in TechCrunch.
In this Issue:
- WooCommerce Plugin Devs Have a Marketing Problem
- WordPress Security in 2026: The Numbers Are Not Reassuring
- What Separates Profitable WordPress Agencies From the Rest
- Automattic’s Board Crisis: What Really Happened
- WordPress Must Read
- On Other WordPress News
- From WordPress Community
WooCommerce Plugin Devs Have a Marketing Problem
AI has made shipping a WooCommerce plugin faster than ever. Building used to be the bottleneck. Now it’s getting people to buy.
Most WooCommerce developers aren’t bad at marketing, they just never get to it. The demo video has been on the to-do list for months. The outreach email is always next week. The real blocker is motivation, not skill. Free advice and free courses haven’t changed that.
Rodolfo Melogli’s answer is Save The Plugin: twenty marketing tasks across four weeks, inside a private Slack group with him directly involved. Finish all 20 and you get a reward worth $400 to $500. The sprint costs $297 for the first 10 seats and starts October 5, 2026.
Read the full blog on Business Bloomer →
Next: a security survey that puts a number on how unprepared most WordPress sites actually are.
WordPress Security in 2026: The Numbers Are Not Reassuring
Melapress surveyed 319 WordPress professionals for their annual security report. The gap between concern and preparation has barely moved.
Security concern averaged 7.85 out of 10, nearly identical to 2025’s 7.8. Yet only 27.9% have a breach recovery plan in place, and just 26% have team security training. Both figures are unchanged from last year.
67.7% of respondents have experienced at least one known security incident. Website downtime hit 68.4% of those who did. 42.6% of incident victims only found out when someone noticed something looked wrong on the site. Only 38.4% were alerted by logs or monitoring first.
When a search engine flagged the problem before the site owner did, outcomes were significantly worse: 45.9% of those incidents involved a loss of search rankings.
Read the full blog on Melapress →
Now, a word from our sponsor. Start building your WordPress WooCommerce store sites using AI chat!
Brought to you by GoDaddy
Setting Up a WooCommerce Store Used To Take Hours. Airo Does It Through a Chat.
WooCommerce setup has always had a learning curve. Install the plugin, configure the pages, set up payments, add products, write descriptions; most of it is buried in menus that aren’t obvious the first time through.
GoDaddy’s Airo for WordPress handles the initial WooCommerce setup through a chat conversation. Tell it you want a store, it installs WooCommerce, creates the core pages and generates product descriptions. It’s not fully hands-off, product category assignment still needs manual input and you’ll want to review the copy. But the foundation that used to take a couple of hours comes together in minutes.
GoDaddy has more WooCommerce features on the roadmap: deeper order management, product imports and broader store operations through Airo. Worth watching if WooCommerce is part of the stack.
What Separates Profitable WordPress Agencies From the Rest
GravityKit analyzed two major 2026 surveys of 832 WordPress agencies. Profitability has almost nothing to do with how long you have been running. It comes down to what you charge and whether revenue recurs.
Agencies charging $5,000 or more per project are consistently profitable 57% of the time. Below that, only 33% are. The most common price band sits at $2,500 to $4,999, just under where things change.
Recurring revenue also matters. Agencies with at least 25% of income on retainers or care plans jump from 30% to 47% consistent profitability. Going further than 25% barely moves the needle.
Meet both conditions and profitability hits 60.3%. With neither, it’s 22.6%. A five-year agency charging $5,000 outperforms a sixteen-year veteran who doesn’t.
Read the full blog on GravityKit →
The biggest WordPress story of the week has nothing to do with code.
Automattic’s Board Crisis: What Really Happened
On September 9, Automattic’s board placed Matt Mullenweg on paid leave and installed CFO Mark Davies as interim CEO. Thirty-three hours and 20 minutes later, Mullenweg posted in company Slack he was back, linking to LL Cool J’s “Mama Said Knock You Out.” He then published a blog post about buying a houseboat.
Four people are out. CFO Mark Davies, CLO Andy Missan, and board members Toni Schneider and Sue Decker all departed. Leaked documents revealed Davies and Missan signed reciprocal severance agreements during the 33-hour window, totaling $8.15 million.
Employees learned everything from press coverage. A week later, staff still had no official explanation. Automattic also retained Susman Godfrey, known for the $787.5 million Fox News settlement, for the WP Engine case. A court hearing is scheduled for September 30.
Read the full report on The Repository →
WordPress Must Read
→ Sources say Automattic’s board is out after failed attempt to oust CEO Matt Mullenweg (techcrunch.com) – TechCrunch’s sourced breakdown of the board ousting attempt, the departures, and how Mullenweg regained control.
→ Ideas for WordPress in an agentic world (apeatling.com) – What should WordPress look like when AI agents become the primary interface? This piece sketches out some concrete answers.
