Category: Newsletter

---

With 7 security fixes landed, update your WordPress right now. Checkout Summit numbers, plugin pricing, AI dev jobs, and Automattic’s new board.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 59, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 47 WordPressers who joined us in the last 7 days! We are now 1071! Hip Hip Hurray!!!

WordPress 7.1.3 fixes seven security issues, so update your sites before anything else. After that, a first-time conference organizer shares his real numbers, a plugin developer explains why the old pricing playbook is failing, and Remkus de Vries asks developers to rethink their job description. We finish with the people Matt Mullenweg picked for Automattic’s new board.

---

In this Issue:

• WordPress 7.1.3 Patches Seven Security Flaws
• Checkout Summit Drew 101 People and Plans a 2027 Return
• Plugin Pricing Can’t Work Like a Car Lot Anymore
• Remkus de Vries Tells WordPress Developers to Learn Agents
• Automattic’s New Board Leans on Mullenweg’s Longtime Ties
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WordPress 7.1.3 Patches Seven Security Flaws

WordPress 7.1.3 landed on October 6 with 7 security fixes and 4 bug fixes, and Jake Spurlock led the release. Because it is a security release, WordPress recommends updating your sites right away.

The fixes cover a stored XSS on the Comments admin page, a second-order SQL injection in WXR export, unauthenticated disclosure of comments on private and unpublished posts, and XSS in Imgur embeds. Anthropic reported three of the seven. The rest came from Trail of Bits, Patchstack, three researchers who found the Imgur issue, and a member of the WordPress security team.

Update from the Dashboard under Updates, or download 7.1.3 from WordPress.org. Sites with automatic background updates will start on their own. The fixes are also being backported to every branch that gets security fixes, currently back to 4.7, though only the latest version is actively supported.

Read the full blog on WordPress.org →

Next, a first-time conference organizer opens his books.

---

Checkout Summit Drew 101 People and Plans a 2027 Return

Rodolfo Melogli wanted WooCommerce developers to have a conference of their own, and in April 2026 101 people showed up in Sicily, with another 107 joining online a couple of weeks later for Reloaded. His goal for the in-person event was 150.

He points to two problems. Flights were disrupted by conflicts in the Middle East, and agencies and WordPress companies cut budgets and stopped sending people to events. Sponsors were slow too. WooCommerce took the headline spot and two companies took booths, but many other promises never turned into payments. A group of Founding Contributors filled the gap, and the event turned a small profit.

His fix list includes starting sponsor talks earlier, not organizing alone, and adding workshops and more networking. Tickets for the April 2027 edition in Palermo are on sale now.

Read the full blog on Checkout Summit →

The next story asks why plugin buyers have stopped haggling.

---

---

Plugin Pricing Can’t Work Like a Car Lot Anymore

Russell Aaron says plugin pricing used to work like a car lot. Buyers installed the free version, came back months later for Pro, and waited for a sale. Buyers now give you about ten minutes after activation, and if the plugin fails on first install, they ask for a refund and never return.

AI changes the math too. People paste a sales page into Claude or ChatGPT and ask whether they can build it themselves. A reading-time counter that costs $49 a year can become a snippet in ten minutes. A plugin listed at $500 that drops to $199 every Black Friday teaches buyers to learn the calendar and wait.

His advice is to sell what people need, make it work on first install, build what an AI chat cannot copy, and price it as you would want to pay for it.

Read the full blog on Russell Envy →

Pricing is one place AI is changing the work, and Remkus de Vries thinks developers should change with it.

---

Remkus de Vries Tells WordPress Developers to Learn Agents

Remkus de Vries has worked in WordPress for more than 20 years, and he says your experience has not expired, but your job description has to change. WordPress already has the Abilities API and an incoming MCP Adapter, and plugins like Albert and Novamira connect AI assistants to live sites.

Many developers read each AI announcement, save it for later, and keep building the same way. He points to David Heinemeier Hansson, who described 37signals going “pencils down” on handwritten code at Rails World 2026.

He suggests giving an agent a complete task in a project where you can experiment, defining the behavior, supplying context, and reviewing the result until you understand it. If your work week has no room for this, invest a bounded amount of time outside it. He also wants developers to use agents on problems they could never justify before.

Read the full blog on Remkus de Vries →

Finally, Automattic’s board changed again, and the new names have a lot in common.

---

Automattic’s New Board Leans on Mullenweg’s Longtime Ties

Automattic’s new board is made up largely of people with long-standing personal ties to CEO Matt Mullenweg. The directors are author Hugh Howey, relationship expert Amy Chan, and Henry Khachatryan and Krutal Desai, co-founders of the defunct social app IRL. Desai is the only one who worked at Automattic, as Head of Special Projects from January 2012 to September 2020.

Jaime Waydo, Matt Van Horn, and Stephen Wolfram serve as advisors, and Hiten Shah takes on an expanded role. IRL shut down in June 2023 after its board found that 95% of users were automated or bots, and the SEC later charged founder Abraham Shafi with fraud. Neither Khachatryan nor Desai has been accused of wrongdoing.

An Automattic spokesperson did not say whether the board is complete or what happens to two former executives’ severance agreements. The board page still lists three old directors.

Read the full report on The Repository →

---

WordPress Must Read

→ ChatGPT ads don’t work yet. Here’s the proof (barn2.com) – Katie Keith shares what Barn2 got from $477 in ChatGPT ads over six weeks: 370 clicks, zero conversions, and no revenue. The ads ran 19,154 impressions, far more than the 1,370 US searches for related terms, and ad visitors stayed 37 seconds compared with 443 for people who followed links in ChatGPT answers.

→ For Love or Money: Open Source’s Labor Law Problem (sereed.media) – Sé Reed asks whether open source contributors still count as volunteers when their work is scheduled, directed, and benefits a single for-profit company. She walks through how the Fair Labor Standards Act treats volunteering and says she is not a lawyer or making claims about any entity.

→ Bringing WordPress AI to the Market (briancoords.com) – Brian Coords argues WordPress needs a Core Abilities feature plugin, a more discoverable MCP, and AI landing pages on WordPress.org. He treats it as a go-to-market question and favors outside-in agent access over more AI features in the dashboard.

→ WordPress plugins: should a PRO add-on auto-install its free version? (blog.wonderm00n.com) – Marco Almeida found a core bug where the upload screen offers an Activate button for a PRO add-on, then WordPress blocks it with an error page when the free plugin is missing. He weighs auto-installing the free plugin but keeps the Requires Plugins header for now, citing zero support tickets.

→ WP Engine v. Automattic, Two Years On: Where the WordPress Drama Stands (therepository.email) – Rae Morey recaps the case since the September 2024 keynote and the 8% royalty demand, about $32 million a year on WP Engine’s roughly $400 million in revenue. It covers the revived antitrust claims, the sanctions fight over Mullenweg’s messages, and a jury trial still set for October 19, 2027.

→ Meet the Female Lead WordCamp Organizers Shaping 2027 WordCamps (mumtahinafaguni.com) – Faguni introduces the women leading five 2027 WordCamps in Asia: Nepal in Nepalgunj, Kolkata, Mumbai, Pune, and Kathmandu. Pune is scheduled for February 6 to 7 and Mumbai for February 13.

→ Spacefast: Automattic’s New Static Hosting (Cloudflare/Vercel Alternative?) (youtube.com)

---

On Other WordPress News

→ Presence API: What’s new (make.wordpress.org) – The Presence API feature plugin is at version 0.14.0 and now shows who is online across a whole multisite network. Post locks moved into the presence table, and AI agents editing over REST or MCP appear with an Agent badge.

→ Heads up: HelpScout to FreeScout Migration (make.wordpress.org) – WordPress.org is moving about 20 mailboxes and 86 accounts from HelpScout to a self-hosted FreeScout after HelpScout shifted from contact-based to user-based pricing. Photos and Jobs go first, and Plugins is last, with phase five planned for October 19.

→ Month in Test: October 05, 2026 (make.wordpress.org) – The Test Team’s roundup lists 19 tickets with patches that need testers and 128 that need bug reproduction. It also says the Test Handbook is now synced with GitHub.

→ Training Team Update – October 4th, 2026 (make.wordpress.org) – Learn WordPress DACH finished its first German-language course cohort, “Starten mit WordPress,” across seven weeks and seven live sessions. A new course on AI literacy through WordPress is also live.

→ Proposal: Minor updates to the WordPress Core CSS Coding Standards (make.wordpress.org) – Andrea Fercia proposes small changes needed to bring Stylelint into Core, including one blank line between sections and blocks and avoiding the order property and reverse values for accessibility. Comments stay open for one week.

→ Accessibility-ready directory changes coming! (make.wordpress.org) – The accessibility-ready tag in the theme directory is becoming conditional. No themes will be delisted, adding the tag will not delay approval, and themes that miss the guidelines can have the tag removed.

→ What’s new in Gutenberg 24.1? (30 September) (make.wordpress.org) – The release focuses on design tool consistency, with about 140 PRs adding background, shadow, color, and typography controls to core blocks. It also adds a text shadow panel in Global Styles and media selection in the Cover and Media & Text blocks.

→ Test Scrub Schedule for WordPress 7.2 (make.wordpress.org) – With 7.2 targeted for December 8, 2026, Test Scrubs on 7.2 milestone tickets will run on the 2nd and 4th Thursday of each month at 3:00 PM UTC, in place of patch testing sessions.

→ Themes team update September 29, 2026 (make.wordpress.org) – The Themes team had 98 new tickets waiting for review and closed 609 tickets in a week, with 56 new themes and 517 updates going live. Twelve reviewers handled the queue.

→ Documentation Team Update – October 5, 2026 (make.wordpress.org) – The Documentation team has 479 open issues and 1,822 closed ones, and it closed 87 issues in the past month. It also introduced a new meeting schedule that mixes Slack chats and video calls.

→ Plugins Team: 5 Oct 2026 (make.wordpress.org) – The plugin review queue holds 4,611 plugins. The team approved 915 plugins, rejected 300, and closed 150 while 1,119 were requested.

→ Who is “anyone” who can organize meetup? (make.wordpress.org) – Mayo Moriyama of Tokyo WordPress Meetup points out that three handbook pages seem to contradict each other on who can organize a Meetup. The Community Team’s answer is that any member can run an event but should coordinate with the co-organizers, who confirm the organizer is trustworthy.

→ Increased security on Hosting team repositories (make.wordpress.org) – After spammy pull requests and premature merges, Hosting team repositories now require two approvals, resolved change requests, re-review of new pushes, and passing tests. New GitHub accounts also wait 24 hours before they can interact.

→ Automattic has a new board after failed attempt to put CEO on leave (techcrunch.com) – Sarah Perez reports that the new board includes Hugh Howey, Amy Chan, and IRL co-founders Henry Khachatryan and Krutal Desai. Mullenweg confirmed the appointments and said the next six months will shape the next 20 years of Automattic.

→ Test WordPress emails in Playground with the new Email tool (make.wordpress.org) – Playground’s new Dev Tools → Email panel captures messages sent through wp_mail() so you can inspect the recipient, subject, and body without a mail server. Captured emails clear on reload, and the tool does not prove delivery.

→ Update on the WordPress community groups on events.wordpress.org (make.wordpress.org) – About 700 meetup groups are moving off Meetup.com to events.wordpress.org, built on GatherPress. A migration tool will import upcoming events as drafts but not member lists, so members will need WordPress.org accounts to join.

→ Call for feedback: Real-time Collaboration (RTC) server-aware approach (make.wordpress.org) – Hosts are asked to test three server-aware sync engine candidates, Yjs-server, Distributed Editing, and Intent log, with a focus on performance. RTC was removed from WordPress 7.0, and host feedback will shape its direction.

→ WP A11y docs update September 2026 (make.wordpress.org) – The update adds docs on tables, color contrast for text and non-text content, and infinite scroll. The Accessibility Team Handbook is also moving to GitHub so more people can contribute.

→ The Experimental WooCommerce Dual API is now a plugin (developer.woocommerce.com) – WooCommerce 11.2 removes the experimental Dual API engine from core and offers it as a separate plugin that requires WooCommerce 11.2 and PHP 8.1. The proof-of-concept products and coupons API is removed, and the feature stays experimental.

→ WordPress 7.2 Roadmap Includes New Security Features, Suggestion Mode for Notes, and Ipsum Default Theme (therepository.email) – Notes gets suggestion mode and emoji reactions, and the security work includes a Secrets API, early sudo mode work, and hardened Application Passwords. Real-time collaboration is deliberately left off, and Beta 1 is expected between October 20 and 22.

---

From WordPress Community

→ Quill: Native WordPress App for macOS (quill.siolon.com) – Quill is a free native Mac app by Chris Poteet for writing and publishing to a self-hosted WordPress site. It supports offline local drafts and a media library, plus an optional Claude-powered writing assistant that needs your own Anthropic API key.

→ Alright Our Kid? – WordCamp Manchester 2026 (manchester.wordcamp.org) – WordCamp Manchester returns for the first time since 2018, on November 6, 2026, at Whitworth Locke. It is a barcamp-style day with no traditional talks or sponsors and a surprise keynote in the morning.

→ 1 billion downloads: The people and stories behind Yoast SEO (yoast.com) – Yoast marks one billion downloads with user stories, including a Montreal agency that has installed Yoast by default for clients for more than a decade. The post also says AI tools surfaced the same themes users named: easier SEO, helpful guidance, and handling technical work.

→ Jill Binder Launches Tech Differently, a Speaker Accelerator and Conference for People Who Build Differently (therepository.email) – Tech Differently is an online conference on October 27 where speakers from a six-month accelerator present their talks. Regular tickets cost $19, rising to $27 from October 15, and a $5 community tier stays available.

→ How do we get Agents to use WordPress (youtube.com)

→ I’m turning our most popular plugin into a chat plugin (ciorici.com) – Pavel Ciorici says Social Icons Widget fell from about 135,000 installs in June 2025 to just under 100,000, and its Pro version made about $8,900 from 223 sales in four years. He is turning it into WPZOOM Connect, a chat plugin that leads to his Yamidoo AI chat service.

→ Call for WordCamp Asia 2027 Wapuu Submissions Now Open! (asia.wordcamp.org) – WordCamp Asia 2027 runs April 9 to 11 in Penang, Malaysia, and the Wapuu design call is open until December 8, 2026, at 23:59 (UTC+8). Professional illustrators and first-time designers can both submit.

→ Aditya Shah receives the Yoast Care fund for his contributions to the WordPress community. (yoast.com) – Aditya Shah leads the WordPress Bhopal community, now in its 11th year, and was nominated by Kripesh Adwani. He works at WPMU DEV as a Hosting Support Manager and DevOps Engineer.

→ Black Friday Has Changed. Has Your WooCommerce Strategy? (youtube.com)

→ Hidden Multipliers: The New Book for Every WordPress Business Owner (publishpress.com) – On the PublishPress Podcast, Jason Cohen, who built WP Engine, talks with Steve Burge about his new book on pricing, customer research, and profitability. He explains his pricing framework of more for more, less for less, and more for less, plus the “profit whale” idea.

---

Until Next Week

Three of the seven security fixes in WordPress 7.1.3 came from reports by Anthropic. Have you updated your sites yet? And how do you feel about AI labs reporting bugs in WordPress core?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Update to WordPress 7.1.2 now. Plus the WordPress 7.2 roadmap, AI agents and WordPress, a plugin developer trust checklist, and the WP Engine antitrust ruling.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 58, where you get curated news about WordPress and the WordPress community all in one place.

Hi5 to the 45 WordPressers who joined us in the last 7 days! We are now 1024! Hip Hip Hurray!!!

A critical security fix shipped, the WordPress 7.2 roadmap is out, and a federal judge put WP Engine’s antitrust claims against Automattic back on the table. We also look at how WordPress could welcome AI agents and what plugin developers can do to earn a cautious buyer’s trust.

---

In this Issue:

• WordPress 7.1.2 Patches a Critical Security Vulnerability
• The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List
• Should WordPress Open the Door for AI Agents?
• A Trust Checklist for WordPress Plugin Developers
• WP Engine’s Antitrust Claims Against Automattic Are Back On
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WordPress 7.1.2 Patches a Critical Security Vulnerability

WordPress 7.1.2 is a security-only release, and it fixes one critical vulnerability. John Blackbourn led the release, which shipped on September 22.

The bug lets an unauthenticated attacker, under certain conditions, make page template resolution include a chosen readable local PHP file from outside the active theme directories. If the server environment and the active theme meet the right pre-conditions, that can lead to remote code execution. Robert Ressl reported it responsibly, and the advisory is tracked as CVE-2026-87902.

WordPress recommends updating your sites immediately, either from the Dashboard under Updates or by downloading 7.1.2 from WordPress.org. Sites with automatic background updates will start the process on their own. The fix was also backported to every branch eligible for security fixes, currently back to 4.7. Only the latest WordPress version is actively supported, so an older site is worth a look this week.

Read the full blog on WordPress.org →

Once your sites are patched, the next question is where WordPress is heading.

---

The WordPress 7.2 Roadmap Puts Notes Suggestions, Sudo Mode, and Ipsum on the List

WordPress 7.2 is planned for early December 2026, and the roadmap is out. Notes gets a suggestion mode, so you can leave edits for others to accept or reject, plus emoji reactions.

The security list includes a “sudo mode” that asks you to re-authenticate before sensitive actions, a Secrets API for storing credentials safely, and hardening for Application Passwords. Sudo mode is still at the early-work stage.

For site builders, you can style form elements in Global Styles, and two blocks are coming: Description List and the Table of Contents block. Admin icons move from dashicons to SVGs, and error messages get clearer wording with a copy button. A new default theme called Ipsum is a minimal blank canvas.

Collaborative editing is not on the 7.2 list. The post also says these items are being actively pursued but may not all make the final release.

Read the full blog on Make WordPress Core →

Beyond the release itself, one writer wants WordPress to prepare for a new kind of visitor.

---

Should WordPress Open the Door for AI Agents?

Nick at Teddy argues that WordPress already has what agents need: structured block content, a REST API, feeds, and metadata. It needs to present them more clearly.

He proposes serving Markdown when a client sends the Accept: text/markdown header, and offering a .md version for clients that don’t. In Checkly’s tests, three of seven agents sent that header: Claude Code, Cursor, and OpenCode. He also suggests a small read-only public menu at a predictable address like /.well-known/wordpress, listing the search route and the site’s stated AI policy.

Reading a public post should never quietly grant permission to change one. He points out that robots.txt is a request to crawlers, not authorization, and that llms.txt belongs last on the list. Ahrefs found that 97% of the files it observed got no requests in the month it measured.

Read the full blog on Teddy →

Trust matters for plugin authors too, and one guide lays out how to earn it.

---

A Trust Checklist for WordPress Plugin Developers

David McCan at WebTNG turns what cautious buyers look for into a checklist for plugin developers. It covers three areas.

In the Plugin Directory, keep the “tested up to” field recent, answer support threads (the negative ones too), reply politely to critical reviews, and keep an honest changelog that mentions security fixes. WordPress.org now lets you update “Tested up to” without releasing a new version.

On your own site, show who you are, be plain about where your company operates, and write real privacy and terms pages. Spell out pricing, renewals, and licensing. He recommends a clear refund window, with 14 or 30 days being typical, and a published vulnerability disclosure policy.

Most items are a few hours of work, and they mean fewer refund requests and fewer one-star reviews. Over time, join the community, show which feedback you acted on, and avoid overpromising.

Read the full blog on WebTNG →

Finally, the WP Engine case just changed direction.

---

WP Engine’s Antitrust Claims Against Automattic Are Back On

A federal judge has reversed course on WP Engine’s antitrust claims against Automattic. In a 17-page order, U.S. District Judge Araceli Martínez-Olguín revived four counts against Automattic and Matt Mullenweg: monopolization, attempted monopolization, and two illegal tying claims. The same judge dismissed them in September 2025.

The turn followed an August 13 Ninth Circuit ruling in an unrelated surgical-robot repair case, which undercut Automattic’s central argument. The court also pointed to allegations that Automattic demanded fees for access that used to be free, and tied WordPress.org login to a checkbox denying any affiliation with WP Engine.

Successful federal antitrust plaintiffs are entitled to triple damages plus attorneys’ fees. WP Engine’s extortion claim was dismissed for good, and its attempt to toss Automattic’s counterclaims mostly failed. Summary judgment motions are due November 20, with a 10-day jury trial set for October 19, 2027.

Read the full report on The Repository →

---

---

WordPress Must Read

→ WordPress Takes Its Turn Leading the Open Website Alliance (wordpress.org) – Mary Hubbard became president of the Open Website Alliance on September 21, 2026, representing the WordPress Foundation. The role rotates among the alliance’s members, which also include the Drupal, Joomla!, and TYPO3 communities.

→ AI Agents for WordPress: What Helps and What Still Fails (abulkhoyer.com) – A Tourfic booking bug fix shows agents do well with clear goals and access to code, WP-CLI, browser tools, and MCP, with 31 regression scripts passing. They still fail when goals are vague, when they edit generated code without updating the source, or when they skip testing plugin combinations.

→ Zero clean: 72 WooCommerce stores (merchlint.com) – Merchlint’s 2026 WooCommerce report, which looked at 72 stores under the headline “Zero clean.”

→ Five ways Claude Code failed on a 240,000-line WordPress plugin (sleevesupai.com) – Five failures from using Claude Code on Easy Digital Downloads, including patching a symptom instead of the root cause, adding 25 lines when 3 were requested, and a test that bypassed the method it covered. The author’s five-question review caught all of them in under four minutes.

---

On Other WordPress News

→ Iterating from live events to livestreamed releases (make.wordpress.org) – WordPress releases move from in-person events to livestreamed Zoom webinars, starting with 7.2 in early December 2026. Release squad members and others involved can share without geographic barriers.

→ WooCommerce 11.1.2 Release Notes (developer.woocommerce.com) – Released September 22, it tightens validation on email-based product reviews and fixes a regression in rendering product variation galleries that could cause infinite recursion when themes call get_available_variations.

→ WordPress Contributor Toolkit 1.2: One app for your first Core or Gutenberg contribution (make.wordpress.org) – A desktop app that removes setup friction for first-time contributors. Version 1.2 adds a full Gutenberg workflow, from creating a site and linking a GitHub issue to applying pull requests and submitting changes without leaving the app.

→ WordPress Trac MCP server (make.wordpress.org) – A free, public MCP server that lets AI assistants like Claude and ChatGPT read tickets, changesets, and timeline history from WordPress.org Trac instances. It needs no authentication or API key.

→ Call for Media Partners for Wordcamp Asia 2027 (asia.wordcamp.org) – WordCamp Asia 2027 runs April 9 to 11 at the Penang Waterfront Convention Centre in Malaysia. Media partners get complimentary passes and media area access, and applications close November 24, 2026.

→ WooCommerce 11.2.0 Pre-release notes (developer.woocommerce.com) – The beta is ready for testing ahead of an October 6, 2026 release. Highlights include configurable withdrawal request emails, more block styling options, a CSV importer that matches products by GTIN, UPC, EAN, or ISBN, and date fields in the Additional Checkout Fields API.

→ Gutenberg’s JavaScript unit and integration tests now use Vitest (make.wordpress.org) – Gutenberg moves from Jest to Vitest for native ESM support and real-browser testing. @wordpress/scripts 36.0.0 makes Vitest the default, and Jest stays available through test-unit-jest with no removal date.

→ New public repo: core release tools (make.wordpress.org) – The public core-release-utils repo holds six CLI tools that automate release chores such as drafting HelpHub pages, generating SVN tag commands, verifying GitHub mirrors, and building contributor lists. Minor releases can touch 20+ branches, so the tools cut manual errors.

→ CVE-2026-87902: A working PoC for WordPress’s critical path traversal (hadrian.io) – A working proof of concept for CVE-2026-87902 uses a double-encoded traversal payload in the pagename parameter to escape the theme directory. It needs a published page and a page-templates directory in the active theme, and it scores 9.2 on CVSS.

→ WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE (patchstack.com) – The flaw affects versions 4.7.0 to 7.1.1 and comes from weak validation of the pagename query parameter. Exploitation needs a theme with a page- prefixed directory and PHP with register_argc_argv enabled, which is common in Docker and cPanel setups.

→ Moving to a server-aware approach for collaboration (make.wordpress.org) – Collaboration moves from browser-only syncing to a model where the server takes part. That lets WordPress record who made each edit, check permissions, and merge updates coming from REST API or CLI tools.

→ Dev Chat Agenda – September 23, 2026 (make.wordpress.org) – The September 23 agenda covers the new Ipsum default theme for 7.2, calls for testing on the DataForm editor inspector, the server-aware collaboration approach, and the recently completed 7.1.1 and 7.1.2 releases.

→ Luganda Translation Workshop at WordCamp Jinja 2026 (make.wordpress.org) – Eleven contributors, two of them newcomers, translated 156 strings and reviewed 43 while learning GlotPress tools. Moses Cursor was table lead for the Luganda Translation Team.

---

From WordPress Community

→ The Page Builder Summit will be back in November 2026 (pagebuildersummit.com) – Page Builder Summit 8.0 runs November 2 to 6, 2026, for designers, developers, and agency owners working across WordPress, Shopify, Squarespace, and AI platforms. Registration opens soon through a waiting list.

→ Auctioning off my WordPress release albums (nomad.blog) – Anne McCarthy is auctioning the framed WordPress release albums she received as a sponsored contributor since 2020. Bidding starts at $500 at release-auction.blog, and proceeds go to Stimpunks, which supports neurodivergent and disabled people.

→ PressConf EU: WordPress Needs to Stop Playing Defense (thewpminute.com) – Organizer Raquel explains why PressConf is coming to Barcelona for the first time, October 27 to 30. She says WordPress businesses face growing uncertainty and need deliberate choices, and the sessions will be unrecorded to keep talks candid.

→ WordCamp Kathmandu 2026 Recap: What We Saw, Learned & Loved (sitesaga.com) – The event drew over 350 attendees on Conference Day and 220+ on Contributor Day, with 17 speakers. The Photos team added 200+ images to the repository, and the Polyglots team recruited 360+ Nepali translators.

→ Meet Wapuu Sa: All Dressed Up for WordCamp Rajasthan (rajasthan.wordcamp.org) – The event mascot wears a colorful pagdi and traditional Rajasthani attire, with a decorated camel companion. WordCamp Rajasthan takes place October 3 to 4, 2026, in Jaipur.

---

Until Next Week

A judge who dismissed WP Engine’s antitrust claims in September 2025 has now revived four of them, and triple damages are possible. Did one Ninth Circuit ruling about surgical-robot repairs just change the shape of this case? And what will the September 30 sanctions hearing over Matt Mullenweg’s WhatsApp, Signal, and Telegram messages turn up?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Automattic’s board crisis explained, WordPress security survey 2026 results, agency profitability data, and why WooCommerce devs keep losing to their own to-do lists.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 57, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 68 WordPressers who joined us in the last 7 days! We are now 979!

I’m writing you this issue from wonderful country Nepal. I traveled last week to join WordPress Kathmandu and it’s now one of my top favorite WordCamp experiences!

WordPress had a full week. A security survey landed with numbers worth knowing. A data-backed piece on agency profitability settled an old argument. Building plugins isn’t the hard part anymore. Selling them is. And Automattic’s boardroom imploded, with four departures, a golden parachute, and employees reading about it in TechCrunch.

---

In this Issue:

• WooCommerce Plugin Devs Have a Marketing Problem
• WordPress Security in 2026: The Numbers Are Not Reassuring
• What Separates Profitable WordPress Agencies From the Rest
• Automattic’s Board Crisis: What Really Happened
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WooCommerce Plugin Devs Have a Marketing Problem

AI has made shipping a WooCommerce plugin faster than ever. Building used to be the bottleneck. Now it’s getting people to buy.

Most WooCommerce developers aren’t bad at marketing, they just never get to it. The demo video has been on the to-do list for months. The outreach email is always next week. The real blocker is motivation, not skill. Free advice and free courses haven’t changed that.

Rodolfo Melogli’s answer is Save The Plugin: twenty marketing tasks across four weeks, inside a private Slack group with him directly involved. Finish all 20 and you get a reward worth $400 to $500. The sprint costs $297 for the first 10 seats and starts October 5, 2026.

Read the full blog on Business Bloomer →

Next: a security survey that puts a number on how unprepared most WordPress sites actually are.

---

WordPress Security in 2026: The Numbers Are Not Reassuring

Melapress surveyed 319 WordPress professionals for their annual security report. The gap between concern and preparation has barely moved.

Security concern averaged 7.85 out of 10, nearly identical to 2025’s 7.8. Yet only 27.9% have a breach recovery plan in place, and just 26% have team security training. Both figures are unchanged from last year.

67.7% of respondents have experienced at least one known security incident. Website downtime hit 68.4% of those who did. 42.6% of incident victims only found out when someone noticed something looked wrong on the site. Only 38.4% were alerted by logs or monitoring first.

When a search engine flagged the problem before the site owner did, outcomes were significantly worse: 45.9% of those incidents involved a loss of search rankings.

Read the full blog on Melapress →

Now, a word from our sponsor. Start building your WordPress WooCommerce store sites using AI chat!

---

---

What Separates Profitable WordPress Agencies From the Rest

GravityKit analyzed two major 2026 surveys of 832 WordPress agencies. Profitability has almost nothing to do with how long you have been running. It comes down to what you charge and whether revenue recurs.

Agencies charging $5,000 or more per project are consistently profitable 57% of the time. Below that, only 33% are. The most common price band sits at $2,500 to $4,999, just under where things change.

Recurring revenue also matters. Agencies with at least 25% of income on retainers or care plans jump from 30% to 47% consistent profitability. Going further than 25% barely moves the needle.

Meet both conditions and profitability hits 60.3%. With neither, it’s 22.6%. A five-year agency charging $5,000 outperforms a sixteen-year veteran who doesn’t.

Read the full blog on GravityKit →

The biggest WordPress story of the week has nothing to do with code.

---

Automattic’s Board Crisis: What Really Happened

On September 9, Automattic’s board placed Matt Mullenweg on paid leave and installed CFO Mark Davies as interim CEO. Thirty-three hours and 20 minutes later, Mullenweg posted in company Slack he was back, linking to LL Cool J’s “Mama Said Knock You Out.” He then published a blog post about buying a houseboat.

Four people are out. CFO Mark Davies, CLO Andy Missan, and board members Toni Schneider and Sue Decker all departed. Leaked documents revealed Davies and Missan signed reciprocal severance agreements during the 33-hour window, totaling $8.15 million.

Employees learned everything from press coverage. A week later, staff still had no official explanation. Automattic also retained Susman Godfrey, known for the $787.5 million Fox News settlement, for the WP Engine case. A court hearing is scheduled for September 30.

Read the full report on The Repository →

---

WordPress Must Read

→ Sources say Automattic’s board is out after failed attempt to oust CEO Matt Mullenweg (techcrunch.com) – TechCrunch’s sourced breakdown of the board ousting attempt, the departures, and how Mullenweg regained control.

→ Ideas for WordPress in an agentic world (apeatling.com) – What should WordPress look like when AI agents become the primary interface? This piece sketches out some concrete answers.

→ AI SEO Myths and Facts (kb.theseoframework.com) – No jargon, no hype. Just what AI actually changes about SEO and what you can ignore.

→ Preparing an Established Freemium Plugin for Modern WordPress.org Review (abulkhoyer.com) – A practical first-person account of what it takes to get a mature freemium plugin ready for today’s WordPress.org review standards.

---

On other WordPress News

→ WooCommerce 11.1.1 Release Notes (developer.woocommerce.com) – Patch release notes covering the latest fixes shipped in WooCommerce 11.1.1.

→ Proposal: Identifying WPCC Participants through WordPress.org Profiles (make.wordpress.org) – A proposal to make WordPress community contributor recognition visible directly on WordPress.org profiles.

→ WordPress 7.1.1 Maintenance and Security Release (wordpress.org) – The official release post for WordPress 7.1.1, covering what was patched and why you should update.

→ The AI-Powered WordPress course is now live on Learn WordPress! (make.wordpress.org) – The WordPress training team has published a new AI-focused course on Learn WordPress.

→ AI Contributor Weekly Summary – 16 September 2026 (make.wordpress.org) – A weekly roundup of what the WordPress AI contributor group has been working on.

→ Call for testing: Purple, a WooCommerce block theme (developer.woocommerce.com) – WooCommerce is reviving Purple, a block theme previously shelved, and wants community testing feedback.

→ Introducing Ipsum, the new default theme (make.wordpress.org) – The core team introduces Ipsum, the proposed next WordPress default theme, ending the sixteen-year Twenty- naming convention.

→ What’s new in Gutenberg 24.0? (16 September) (make.wordpress.org) – The full changelog for Gutenberg 24.0, covering new block features, editor improvements, and contributor updates.

→ WordPress 7.1.1 Ships 11 Security Fixes, Credits Anthropic and pwn.ai Again (therepository.email) – The Repository’s detailed look at what the 11 security fixes in 7.1.1 actually addressed.

→ Explore the WordPress Playground Terminal with the new Dev Tools Dock (make.wordpress.org) – WordPress Playground gets a new Dev Tools Dock giving developers terminal access directly in the browser.

→ Call for testing: DataForm editor inspector (make.wordpress.org) – The core team is asking for community testing on the new DataForm editor inspector before it ships.

→ A Note on Figma access (make.wordpress.org) – The WordPress design team shares an update on how Figma access is being managed across contributors.

→ Events in the US and Canada: the plan through 2027 (make.wordpress.org) – The community team lays out the WordPress events roadmap for North America through the end of 2027.

---

From WordPress Community

→ WP Shipyard (wpshipyard.com) – Austin Ginder launched WP Shipyard, a tool that lets site administrators browse their site in a different installed theme while visitors keep seeing the live one. Handy for previewing a new theme without spinning up a full sandbox.

→ WPAcquire (wpacquire.com) – Cagdas Dag launched WPAcquire, a marketplace to buy and sell WordPress businesses. Plugin listings are free; paid members can browse and contact sellers directly.

→ WP Suomi Full Schedule (wpsuomi.fi) – WP Suomi, the independent Nordic WordPress conference, has published its full schedule for October 16 in Oulu, Finland.

→ Portuguese Community to Host First WordPress Event Dedicated Entirely to AI (therepository.email) – The Portuguese WordPress community is organizing a first-of-its-kind event focused entirely on AI and its impact on WordPress.

→ How GatherPress Grew From a Road Trip Idea to WordPress’ Meetup.com Replacement (therepository.email) – The origin story behind GatherPress, now positioned as the open-source replacement for WordPress meetup management.

→ New Proposal Targets 20+ WordPress Events Across North America in 2027 (therepository.email) – A new proposal outlines a flexible, menu-style approach to running 20+ WordPress events across North America in 2027.

→ ‘Ipsum’ Proposed as Next WordPress Default Theme, Ending 16 Years of the Twenty- Naming Convention (therepository.email) – The Repository’s coverage of the Ipsum default theme proposal and what it means for the long-running Twenty-* tradition.

→ Back in WordPress core (fullstackleader.blog) – A personal account from a developer returning to WordPress core contribution.

→ Day one at Pantheon: good docs, good company (courtneyr.dev) – Courtney Robertson shares her first-day experience joining Pantheon, with notes on onboarding and documentation culture.

→ How GoDaddy’s Airo Handles WooCommerce Store Setup Through Conversation (godaddy.com) – Airo installs WooCommerce, creates core store pages and generates product descriptions from a single prompt; with deeper store management on the roadmap.*

^*Sponsored

---

Until Next Week

Automattic’s board tried to remove its founder. The attempt lasted 33 hours and 20 minutes, cost at least $8.15 million in severance, and left employees learning the details from TechCrunch. What does that kind of internal communication breakdown cost a company in the longer run? And with a WP Engine court hearing on September 30, is the drama actually behind us?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

Automattic’s board tried and lost. Mullenweg’s back as CEO. Plus 7.2 squad, Grok malware find, and auto plugin security news.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 56, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 87 WordPressers who joined us in the last 7 days! We are now 878!

Automattic’s board tried to remove Matt Mullenweg as CEO. He refused to leave. Thirty-three hours later the board was gone and Mullenweg was back. That story dominated the week, but WordPress 7.2 also named its release squad, a Grok bot caught live malware sitting in a 40,000-install plugin on WordPress.org, and the plugin directory added automated security reviews that can block bad updates before they ship.

---

In this Issue:

• The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.
• WordPress 7.2 Release Squad Is Here
• A Grok Bot Found Live Malware on WordPress.org During a Routine Check
• WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.

On September 9, Automattic’s board voted to put Mullenweg on paid leave, naming CFO Mark Davies interim CEO. Mullenweg posted to company Slack that board members had “conspired” behind his back, that he received the resolution 50 minutes before the meeting, and that requests to consult a lawyer were denied.

What followed was 33 hours and 20 minutes of chaos. He declined to leave, removed Slack admins, posted “I’m a pirate now,” and swore for what he called the first time in 42 years. He posted a hiring call for sysadmins to move “my stuff” off Automattic servers, raising questions about WordPress.org, which he personally owns. By Friday he said he was back in control. Automattic confirmed it Saturday. Davies, CLO Andy Missan, Toni Schneider, and Sue Decker are all reported out. What triggered the original vote has not been explained.

Read the full blog on The Repository →

With the leadership drama still fresh, the WordPress 7.2 release squad was announced the same week, and Mullenweg himself is on it.

---

WordPress 7.2 Release Squad Is Here

The WordPress 7.2 release squad has been announced. Matt Mullenweg is Release Lead, with David Baumwald on coordination, George Mamadashvili and Peter Wilson as Tech Leads, and a full team covering triage, testing, and the Twenty Twenty-Seven default theme.

The structure follows the lean squad model in use since WordPress 6.7. Make Team Reps coordinate inside their teams rather than routing through a central group. Twenty Twenty-Seven has dedicated design and development leads, plus a mentor role built specifically to get new contributors into the default theme work. The release date is December 9, 2026, during State of the Word. If you weren’t selected, triage, bug scrubs, testing, and documentation are all still open for contribution throughout the cycle.

Read the full blog on Make WordPress Core →

While the 7.2 squad gets to work, a security story from the plugin directory showed just how fast a threat can move through WordPress.org.

---

---

A Grok Bot Found Live Malware on WordPress.org During a Routine Check

Austin Ginder at Anchor Hosting runs a morning Grok bot that reviews plugin diffs from the WP Beacon catalog. After two weeks of quiet, it flagged something: the tailwind.config.js file in instawp-connect had grown from 2.2 KB to 9.8 KB. The extra bytes contained a Node.js dropper pulling command-and-control IPs from Ethereum transactions, then decrypting and executing a remote payload.

The plugin has 40,000 active installs, but no one got hit. The attacker pushed to trunk rather than cutting a tagged release, which is what the update API actually serves. Wordfence showed zero hits overnight because the payload only runs during a Node build, not on PHP page loads. Ginder emailed the plugins team, who closed the listing that afternoon. Trunk was infected for about 23 hours before the author cleaned and restored it.

Read the full blog on Anchor Hosting →

That attack was caught by one developer’s morning routine. WordPress.org is now building the same kind of check into every plugin update before it ships.

---

WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship

WordPress.org has added automated security reviews to every plugin release. New plugins get reviewed before listing, but every update after that used to ship without any scrutiny between commit and distribution. That gap is now closed.

Every release sits in a six-hour cooldown window while several AI models and Jetpack Scan analyze the changes, producing a risk score. High-risk releases are automatically blocked before they reach the WordPress.org update API. Committers get an email with the findings. A high score doesn’t mean malicious intent, since an accidental vulnerability can score as high as deliberate malware. The InstaWP Connect incident described above was the system’s first confirmed interception: the Plugins Team closed that plugin 26 minutes after Wordfence flagged it, and the compromised version never shipped. If it runs cleanly, the cooldown window may shrink over time.

Read the full report on The Repository →

---

WordPress Must Read

→ Sources Say Automattic’s Board Is Out After Failed Attempt to Oust CEO Matt Mullenweg (techcrunch.com) – Davies, Missan, and Schneider are all reported out after the board’s attempt to remove Mullenweg collapsed in under 34 hours.

→ How to Model Data You Need to Query in Modern WordPress (remkusdevries.com) – A practical breakdown of how to structure custom data in WordPress for clean, efficient querying without fighting the platform.

→ WordPress 7.2 Release Squad Announced With Matt Mullenweg Back as Release Lead (therepository.email) – The Repository’s full coverage of the 7.2 squad announcement, with context on what Mullenweg’s return as Release Lead means for the December cycle.

→ Matt Mullenweg Tells Automattic Staff He’s Back in Control After CEO Ouster (techcrunch.com) – TechCrunch’s reporting on the 48 hours from ousted to reinstated, including the Slack messages and the “pirate” moment.

→ Automattic Board Forces Matt Mullenweg on Leave, Names CFO Mark Davies as Interim CEO (therepository.email) – The Repository’s original breaking story on the board vote, Davies’s appointment, and what Mullenweg posted company-wide.

→ Automattic’s Board Forces CEO Matt Mullenweg Into Leave of Absence (techcrunch.com) – TechCrunch’s initial September 9 report on the board vote and the Slack messages that followed.

→ Automattic CEO Matt Mullenweg Placed on Leave (theverge.com) – The Verge’s coverage of the leave announcement and what it means for Automattic and WordPress.com.

→ Students Built 108 Websites in Two Weeks in Bangladesh (wordpress.org) – Students in Bangladesh built 108 WordPress sites in two weeks as part of a learning program tied to the WordPress Credits initiative.

---

On Other WordPress News

→ Bringing Four Flagship Budgets Into One View (make.wordpress.org) – The Community team consolidates budget reporting across four flagship WordCamp events for clearer oversight.

→ Monthly Education Buzz Report: August 2026 (make.wordpress.org) – The Community team’s monthly roundup on WordPress education programs and what moved in August.

→ WordPress 7.1.1 RC1 Is Now Available (make.wordpress.org) – The first release candidate for the 7.1.1 maintenance release is out and ready for testing.

→ Planning for the Accessibility Lab Plugin (make.wordpress.org) – The Accessibility team’s plans for a dedicated lab plugin to test and develop accessibility improvements.

→ Updating WordPress to Use Node.js 24 and npm 11 (make.wordpress.org) – WordPress core is moving to Node.js 24 and npm 11, with details on what developers need to know.

→ Proposal: WordCamp Education Sponsor Fund for Flagships (make.wordpress.org) – A proposal to create a dedicated sponsor fund for education programming at flagship WordCamp events.

→ Automattic Fires Back at WP Engine Customer Class Action, Claims Small Business Owners Caused Their Own Losses (therepository.email) – Automattic’s legal response to the WP Engine customer class action, arguing the plaintiffs’ losses were self-inflicted.

→ Automated Security Review for Plugin Releases (make.wordpress.org) – The official Make WordPress Plugins post on how the new automated review works, what triggers a block, and what plugin authors should do if a release is flagged.

→ Proposed Change: Requiring PHP 8.1 or Newer for WooCommerce 11.5 and Beyond (developer.woocommerce.com) – WooCommerce is proposing to drop PHP 7.4 support starting with version 11.5, requiring PHP 8.1 as the new minimum.

→ WordPress 7.1 Release Retrospective (make.wordpress.org) – The core team’s post-release look at what worked and what didn’t in the 7.1 cycle.

---

From WordPress Community

→ Why WebMCP Is Going to Be Big for WordPress, and How to Try It Today (linkedin.com) – Jamie Marsland on why WebMCP matters for WordPress developers and how to get started with it today.

→ CloudFest Americas Returns to Miami With More Space, an Agency Focus, and a New Name (therepository.email) – CloudFest Americas is back in Miami with a larger venue, a sharper agency focus, and a new name for the event.

→ LoopConf Postponed to June 2027 After Lead Sponsor Pulls Out Six Weeks Before the Event (therepository.email) – LoopConf is pushed to June 2027 after its lead sponsor withdrew six weeks out, leaving no time to find a replacement.

→ AI-Generated Websites vs. WordPress: An Honest Comparison From a WordPress Agency (webdevstudios.com) – WebDevStudios on where AI site builders actually stand versus WordPress for real client work.

→ Six Solutions for WordPress Plugin Distribution, Each With a Different Philosophy (deploytroy.org) – A side-by-side look at six approaches to distributing WordPress plugins, from the official directory to self-hosted and commercial options.

→ Chris Reynolds on Building Trust With Project Contracts for Reliable AI Development (wptavern.com) – WP Tavern’s podcast with Chris Reynolds on how project contracts make AI-assisted development more predictable.

→ Did WordPress Just Lose? (youtube.com) – A video essay on where WordPress stands as the web shifts around it.

→ Benefit of the Doubt (crossword.fm) – The latest Crossword podcast episode on WordPress and the broader open source community.

→ Full WordPress, Full Control: How Airo Builds on Open-Source Without the Lock-in (godaddy.com) – Unlike proprietary AI builders, Airo generates a live WordPress installation. Full plugin access, full data ownership, no platform cage.*

_^*Sponsored

---

Until Next Week

Mullenweg was gone for 33 hours and 20 minutes. The board that voted him out is now out themselves. Three of Automattic’s top executives are reportedly gone, and the composition of the new board is still unclear as of today.

What actually triggered the vote? And with Mullenweg now also serving as WordPress 7.2 Release Lead, does his return to full control accelerate the project or complicate it?

Hit reply with your take. If this issue was interesting, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

---

WordPress launches a Core Security Initiative, WooCommerce 11.1 speeds up REST APIs, Miriam Schwab on the agentic web gap, WordCamp US recap, and CMS Conf launches in Poland.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 55, where you get curated news about WordPress and the WordPress community all in one place.

Security is getting a serious upgrade this week, WooCommerce 11.1 ships faster APIs and native variation galleries, Miriam Schwab calls out the gap between WordPress core’s AI plumbing and what the plugin ecosystem is actually delivering, and a Polish organizing team just launched a cross-platform CMS conference to break out of the WordPress bubble.

---

In this Issue:

• The WordPress Core Security Initiative: A Response to AI-Driven Vulnerabilities
• WooCommerce 11.1: Faster APIs, Variation Galleries, and More
• WordPress Is Ready for the Agentic Web, but the Ecosystem Isn’t
• 31 WordCamps Later: One Contributor’s Experience in Phoenix
• Polish WordCamp Organizers Launch CMS Conf, a New Cross-Platform Conference

---

The WordPress Core Security Initiative: A Response to AI-Driven Vulnerabilities

AI-powered security research is flooding WordPress’s bug bounty inbox. Monthly reports to the HackerOne program held steady at 20-30 for a decade, then jumped to 450 in July and hit 773 in August alone. The WordPress Security Team has responded with the Core Security Initiative, a coordinated effort built around three pillars: a tighter, more automated release process for fixes; a push to clear the backlog of open reports by bringing on more volunteers; and AI-assisted scanning to catch vulnerabilities before they get reported at all.

The scope of the HackerOne program has also been tightened. Vulnerabilities that require an administrator-granted role, like Contributor, will generally no longer qualify unless they demonstrate a high-severity escalation. Bugs where one authenticated role does something normally available to another won’t be enough on their own. If you do find something, report it at hackerone.com/wordpress and review the updated guidelines first.

Read the full blog on Making WordPress Secure →

Security is just one part of what’s been a busy few weeks for WordPress. The WooCommerce team has been shipping too.

---

WooCommerce 11.1: Faster APIs, Variation Galleries, and More

WooCommerce 11.1, released September 1, brings a real speed bump alongside features store owners have been waiting on. The headline change: Store API and REST requests are now 30-42% faster, by skipping block registration on requests that don’t need it. No code changes required on your end.

Variation image galleries are now a native WooCommerce feature, with no extra extension needed. The Additional Variation Images plugin is being retired, and the gallery is on by default for all stores. Virtual-only orders no longer show a shipping address in admin, clearing up display clutter that served no purpose. Video support in product galleries lands in beta, disabled by default, for locally uploaded videos. Developers also get a unified block editor asset system as an experimental feature, and a fix to remove_order_items() that stops replacement items from being accidentally deleted on save.

Read the full blog on The WooCommerce Developer Blog →

While WooCommerce ships performance wins, one WordPress voice is asking harder questions about what the platform still needs to deliver for the next wave of the web.

---

WordPress Is Ready for the Agentic Web, but the Ecosystem Isn’t

Miriam Schwab gave a talk at WordCamp US called “The Agentic Web Is Coming: Is WordPress Ready?” Core has the plumbing, she found. The plugin ecosystem hasn’t shown up. WordPress since version 7 ships the Abilities API and the MCP Adapter, giving agents a defined way to interact with a site. But core only registers three abilities out of the box.

On Miriam’s own site, 67 abilities are registered. Three come from core. She built 41 herself. She also tested whether agent-ready features like llms.txt and markdown page versions were being used. They mostly weren’t. Claude went straight for the HTML and converted it to markdown itself, ignoring the dedicated files. Bots want what humans want. Clean semantics, stable URLs, structured data, markup without junk. Build for people and agents follow.

Read the full blog on MiriamSchwab.me →

The plugin ecosystem gap Miriam describes was a real conversation topic at WordCamp US itself, where contributors gathered for four days in Phoenix.

---

---

31 WordCamps Later: One Contributor’s Experience in Phoenix

Mainul Kabir Aion flew from Kuala Lumpur for his 31st WordCamp, this time also organizing on the Attendee Communications team. WordCamp US 2026 ran August 16-19 at the Phoenix Convention Center with 425 contributors on Day 1, including 29 first-timers across 26 teams.

His highlight was a hackathon where his group built an AI-powered site architecture tool for service-area businesses, designed to map out which service pages to create, how they connect, and which thin pages to skip. They finished the day with a concrete workflow and pitched it as a rap. Beyond the hackathon, he scored 995 out of 1000 at the Community Booth quiz to take home a LEGO Wapuu, then spent an hour painting his own mascot. His post is an honest account of how much WordCamp work happens out of sight, and why that effort matters.

Read the full blog on MKAion.com →

WordCamp US wasn’t the only community event making news this week. In Poland, a WordCamp organizing team is building something different entirely.

---

Polish WordCamp Organizers Launch CMS Conf, a New Cross-Platform Conference

The team behind WordCamp Gdynia has launched CMS Conf, a three-day conference for CMS creators and developers, scheduled November 12-14 in Gdynia, Poland. Lead organizer Maciek Palmowski said 15 years in WordPress left him with almost no picture of what was happening on the other 58% of the web. CMS Conf is the fix.

The event received around 120 speaker submissions for roughly 30 slots, with talks covering WordPress, Drupal, Joomla, TYPO3, Astro, Payload, and Cloudflare’s EmDash. Speakers are coming from Figma, the Drupal Association, Automattic, Cloudflare, and Zendesk. Two parallel tracks run, one for developers and one for creators, borrowed directly from the WordCamp format. The team had to form a company to run independently, since the WordPress Foundation only handles WordCamp finances. Tickets are €150 at cmsconf.com.

Read the full blog on The Repository →

---

WordPress Must Read

→ 6 WordCamp US 2026 Sessions Worth Your Time (and What I Actually Took Away From Each) (wpmore.net) – WordCamp US 2026 had 60+ sessions. Most of them I won’t remember in a week. These six stayed with me.

→ Security Stories from the People Who Experienced Real Incidents (melapress.com) – Melapress’s Wall of Security Stories collects first-hand accounts of website hacks, their financial impact, and the recovery work that the vulnerability numbers never show.

→ WordPress Tightens Bug Bounty Scope After Monthly Security Reports Nearly Double to 773 (therepository.email) – Reports to WordPress’s HackerOne program jumped from a decade-long baseline of 20-30 a month to 773 in August alone, driven by AI-assisted security research tools.

→ Bringing Together Our Various Responsive Tooling (nomad.blog) – Anne McCarthy maps out the current state of WordPress responsive controls ahead of 7.2, covering fluid typography, viewport-based block visibility, and the gaps that still need solving.

---

On Other WordPress News

→ Telex Has Been Retired (telex.automattic.ai) – Automattic’s AI-assisted authoring environment for WordPress has been shut down.

→ Transparency Report Update: January – June 2026 (transparency.automattic.com) – Automattic’s mid-year transparency report covers content takedown requests, government demands, DSA compliance, and the difficult balance between user expression and reporter rights.

→ WordCamp US 2026 Contributor Day Recap (make.wordpress.org) – The Hosting team’s write-up from Contributor Day in Phoenix, covering what the team worked on across 425 participants and 26 contributing teams.

→ Themes Team Update September 1, 2026 (make.wordpress.org) – The latest weekly status update from the WordPress Themes team.

→ WordCamp US 2026: PHP Conversation (make.wordpress.org) – Notes from the PHP discussion held at WordCamp US, covering the project’s approach to PHP version support and compatibility decisions.

→ Announcing the 2026 Kim Parsell Memorial Scholarship Recipient: Jeanherline Santiago (wordpressfoundation.org) – The WordPress Foundation names this year’s scholarship recipient, awarded annually in memory of community contributor Kim Parsell.

→ Replacing Dashicons in the Admin Bar and Menu (make.wordpress.org) – A look at the ongoing effort to move WordPress admin icons away from the aging Dashicons icon font.

→ WordPress 7.1.1 Release Schedule (make.wordpress.org) – The core team has published the schedule for the upcoming 7.1.1 maintenance release.

→ AI Contributor Weekly Summary – 2 September 2026 (make.wordpress.org) – The WordPress AI team’s weekly summary covering contributor activity and progress in the AI working group.

→ Accessibility Team Meeting Notes: Aug 27, 2026 (make.wordpress.org) – Notes from the WordPress Accessibility team’s most recent meeting.

→ Agenda: Weekly Polyglots Chat – September 2, 2026 (7:00 UTC) (make.wordpress.org) – The agenda for the weekly Polyglots team chat, covering locale stats, the WordPress 7.1.1 release schedule, and open help and feedback items.

→ Emoji Locale (art-xemoji): How Would You Translate Weekdays and Months? (make.wordpress.org) – The Polyglots team opens a discussion on how to handle weekday and month names in the emoji locale, which has no spoken language to fall back on.

→ A Week in Openverse: 2026-08-24 – 2026-08-31 (make.wordpress.org) – The Openverse team’s weekly update covering development work and progress from the last week of August.

→ What’s New in Gutenberg 23.9? (2 September) (make.wordpress.org) – A full rundown of the changes and improvements shipping in the latest Gutenberg release.

→ Updates to the WordPress Vulnerability Disclosure Program (make.wordpress.org) – The Security Team’s formal update on the scope changes to the HackerOne disclosure program, with guidance for researchers on what now qualifies.

→ WooCommerce 11.1 Delivers Faster REST and Store API Requests by Skipping Block Registration (developer.woocommerce.com) – A deeper technical look at how WooCommerce 11.1 cuts Store API and REST response times by 30-42% by skipping block registration on non-rendering requests.

→ WordPress Announces Core Security Initiative as AI-Driven Vulnerability Reports Hit Record Levels (therepository.email) – The Repository’s full coverage of the Core Security Initiative announcement, with context on the AI-assisted research surge driving the record report volumes.

---

From WordPress Community

→ WordCamp Belgrade Returns With a New Bilingual Format to Bring the Community Together (therepository.email) – WordCamp Belgrade is back and running both Serbian and English tracks to widen who can participate and benefit.

→ Aaron D Campbell on Navigating WordPress Security in the AI Era (wptavern.com) – WP Tavern’s podcast episode with longtime WordPress security contributor Aaron D Campbell on what AI means for vulnerability research and the project’s defenses.

→ WordPress Is Eating Itself Alive (youtube.com) – A candid video essay on the tensions inside the WordPress project and the community dynamics that have built up over recent years.

→ Why Real-Time WordPress Is the Future (thewpminute.com) – The WP Minute makes the case for real-time, collaborative WordPress editing and what needs to change for it to get there.

→ Enqueue Returns to Sydney to Explore What AI Means for WordPress Developers (therepository.email) – The Enqueue developer event is coming back to Sydney with AI and its practical implications for WordPress development as its central theme.

---

Until Next Week

WordPress’s HackerOne inbox went from 450 reports in July to 773 in August, driven almost entirely by AI-assisted security research tools. That volume prompted a structural response: tighter scope rules on the bug bounty program, more volunteers to clear the backlog, and AI-assisted scanning to catch vulnerabilities before researchers do.

Is your site’s security posture keeping up with how fast the threat surface is changing? And if you’re a developer, are you paying attention to what the scope changes mean for the reports you might submit?

Hit reply with your take. If this issue was useful, pass it along.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

WordCamp US 2026 recap: Matt’s Piplets demo, WordPress form plugin market share data, and the WP Rocket backlash explained.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 54, where you get curated news about WordPress and the WordPress community all in one place.

WordCamp US just wrapped in Phoenix. Matt Mullenweg teased a database-free WordPress experiment on stage. A new form plugin market share report landed with a surprise entry. A community builder left camp feeling uninspired and wrote about why. And the WordPress X account reignited old frustrations with its handling of the WP Rocket incident.

If you were also a WordCamp US attendee, what are your thoughts on Matt’s keynote?

---

In this Issue:

• Matt Mullenweg’s WCUS keynote: Piplets, AI, and a push for simplicity
• WordPress form plugin market share 2026: who’s up, who’s down
• What one community veteran took home from WordCamp US
• WordPress X account backlash over the WP Rocket/7.1 callout
• WordPress must read
• On other WordPress news
• From WordPress community

---

Matt Mullenweg’s WCUS Keynote: WordPress Needs to Be Simpler

The closing keynote at WordCamp US 2026 was an hour-long conversation between Matt Mullenweg and Robert Jacobi, covering AI, open source, and where WordPress is headed. The throughline: technology needs to get simpler, and WordPress is no exception.

The standout moment was Mullenweg introducing “Piplets,” a concept he hacked on in 2007, now rebuilt. A Piplet is a self-contained PHP file that stores its own data, no database required. He demoed a version loading in about 50 milliseconds and holding up to 25 megabytes. He wants to make them forkable and shareable on WordPress.org.

Mullenweg also suggested the community should put WordPress.org profiles on conference badges instead of social handles. On AI, he said the term might be backfiring and “automation” could land better. A notable share of the 1,000-plus attendees were at their first WordCamp.

Watch the full keynote on YouTube →

Speaking of what’s changing in the WordPress world, the form plugin market just got a fresh look at who’s actually running what.

---

WordPress Form Plugin Market Share 2026: CF7 Still Leads, but Gravity Forms Is Gaining

GravityKit published its 2026 WordPress form plugin market share study using the July 2026 HTTP Archive crawl. Contact Form 7 still leads at 29.74% of WordPress sites, but has bled nearly a quarter of its share since 2022. Every plugin with a full year of history lost ground except one.

Gravity Forms is the only plugin that gained share year-over-year, ticking up to 3.53%. WPForms sits at 2.43%, Formidable Forms at 0.88%, and Ninja Forms at 0.45%. The big new entrant is Fluent Forms, appearing in HTTP Archive’s detection library for the first time and landing at 1.09%, fourth in the ranking.

HTTP Archive only crawls the homepage and one interior page per site, so plugins that only load assets on a contact page are under-counted. These numbers are floors, not census figures. The direction of travel, though, is clear.

Disclaimer: I am the product marketing lead of Fluent Forms.

Read the full blog on GravityKit →

From plugin market share to something more personal, here’s what one veteran community member took away from this year’s WordCamp.

---

What One WordCamp US Veteran Took Home: Community Is Great, the Event Needs Work

James Laws, co-founder of Saturday Drive and creator of Ninja Forms, attended WordCamp US 2026 and wrote a candid post about it. The people were great. The event itself was not.

He described a vendor hall with about a dozen sponsors, mostly hosts, spread across a room too big for the crowd. Sponsorship costs have priced out smaller shops. The closing keynote started 25 minutes late and felt off-book. Laws’s core critique is a values shift: it used to feel like community was the goal and WordPress the tool. Now it feels inverted.

His suggestions: lower sponsor costs to bring in 40 or 50 smaller companies, give WordCamp US a permanent home, and revive regional camps. (I agree with him on these points; what are your thoughts?) He praised the volunteers and pointed the blame at the constraints they were handed, then committed to figuring out his own role in turning things around.

Read the full blog on JamesLaws.com →

Before the next story, a word from this week’s sponsor.

---

---

The WordPress X Account Called Out WP Rocket. The Community Pushed Back Hard.

After WP Rocket’s compatibility issue caused fatal errors on WordPress 7.1 sites, Matt Mullenweg posted “Did your rocket explode? Get a Jetpack.” The official WordPress X account followed with a thread faulting WP Rocket for not fixing a bug it was warned about 44 days before the release, pushing users toward plugins in the official directory, and flagging unauthorized WordPress branding, all in one thread.

Developers questioned why the official WordPress account would amplify a story about 7.1 causing outages, and whether publicly targeting a major plugin helps anyone. The technical picture was also murkier: a Trac ticket flagged a backward-compatibility break in 7.1 itself. Anchor Hosting’s Austin Ginder noted the fatal only triggered with WP Rocket, Elementor Pro, and 7.1 combined. WP Rocket’s post-mortem said roughly 10% of its sites were hit.

Read the full blog on The Repository →

---

WordPress Must Read

→ Rank Math WordPress Plugin Accused Of Secretly Taking Admin Access (searchenginejournal.com)

→ WordPress Signs Open Weights AI Letter Alongside Automattic and GoDaddy (therepository.email)

→ How We Made Our Plugin 30x Times Faster (linkedin.com)

→ The WordPress 7.1 Outage: What Went Wrong, and What Changes Now (wp-rocket.me)

→ Anchor Hosting’s Austin Ginder Calls Out Hosts for Failing to Test WordPress Releases (therepository.email)

→ WordCamp US 2026: The Artist and the Algorithm (wordpress.com)

→ WordPress 7.1 Release Lead Decision Log (nomad.blog)

→ Hands-on with the WordPress 7.1 Icon Registration API (developer.wordpress.org) → Real Artists Ship: Contributor Day at WCUS 2026 (us.wordcamp.org)

→ Showcase Day at WordCamp US 2026 (us.wordcamp.org)

→ WordCamp US Day 3: From Taking It In to Putting It to Work (us.wordcamp.org) → Driving Into the Sunset: The Final Day of WCUS 2026 (us.wordcamp.org)

---

On Other WordPress News

→ AI Contributor Weekly Summary – 26 August 2026 (make.wordpress.org)

→ Performance Chat Summary: 25 August 2026 (make.wordpress.org)

→ Introducing Order Withdrawal in WooCommerce 11.1 (developer.woocommerce.com)

→ Help Shape the Accessibility Lab Plugin (make.wordpress.org)

→ Run Any Era of WordPress in Playground (make.wordpress.org)

→ Proposal: A Secrets API for WordPress 7.2 (make.wordpress.org)

→ WordPress 7.1 Highlights Video (youtube.com)

---

From WordPress Community

→ What’s New With Woo? (July 2026 Member Meetup) (thewpminute.com)

→ WPOCC: Rebranding, and Surveying the WordPress Community – WP Builds Podcast #482 (wpbuilds.com)

→ Wordfence’s New AI Agent Chains Six Flaws Into a Critical Unauthenticated RCE in Popular Avada Theme (therepository.email)

→ Adrian Sticea on Navigating the Decline of WordPress Work on Upwork and the Rise of New Opportunities (wptavern.com)

→ WordCamp US 2026 Experience (topher.how)

---

Until Next Week

Is your site still running a plugin that’s trending in the wrong direction? And after everything that happened this week with the WP Rocket callout, do you think the official WordPress account is helping or hurting the community’s trust?

Hit reply with your take. If this issue was useful, pass it along to someone in the WordPress community.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

WordCamp US 2026 wrapped up; more than 1,100 people showed up and WordPress 7.1 landed live on stage.

---

This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 53, where you get curated news about WordPress and the WordPress community all in one place.

WordCamp US 2026 just wrapped up in Phoenix. More than 1,100 people showed up for four days of sessions, a hackathon-style Contributor Day, and the live release of WordPress 7.1. It was a big week for the community. I was getting so much fomo seeing all the amazing photos and posts from X and LinkedIn. If you were also an attendee, what are your thoughts on WordCamp US?

---

In this Issue:

• WordPress 7.1 “Mary Lou” Is Here
• Build Your First AI-Powered WordPress Plugin
• A WooCommerce Developer Takes on the Plugin Repo
• WordCamp US 2026 Wraps in Phoenix
• WordPress Must Read
• On Other WordPress News
• From WordPress Community

---

WordPress 7.1 “Mary Lou” Is Here

WordPress 7.1, named after pioneering jazz pianist Mary Lou Williams, shipped on August 19, live at WordCamp US 2026. The release is built around how you actually work: navigating the admin, controlling your designs, and collaborating with others.

The admin bar now follows you across every editor, so you always have familiar tools within reach. Responsive styling is built in, letting you control how blocks look at different screen sizes without writing custom CSS. A new media editor brings freeform cropping, image flipping, rotation, and metadata editing into one place. Notes now support rich text and @mentions, making it easier to leave feedback and loop in collaborators.

Two new blocks landed as well: Playlist and Tabs, along with browser-based image compression that reduces server load on uploads. Over 800 contributors shipped more than 1,500 enhancements and fixes, including 170 first-time contributors.

Read the full blog on WordPress.org →

If you’ve been eyeing the new AI features in WordPress core, the next piece shows exactly how the pieces fit together in a real plugin.

---

Build Your First AI-Powered WordPress Plugin

The WordPress Developer Blog published a step-by-step guide to building an AI-powered plugin using three core building blocks: the Abilities API, the WordPress AI Client, and the MCP Adapter. The tutorial walks through building “Photo to Post,” a plugin that takes an image URL, generates a text description via an AI vision model, writes a draft post from that description, and sets the image as the featured image.

The key concept is ability composition: the orchestrator ability calls two smaller abilities rather than touching the AI Client directly, so each piece stays reusable. Once registered, the abilities work over the REST API, in the dashboard, and through an AI agent, all without separate code for each. The AI Client handles provider differences behind the scenes, so the same code works with OpenAI, Anthropic, or Google. Good reading for any developer watching where WordPress AI is headed.

Read the full blog on WordPress Developer Blog →

From AI development to the plugin repo itself; this next story is about what actually happens when you finally just try.

---

A WooCommerce Developer Takes on the Plugin Repo

Rodolfo Melogli of Business Bloomer spent 15 years building WooCommerce plugins but never published one to the official WordPress.org repository. SVN, PHPCS, review queues, readme standards; it all felt like a locked door he assumed wasn’t worth opening.

Then he started using Claude Code. Seven days later, he had four plugins live on WordPress.org. The process involved running plugins through Plugin Check and WPCS, handling a rejection for a name that was too generic, and iterating until approval. He also launched two new brand websites alongside the plugins.

His honest takeaway: shipping fast is now the easy part. What still matters is domain knowledge built over years, good ideas, and the marketing to make sure anyone actually finds what you built. A refreshingly grounded take on what AI tooling can and cannot do for the average WordPress developer.

Read the full blog on Business Bloomer →

Before the WordCamp US recap, a word from our sponsor.

---

---

WordCamp US 2026 Wraps in Phoenix

WordCamp US 2026 ran August 16–19 at the Phoenix Convention Center in 111°F heat, drawing 1,156 ticket holders across four days of sessions, demos, and hallway conversations. Contributor Day ran as a hackathon this year, with 425 participants across 26 teams shipping 22 pull requests and 21 finished items, including three plugins and two new features.

At the closing keynote, Matt Mullenweg called for WordPress to prioritize simplicity, said the project may have pushed AI too hard, and floated rebranding some features as “automation.” He also acknowledged WordPress’s slight market-share dip, suggesting that WP Engine sites no longer pinging the WordPress.org update server fully account for the drop. The WordPress 7.1 release went live during the session itself; by the time Mullenweg noticed, the counter had already passed 330,000 downloads and 1.4 million auto-updates.

Read the full report on The Repository →

---

WordPress Must Read

→ We Checked 60,000 WordPress Plugins to Find the Ones Still Growing. They Share One Thing. (wp-rankings.com)

→ AI Creates Opportunity While Artists Ship at WordCamp US 2026 (wordpress.org)

→ Homework from WordCamp (ma.tt)

→ State of the Community 2026 (thewpocc.org)

→ The integer that delayed WooCommerce 11.0 (remicorson.com)

---

On Other WordPress News

→ AI Contributor Weekly Summary – 19 August 2026 (make.wordpress.org)

→ WordCamp US opens, students ship 108 sites in Bangladesh, and a lesson in the dark (make.wordpress.org)

→ Plugin Check just got an update 2.1.0 🚀 (x.com)

→ Call for WordPress 7.1.x Release Managers (make.wordpress.org)

→ What’s new in AI 1.3.0 (18 August 2026)? (make.wordpress.org)

→ WordPress 7.1 “Mary Lou” Launches at WordCamp US With Responsive Styling, Improved Media Handling, and New Blocks (therepository.email)

→ What’s new in Gutenberg 23.8? (19 August) (make.wordpress.org)

→ WooCommerce 11.1: What’s coming for developers (developer.woocommerce.com)

→ Accessibility Improvements in WordPress 7.1 (make.wordpress.org)

→ WordPress Contributor Toolkit 1.0: A smoother workflow for your first Core contribution (make.wordpress.org)

→ The WordPress.com Student Plan Is Here: Give Your Students a Website They Can Keep (wordpress.com)

→ Automattic Launches Free WordPress.com Student Plan for Teachers and Students (therepository.email)

---

From WordPress Community

→ My WordPress Contribution Journey: A Transparency Report by Satyam Vishwakarma (satyamvishwakarma.com)

→ What’s Next: Open Source Programs, Docs, and SBOMs by Courtney Robertson (courtneyr.dev)

→ Fueled Partners with beehiiv to Launch Its Official Plugin for WordPress (fueled.com)

→ PressConf Heads to Europe for the First Time, Announces Four-Day Barcelona Conference in October (therepository.email)

→ State of the Community Survey Finds Three in Four Feel Worse About WordPress, but 90% Agree on What Matters (therepository.email)

→ GoDaddy’s Airo for WordPress Delivers AI that Builds, Grows, and Continuously Improves Your Website (godaddy.com)*

_*Sponsored

---

Until Next Week

WordPress 7.1 went live during Mullenweg’s own closing keynote. By the time he noticed, it had already hit 330,000 downloads and 1.4 million auto-updates. If you haven’t upgraded yet, the responsive styling controls and browser-based image compression are worth checking first.

Three in four respondents in the State of the Community survey said they feel worse about WordPress than a year ago. Mullenweg acknowledged it on stage and said the project needs to simplify. What does that actually mean to you in practice? Fewer features, better defaults, a cleaner admin? And after reading Rodolfo’s story about finally opening the plugin repo door after 15 years of assuming it was too complicated, is there something similar sitting on your own list?

Hit reply with your take. If this issue was useful, pass it along to someone in the WordPress community.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

What 3,400 plugin reviews reveal, plus WP 7.1 dev updates and a new RCE patch.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 52, where you get curated news about WordPress and the WordPress community all in one place.

WordCamp US 2026 starts August 16 in Phoenix today. Are you joining?

WordPress 7.1 ships August 19 on the event’s final day, so this is a packed week. Plugin transparency issues, developer updates, a fresh security patch, and a call for 7.2 volunteers all landed at once.

---

In this Issue:

• What 3,400 plugin reviews tell you about building products people love
• The hidden WordPress hook any plugin can use to rewrite your Add New screen
• What’s new for developers in August 2026
• WordPress 7.2 is already recruiting volunteers
• A third WordPress security release in four weeks patches an author-level RCE

---

What 3,400 Plugin Reviews Reveal About Products People Love

Matt Cromwell scraped and tagged 3,354 one-star and five-star reviews from the 100 most popular plugins on WordPress.org. Reliability failures drive 42% of one-star reviews, far ahead of missing features, which show up as the primary complaint in just 2.5% of cases.

The second biggest one-star driver is monetization: free tiers that hide their limits until someone has already built on top of them (170 reviews), ahead of nag popups (102 reviews). On the five-star side, ease of use tops the list at 21%, followed by dependability at 20%, and excellent human support at 17%.

Read the full blog on Roots & Fruit →

If you build or sell WordPress plugins, this data is worth reading before you touch the roadmap.

---

Any Plugin Can Secretly Edit Your WordPress Add New Screen

Developer Marcin Dudek noticed his own plugin was not the first result when he searched for it by exact name in Plugins > Add New. That led him to the plugins_api_result filter, a hook that fires before search results reach your screen and lets any installed plugin reorder, add, or delete what you see. He scanned all 63,619 free plugins on WordPress.org and found two vendors using it to remove a competitor from the Featured and Recommended tabs.

Read the full blog on Marcin Dudek →

With plugin transparency on everyone’s mind, the developer update below is worth reading alongside this one.

---

WordPress 7.1 Developer Updates: What’s Shipping August 19

WordPress 7.1 lands August 19, the final day of WordCamp US in Phoenix. The standout additions are responsive block styles (per-breakpoint styles in theme.json via @mobile and @tablet keys), pseudo-state styling for Button and Navigation Link blocks, and a now-public SVG Icon API for registering custom icon collections. The post editor is always iframed in 7.1, regardless of block API version or theme type. The Abilities API picks up a full execution lifecycle and shared discovery pipeline, making it ready for AI integrations and automation tooling. A new background.gradient block support lets you layer gradients and images in the same block. React 19 is punted again, real-time collaboration didn’t make the cut, and the Classic block stays in the inserter. If you maintain plugins or themes, the Field Guide is your checklist before 7.1 ships.

Read the full blog on WordPress Developer Blog →

Planning for the next major release is already moving, which brings us to 7.2.

---

---

WordPress 7.2 Is Looking for Volunteers: Deadline August 28

The WordPress 7.2 release cycle is open, with a proposed final release date of Wednesday, December 9, 2026. Alpha development began August 10, and the team is recruiting for Release Lead, Release Coordination, Tech Leads, Triage Lead, and Test Lead roles. The squad structure stays lean: Make Team Reps coordinate within their teams rather than routing through a large central group.

Attending State of the Word is not required; all coordination happens in the #core Slack channel. The timeline runs from Beta 1 in late October through three release candidates, with a dry run December 7-9. Whether you’ve led a release before or want to get involved for the first time, comment on the post or reach out in #7-2-release-leads before Friday, August 28.

Read the full blog on Make WordPress Core →

On the security front, 7.2 planning is happening against a backdrop of accelerating vulnerability reports.

---

Third WordPress Security Release in Four Weeks Patches an Author-Level RCE

WordPress 7.0.4 shipped on August 12, fixing a remote code execution vulnerability found by AI penetration testing firm pwn.ai. A logged-in author could upload a file with a .png extension containing PostScript, which ImageMagick would recognize and pass to Ghostscript for arbitrary code execution. The bypass worked through two paths that skip WordPress’s standard upload checks: XML-RPC’s wp.uploadFile and the MP3 cover-art extraction routine.

The patch adds content inspection before any file reaches Imagick. Author-level access sounds like a high bar, but on membership sites or multi-author publications with open registration, it isn’t. Sites with automatic updates are already patched; backports go back to WordPress 4.7. This is the third core security release since July, following 7.0.2 (a critical pre-auth RCE) and 7.0.3 (12 vulnerabilities). HackerOne bug bounty reports have climbed from a 20-30 monthly baseline to 450.

Read the full report on The Repository →

---

WordPress Must Read

→ 62% of Our Search Console Impressions Were Bots. Then 17%. (jnkplugins.com)

→ When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE (patchstack.com)

---

On Other WordPress News

→ WordPress 7.0.4 is now available (wordpress.org)

→ WordPress 7.1 Release Candidate 3 (make.wordpress.org)

→ WordPress 7.2 Planning Kicks Off With December 9 Release Date During State of the Word (therepository.email)

→ Hands-on Activity Kits Now Live on Learn WordPress (make.wordpress.org)

→ WordCamp Switzerland postponed (switzerland.wordcamp.org)

→ Monthly Education Buzz Report – July 2026 (make.wordpress.org)

→ Post list tables row headers changed (make.wordpress.org)

→ Official WordPress Browser Extension Now Available in the Chrome Web Store and Mac App Store (therepository.email)

→ WordPress Credits Team Proposes Graduate Retention Program, Launches Public Dashboard (therepository.email)

→ Matt Mullenweg’s Messages Went Missing Amid a Failed Backup and Two Lost Devices, Court Filing Reveals (therepository.email)

→ Accessibility Team Initiative “Permanently Delayed” as Matt Mullenweg Declares Team Has “Overstepped Its Authority” (therepository.email)

→ Automattic Fires Back at WP Engine’s Sanctions Motion, Says Hosting Company Can’t Identify a Single Missing Message (therepository.email)

---

From WordPress Community

→ Announcing WP Future Conclave 2026, Kozhikode! (events.wordpress.org)

→ What 3,400 WordPress Plugin Reviews Say About What Users Actually Care About: Q&A With Matt Cromwell (therepository.email)

---

Until Next Week

Matt Cromwell’s plugin review analysis showed that reliability failures, not missing features, drive 42% of one-star reviews, and that great support is nearly four times more likely to earn a five-star than a one-star. The hidden plugins_api_result filter story showed two vendors with a combined 570,000 installs silently removing a competitor from the WordPress installer. One fixed it within 17.5 hours; the other needed a nudge from WordPress.org. On the security side, HackerOne bug bounty reports have jumped from a 20-30 monthly baseline to 450, with WordPress now on its third core security patch in four weeks. And 7.2 planning is already open, targeting December 9, 2026.

Are you auditing your own plugin’s reviews the way Cromwell’s data suggests you should? If you’ve been thinking about contributing to a WordPress release, August 28 is the deadline to raise your hand for 7.2.

Reply to share what caught your attention this week, or forward this to a WordPress friend who should be reading it.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

WordPress plugin opportunities, WooCommerce 11.0, REST API security, and a bug bounty spike.

---

This issue of WP More is brought to you by our sub-reddit; join now and start a WordPress discussion today!

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 51, where you get curated news about WordPress and the WordPress community all in one place.

I know, I am one day late. Sorry for the delay!

Nearly half the WordPress plugin directory has gone stale, WooCommerce 11.0 is out with real speed and analytics improvements, your REST API is probably more exposed than you think, small purpose-built plugins deserve a second look, and WordPress 7.0.3 just patched 12 vulnerabilities as AI-assisted bug hunting hits an all-time high.

---

In this Issue:

• The WordPress Plugin Directory Has a Staleness Problem
• WooCommerce 11.0 Brings Speed Gains and Smarter Analytics
• Why You Should Lock Down Your WordPress REST API
• The Case for Small, Purpose-Built WordPress Plugins
• WordPress 7.0.3 Patches 12 Vulnerabilities Amid AI-Powered Bug Bounty Surge

---

The WordPress Plugin Directory Has a Staleness Problem

A new report from WP Goldmine analyzed 60,257 WordPress plugins and found that 43.8% have not been updated in over two years. Among plugins with 10,000 or more active installs, 207 have been abandoned for at least two years, with Limit Login Attempts (300K+ installs) topping that list.

The support data tells a similar story: Classic Editor has 9M+ installs but only a 10% support resolution rate. W3 Total Cache sits at 28%. For plugin developers, every stale high-install plugin is an opening for a modern, maintained alternative. For site owners: audit what’s running. If a plugin hasn’t shipped an update in years and has unresolved support threads, replace it.

Read the full blog on WP Goldmine →

WooCommerce 11.0 shipped this week, and it has concrete speed numbers worth knowing.

---

WooCommerce 11.0 Brings Speed Gains and Smarter Analytics

Variable product pages now load 9-12% faster in WooCommerce 11.0, thanks to a new product object caching experiment enabled by default for new stores. Bundle products are 6-12% faster at checkout too.

Analytics reporting also gets more accurate: refunds now count in the period they happened, making month-by-month figures more trustworthy. Session tracking is stricter, stripping out bots and fleeting connections that were inflating visitor counts. Guest customers can now connect past orders to a new account just by confirming their email. A Checkout Recovery beta lets you test recovery messaging before rolling it out broadly. Note that the experimental Product Editor beta is retired in this release, though your product data stays intact.

Read the full blog on WooCommerce →

Faster sites are good, but most WordPress installs have a security surface that often goes unexamined.

---

Why You Should Lock Down Your WordPress REST API

The WordPress REST API powers the block editor, wp-admin, and dozens of plugins, and by default it exposes quite a bit publicly. A recent deep-dive from WebTNG shows what the API makes visible to unauthenticated visitors, including a full list of registered endpoints from core and active plugins, and walks through why leaving it open is a risk.

Two approaches are covered: restrict API access to logged-in users only, or disable all endpoints by default and re-enable only what your site needs. The latter is more precise. Re-enabling an analytics plugin’s endpoint after a blanket lockdown, for instance, keeps front-end tracking intact without reopening anything else. The public oEmbed endpoint is also flagged as the one implicated in a recent Remote Code Execution vulnerability.

Read the full blog on WebTNG →

How you choose plugins shapes how easy the site is to debug and hand off six months later.

---

---

The Case for Small, Purpose-Built WordPress Plugins

A plugin that does one thing is easier to debug, safer to disable, and clearer to hand off months later. Developer V. Chuy makes the case for single-purpose plugins over all-in-one solutions on client sites, and the maintenance argument is solid.

Large plugins bring extra database tables, frontend assets, unnecessary hooks, and third-party dependencies even when you only need one feature. A small plugin with a descriptive name like client-checkout-rules makes its purpose obvious. The article covers practical safeguards: check dependencies before calling plugin code, validate input, use nonces for forms and AJAX, and decide what happens on deactivation. A WooCommerce example shows how an order flag can live in a compact standalone plugin rather than inside a sprawling tool.

Read the full blog on V. Chuy Develop →

Leaner plugin stacks help, but the WordPress Security Team has had a busy week on core itself.

---

WordPress 7.0.3 Patches 12 Vulnerabilities Amid AI-Powered Bug Bounty Surge

WordPress 7.0.3 shipped with fixes for 12 security vulnerabilities. The most serious is a pre-authentication cross-site scripting flaw on the login screen that could enable remote code execution through social engineering. Sites with automatic updates should already be patched. Backports cover branches back to WordPress 4.7.

Bug bounty submissions to the WordPress HackerOne program hit 450 in July, up from a steady 20-30 per month for the previous decade. AI-assisted research is driving it. After a researcher found a WordPress RCE using OpenAI’s Sol Ultra for roughly $25, rival labs took notice. Anthropic, pwn.ai, and Aikido Security are all credited in this release. WordPress Security Team lead John Blackbourn confirmed GPT 5.3 and Claude Opus 4.6 as the main drivers. WordPress 7.1 remains on track for August 19.

Read the full report on The Repository →

---

WordPress Must Read

→ Patchstack Challenges WordPress.org to Fast-Track Security Fixes Under Protect the Shire (therepository.email) – Patchstack tracked 114 releases and found security patches get held just as long as cosmetic updates under the Protect the Shire policy.

→ For the First Time in 10 Years, I Built a Site With No Page Builder (linkedin.com)

→ WordPress 7.1 Source of Truth (gutenbergtimes.com)

→ Getting Started With the WordPress Abilities API: A Practical Guide (kinsta.com)

→ WordPress Blocks Breaking in 7.1? Here’s Why (youtube.com)

---

On Other WordPress News

→ Our Own Newsletter Took the Site Down (developer.woocommerce.com)

→ Meet the New WordPress Playground Interface (make.wordpress.org)

→ Plugins Directory Release Process Issues (make.wordpress.org)

→ What’s New in Gutenberg 23.7? (05 August) (make.wordpress.org)

→ Iframed Editor Changes in WordPress 7.1 (make.wordpress.org)

→ AI Contributor Weekly Summary – 5 August 2026 (make.wordpress.org)

→ WordPress Credits Adds 10 New Partner Institutions in a Single Month as Education Programs Continue Pushing Into New Regions (therepository.email)

→ Pull Up a Chair for the State of Open Source (us.wordcamp.org)

→ Defensive Data Design (make.wordpress.org)

→ Leaner, Steadier PHPUnit Runs for Upcoming Releases (make.wordpress.org)

→ WordPress 7.1 Beta 4 Is Here (wordpress.org)

→ WordPress 7.1 Release Candidate 1 Ships With Field Guide and 145 Fixes Ahead of WordCamp US Launch (therepository.email)

---

From WordPress Community

→ Perspectives with Josepha Haden Chomphosy (crossword.fm)

→ Ceilingless WooCommerce: Why Merchants Don’t Need to Outgrow Open Source (urumi.ai)

→ Poland Warns of Critical WordPress Flaws That Could Let Attackers Seize Servers (tvpworld.com)

→ Automattic’s Anne McCarthy Joins the PHP Foundation Board (therepository.email)

→ DocsBot Launches Free AI Sidekick for WordCamp US 2026 Attendees, Builds It a Physical Body Too (therepository.email)

→ WPManageNinja Discloses Supply Chain Attack After Forgotten Server Delivers Tampered Plugin Updates (therepository.email)

→ Why I’m Organizing CMS Conf (maciekpalmowski.dev)

→ Md Noruzzaman Receives the Yoast Care Fund for His Contributions to the WordPress Community (yoast.com)

→ 3 Failed WP-Admin Projects, Let’s Go for the 4th! (anchor.host)

→ A Year of Working on My Content: What Happened in Search and AI (alwaysopen.design)

→ Why It Took Me 16 Years to Contribute to WordPress (shifteq.com)

→ AI in WordPress…The New Era (Jeffrey @ Lytbox with Shahjahan Jewel) (youtube.com)

→ What Experts Say About WordPress Future (youtube.com)

---

Until Next Week

WordPress 7.0.3 patched 12 vulnerabilities this week while bug bounty reports jumped from 30 to 450 a month. Patchstack’s data shows those patches sit in the queue just as long as cosmetic updates. Meanwhile, nearly half the plugin directory hasn’t shipped an update in two years, WooCommerce 11.0 brings real speed numbers, and your REST API is probably more open than you think.

Plenty to act on. Have you audited your plugin stack lately? Locked down your REST API? Reply and let me know where you’re at. If this issue was useful, share it with someone in the WordPress world who’d appreciate the roundup.

— Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community

---

The numbers, the risks, and the tools shaping WordPress right now.

---

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 50, where you get curated news about WordPress and the WordPress community all in one place.

Issue 50. Half a century of WordPress roundups. This week we looked into market share projections, a damning PHP audit, a clever client training trick, and an AI security agent that caught a live backdoor before it reached a single site.

---

In this Issue:

• WordPress market share is declining: here’s what the next three years actually look like
• The WordPress.org active install count is easy to fake, and nobody outside WordPress.org can audit it
• Security researchers found 70% of WordPress sites running outdated PHP, and site owners can’t fix it
• WordPress Playground and Blueprints can replace your staging environment for client training
• Wordfence’s AI agent caught a plugin backdoor within two hours, before any site was hit

---

WordPress Market Share: A Realistic 3-Year Forecast

WordPress peaked at around 43.6% of all websites in 2025. By July 2026, W3Techs put it at 41.5%. Nikolai Graf-Rüssel projects a further 1.1 to 1.4 percentage-point annual decline through 2029, landing WordPress above 37% of all websites. AI-first builders like Wix and Squarespace are winning the simple, first-time site segment: restaurants, freelancers, landing pages.

WordPress holds firm for content-heavy sites, WooCommerce stores, agencies, publishers, and anyone who needs plugin depth and data ownership. The lost segment is low-value commodity installs; the defensible segment is managed WordPress with real performance, security, and AI-assisted onboarding.

Read the full blog on his LinkedIn →

That decline depends on a metric worth questioning, and the next story does exactly that.

---

The WordPress.org Active Install Count Nobody Can Audit

Marcin Dudek at MakeWPFast spent a day digging into how WordPress.org’s “active installs” figure actually works. The count comes from unauthenticated update-check requests that anyone can POST to, and anyone can inflate a competitor’s numbers by reporting their slug as active on thousands of invented URLs. The number is rounded to one significant digit (”10,000+” means anywhere from 10,000 to 19,999), has no public history, costs 0.34 KB to fake, and yet drives plugin directory ranking.

Dudek built tooling to record daily snapshots going forward, since WordPress.org publishes no historical data. Before picking a plugin based on install count, treat it as directional at best; nobody outside WordPress.org can verify it.

Read the full blog on his MakeWPFast →

Numbers you can’t audit are a trust problem. Numbers running on dead software are a security problem.

---

70% of WordPress Is Running on an End-of-Life PHP Version

Security researchers at Censys scanned the public internet and found over 70% of publicly visible WordPress sites running outdated PHP. PHP 7.4, which stopped receiving security patches in November 2022, is still the most common engine on the WordPress web. The core problem is an ownership gap: WordPress updates itself through the dashboard, but PHP is a server-level runtime that site owners can’t see or change.

Hosts control it, and most haven’t built fleet-wide lifecycle management for it. The researchers also documented an active defacement campaign targeting these same sites: outdated software, default misconfigurations, no sophisticated exploit needed. The advice to “update your PHP” isn’t wrong; it’s just aimed at people who can’t act on it.

Read the full blog on his WP Maintain →

Not all WordPress news this week is grim. Here’s a practical trick for developers who train clients on block themes.

---

---

Train Clients on Block Themes With WordPress Playground and Blueprints

Elliott Richmond came back from WordCamp Europe wanting to try one thing: WordPress Playground and Blueprints for client training. Playground runs a full WordPress instance in the browser via WebAssembly, no hosting needed. A Blueprint is a JSON file that configures the whole environment on load.

Richmond built a trimmed-down version of a client’s real site (50MB instead of 1GB+), with the custom block theme and plugin intact, so the client could explore, edit, and break things in a safe environment that resets every session. When the client forgets something next month, they just open the same link again.

Read the full blog on Elliott Richmond Site →

And speaking of things that work quietly in the background: the last story is about an AI agent that caught a live backdoor before it reached anyone.

---

Wordfence AI Agent Stops Plugin Backdoor in Under Three Hours

WordPress.org’s Protect the Shire initiative has its first confirmed real-world interception. A supply chain backdoor was planted in the Advanced Responsive Video Embedder (ARVE) plugin (around 20,000 active installs) on July 28. Less than two hours later, Wordfence’s autonomous AI agent PRISM flagged it.

Wordfence notified the WordPress.org Plugins Team at 15:43 UTC, and the plugin was closed for downloads by 16:09 UTC. The entire sequence took under three hours, and because Protect the Shire holds new releases in a cooldown window, the tampered version never reached a single site. The backdoor checked incoming requests for a hardcoded token and, if matched, silently authenticated the attacker as a random site administrator in one HTTP request. PRISM has now found 202 vulnerabilities total, including 88 in the past 30 days.

Read the full report on The Repository →

---

WordPress Must Read

→ The Future of the Website (joost.blog) – Joost de Valk on where websites are heading: agent-readable surfaces, MCP servers, and why authenticity is the only moat left.

→ How WooCommerce.com Speeds Up Requests by Loading Fewer Plugins (developer.woocommerce.com) – How selective plugin loading cut memory use by 50%+ and dropped key endpoint latency from 800ms to 475ms.

---

On Other WordPress News

→ Rethinking Our Monthly Team Meetings (make.wordpress.org)

→ WordCamp Creator Studio, Sponsored by WordPress.com: Available for Sign Ups Now! (us.wordcamp.org)

→ WordPress Credits Student Feedback: The Program Works, Now for Quality and Retention (make.wordpress.org)

→ Proposal: Bringing Back the Meetup Organizer Newsletter (make.wordpress.org)

→ WP Engine Accuses Automattic of Destroying Evidence, Asks Court to Dismiss Trademark Counterclaims (therepository.email)

→ Class Action Against Automattic to Proceed After Judge Finds Company Tracked WP Engine Customers (therepository.email)

→ Jamie Marsland Among Educators Leading WordCamp US 2026 Beginner Workshops (therepository.email)

→ First Student Survey Shows WordPress Credits Building Skills and Satisfaction, With Focus Now On Retention (therepository.email)

→ WordPress Credits Calls for Help Designing a Developer Track Ahead of a US College Pilot (therepository.email)

→ WordPress 7.1 Beta 4 Adds Opt-Out for Responsive Styling, Punts Inherited Styles Display (therepository.email)

---

From WordPress Community

→ WordCamps Are Great, But They’re Not Enough (youtube.com)

→ Why WordPress 7.1 Will Improve Your Workflow (thewpminute.com)

→ Jonathan Jernigan Finally Decided It’s Time to Leave WordPress (youtube.com)

→ Interview with Birgit Pauli-Haack, Anne McCarthy and Nathan Wrigley (wpbuilds.com) – Inside WordPress 7.1: responsive styling, new blocks, media modal, and behind-the-scenes changes.

→ Gogh Is Getting a Lot of Excitement. Should We Build It? (pootlepress.com)

→ Lana Miro: An Unexpected Conversation With a Woman Who Manages to Smile and Laugh in the Middle of a War (seriouslybud.com)

→ Join WP More Sub Reddit, start a WordPress discussion! (reddit.com)*

_{*brought to you by WP More.}

---

Until Next Week

Issue 50, can you believe it? Thanks for being part of this community and for reading along. If any of this week’s stories sparked a thought, hit reply and share it. And if you know another WordPresser who’d enjoy this, pass it on.

Nishat, WP More

---

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community