→ AI SEO Myths and Facts (kb.theseoframework.com) – No jargon, no hype. Just what AI actually changes about SEO and what you can ignore.
→ Preparing an Established Freemium Plugin for Modern WordPress.org Review (abulkhoyer.com) – A practical first-person account of what it takes to get a mature freemium plugin ready for today’s WordPress.org review standards.
On other WordPress News
→ WooCommerce 11.1.1 Release Notes (developer.woocommerce.com) – Patch release notes covering the latest fixes shipped in WooCommerce 11.1.1.
→ Proposal: Identifying WPCC Participants through WordPress.org Profiles (make.wordpress.org) – A proposal to make WordPress community contributor recognition visible directly on WordPress.org profiles.
→ WordPress 7.1.1 Maintenance and Security Release (wordpress.org) – The official release post for WordPress 7.1.1, covering what was patched and why you should update.
→ The AI-Powered WordPress course is now live on Learn WordPress! (make.wordpress.org) – The WordPress training team has published a new AI-focused course on Learn WordPress.
→ AI Contributor Weekly Summary – 16 September 2026 (make.wordpress.org) – A weekly roundup of what the WordPress AI contributor group has been working on.
→ Call for testing: Purple, a WooCommerce block theme (developer.woocommerce.com) – WooCommerce is reviving Purple, a block theme previously shelved, and wants community testing feedback.
→ Introducing Ipsum, the new default theme (make.wordpress.org) – The core team introduces Ipsum, the proposed next WordPress default theme, ending the sixteen-year Twenty- naming convention.
→ What’s new in Gutenberg 24.0? (16 September) (make.wordpress.org) – The full changelog for Gutenberg 24.0, covering new block features, editor improvements, and contributor updates.
→ WordPress 7.1.1 Ships 11 Security Fixes, Credits Anthropic and pwn.ai Again (therepository.email) – The Repository’s detailed look at what the 11 security fixes in 7.1.1 actually addressed.
→ Explore the WordPress Playground Terminal with the new Dev Tools Dock (make.wordpress.org) – WordPress Playground gets a new Dev Tools Dock giving developers terminal access directly in the browser.
→ Call for testing: DataForm editor inspector (make.wordpress.org) – The core team is asking for community testing on the new DataForm editor inspector before it ships.
→ A Note on Figma access (make.wordpress.org) – The WordPress design team shares an update on how Figma access is being managed across contributors.
→ Events in the US and Canada: the plan through 2027 (make.wordpress.org) – The community team lays out the WordPress events roadmap for North America through the end of 2027.
From WordPress Community
→ WP Shipyard (wpshipyard.com) – Austin Ginder launched WP Shipyard, a tool that lets site administrators browse their site in a different installed theme while visitors keep seeing the live one. Handy for previewing a new theme without spinning up a full sandbox.
→ WPAcquire (wpacquire.com) – Cagdas Dag launched WPAcquire, a marketplace to buy and sell WordPress businesses. Plugin listings are free; paid members can browse and contact sellers directly.
→ WP Suomi Full Schedule (wpsuomi.fi) – WP Suomi, the independent Nordic WordPress conference, has published its full schedule for October 16 in Oulu, Finland.
→ Portuguese Community to Host First WordPress Event Dedicated Entirely to AI (therepository.email) – The Portuguese WordPress community is organizing a first-of-its-kind event focused entirely on AI and its impact on WordPress.
→ How GatherPress Grew From a Road Trip Idea to WordPress’ Meetup.com Replacement (therepository.email) – The origin story behind GatherPress, now positioned as the open-source replacement for WordPress meetup management.
→ New Proposal Targets 20+ WordPress Events Across North America in 2027 (therepository.email) – A new proposal outlines a flexible, menu-style approach to running 20+ WordPress events across North America in 2027.
→ ‘Ipsum’ Proposed as Next WordPress Default Theme, Ending 16 Years of the Twenty- Naming Convention (therepository.email) – The Repository’s coverage of the Ipsum default theme proposal and what it means for the long-running Twenty-* tradition.
→ Back in WordPress core (fullstackleader.blog) – A personal account from a developer returning to WordPress core contribution.
→ Day one at Pantheon: good docs, good company (courtneyr.dev) – Courtney Robertson shares her first-day experience joining Pantheon, with notes on onboarding and documentation culture.
→ How GoDaddy’s Airo Handles WooCommerce Store Setup Through Conversation (godaddy.com) – Airo installs WooCommerce, creates core store pages and generates product descriptions from a single prompt; with deeper store management on the roadmap.*
*Sponsored
Until Next Week
Automattic’s board tried to remove its founder. The attempt lasted 33 hours and 20 minutes, cost at least $8.15 million in severance, and left employees learning the details from TechCrunch. What does that kind of internal communication breakdown cost a company in the longer run? And with a WP Engine court hearing on September 30, is the drama actually behind us?
Hit reply with your take. If this issue was useful, pass it along.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply