Issue #270 | May 5, 2026 | Reading time: 22 mins
Hello!
This week on The WP Week Newsletter, we cover Themeum merging its no-code builder Droip into Kirki, Call for host cities for WordCamp India, an open letter to WooCommerce and Woo Community by Rodolfo Melogli, new UI for managing Custom Post Types in Gutenberg, new projects, and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
🗣️TALK OF THE TOWN
Themeum has integrated Droip into Kirki, transforming the widely used customizer toolkit framework plugin into a combined website builder and customizer, a move that expands its capabilities while sparking debate over its changing direction.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
The WordPress Community team has officially opened the call for host cities for WordCamp India, which will debut as the fourth flagship WordCamp event. Applications are now being accepted, with a deadline at the end of June 2026.
- Peer review requested for hands-on WordPress Meetup Activity Library: Destiny Kanno is building a free library of structured, peer-reviewed kits to help WordPress meetup organizers run hands-on activities instead of just presentations. Each kit will include facilitator guides and slides across topics like plugin development, Gutenberg blocks, performance, SEO, security, WooCommerce, and more, with peer review support and an AI prompt set to help organizers create their own sessions.
- WP Accessibility Knowledge Base updated: Rian Rietveld shared an April 2026 update to the WP A11y Docs, introducing new and expanded guidance on alternative text, headings, links, an introduction to WCAG, and more. Work is also underway on accessibility testing documentation, updates to the Themes Handbook accessibility-ready tag, and a proposed “Can I Use” section for core block accessibility status.
- WordPress Academy for young people in Krakow: This was a pilot project of the Polish WordPress community that brought over 60 high school students together for a hands-on introduction to WordPress, where they learned setup, SEO, accessibility, AI use, and live development while building seven different real-world school projects.
- WordPress Student Clubs build momentum: WordPress Student Clubs are extending Campus Connect by turning one-time workshops into ongoing, student-led communities on campuses. This early impact is already visible in events like the International Women’s Day celebration in Ajmer, where more than 50% of attendees came from student clubs, showing how campus activity is beginning to connect directly with the wider WordPress community.
- Gutenberg 23.2 will add a UI for managing Custom Post Types: This will allow users to manage custom post types natively and naturally from the WP admin interface.
- WooCommerce Subscriptions Health Check Tool released: This allows WooCommerce store owners to review and find out subscriptions that are on manual renewal instead of auto-renewal. This tool comes as a response to a bug that was identified and reported by Sybre Waaijer.
- Breeze Cache plugin security advisory: A security vulnerability in Breeze Cache (versions ≤ 2.4.4) that could allow unauthenticated file uploads and remote code execution under specific configurations has been patched. Users are advised to update to the latest version immediately.
- Austin Ginder uncovers two more plugins with a backdoor: Scroll To Top plugin (20,000 installs) was found using a hidden external update channel that delivered a modified version with content-injection capabilities outside WordPress.org’s control. After the report, WordPress.org closed the plugin and released a cleaned version, but sites that previously received updates from the external channel may still remain affected unless manually cleaned. Secondly, the Quick Page/Post Redirect plugin was also found to have a backdoor, and the Plugins Team has temporarily closed the plugin for now.
- cPanel zero-day exploited for months before patch release: A critical cPanel zero-day (CVE-2026-41940) has been actively exploited in the wild since at least February before a patch was released in April. The vulnerability was reportedly exploited before public disclosure, and although patches are now available, millions of exposed instances remain at risk, prompting urgent updates and firewall mitigations from hosting providers.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 20, 2026 to April 26, 2026): Last week, there were 157 vulnerabilities disclosed in 122 plugins and 27 themes.
- PyTorch Lightning compromised with two malicious package versions published: A supply chain attack on the PyTorch Lightning package saw two malicious versions (2.6.2 and 2.6.3) uploaded, embedding code that steals developer credentials and propagates infected packages.
- Court orders sworn declaration from Matt Mullenweg: The Judge has ordered Matt Mullenweg to provide a sworn declaration addressing alleged deletion and preservation issues involving Signal messages, X posts, Slack communications, and WordPress plugin reviews, citing incomplete discovery responses and requiring detailed explanations ahead of deposition. Also, the Judge has denied Automattic’s request to force a separate device search of Silver Lake executives.
🔧 TIP OF THE WEEK
Avoid Hardcoding URLs
Tip: Always use:
get_template_directory_uri()
home_url()
site_url()
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
Rodolfo Melogli reflects on the WooCommerce ecosystem, highlighting its strength in open-source freedom and community, while urging WooCommerce and its users to collaborate more closely to shape its future.
- How to get started contributing to WordPress course: The WP Minute has launched a beginner-level course led by Topher DeRosia that aims to help users start contributing to WordPress by understanding the ecosystem, exploring different contribution paths, and learning how to get involved in the community.
- #WPLDN is looking for sponsors to sustain free London WordPress Meetups: They are inviting sponsors to support its long-running free WordPress meetups in London, helping cover costs like venue hire, recordings, and event essentials to keep the community open and accessible.
- Uganda Website Projects Competition 2026: This will take place on Tuesday, 9th June 2026, at Busoga College, Mwiri, bringing together 20 teams of students competing in three categories: Cubs (12 and below), Rising Stars (13–18), and Explorers (18+) to showcase their WordPress-based web design skills and creativity.
- ZipWP prices slashed: The Starter plan is now priced at $4.99/month, down from $14.99, while the Pro plan has dropped to $9.99/month from $29.99, and the Business plan to $14.99/month from $44.99. These discounted rates apply to the 4-year term, with discounts also available on 1-year and 2-year plans.
- Hostinger’s 2025 Sustainability Report: The report highlights strong AI-driven growth alongside continued progress in sustainability, security, and social impact. The company expanded its AI tools, served 4.6M+ customers, and kept data centers fully powered by renewable energy.
- Syde celebrates its 20th anniversary: On this occasion, they have reflected their journey from Inpsyde, founded in 2006 as one of Germany’s earliest WordPress agencies, growing from early community contributions and plugin development into a global enterprise team of 130+ people across 40+ countries.
- Introducing the new and improved Ollie Pattern Library: The Ollie Pattern Library has been redesigned with a faster browsing experience, a unified design system, and new Ollie AI features like AI-powered search, curated prompts, and the “Inspire Me” tool to help users quickly find and assemble page layouts.
- New WooCommerce product variations editor prototype: Poli Gilad and James Kemp are testing a redesigned product variations editor for WooCommerce as part of Automattic’s Radical Speed Month, sharing an early prototype and inviting feedback to improve how merchants manage variations.
- Beaver Builder AI is coming soon: The teaser shows an upcoming AI builder that will allow users to build websites with prompts.
- LifterLMS 10.0 releasing soon: The upcoming version will introduce new tools for live learning, automated revenue recovery, faster course building, and a more focused learner experience. They are also running a LifterLMS Infinity Bundle Lifetime license giveaway.
- Quick Edit is now a part of the WooCommerce Product Catalog experience: Luigi Teschio provided a preview of it, and it’s still a work in progress.
- Unlimited launched by WPMU DEV: This is a new hosting plan that lets users run 50+ WordPress sites on a single server for $15/month.
- A new milestone for WP Umbrella: The plugin now has over 70,000 active installations.
- FlyWP v2026.40 released: The update introduces direct installation of Cloudflare Origin CA certificates from the dashboard, along with UI improvements.
- MailerPress 2.0 is now available: This introduces new features, including advanced email automation workflows, full customization of WordPress and WooCommerce emails, improved template management, expanded sending options, and new integrations.
- Scanfully v1.9 is here: The release introduces Email Deliverability Monitoring, allowing WordPress sites to verify not just if emails are sent, but if they actually reach an inbox.
- Several new features arrive in ModularDS: The update introduces new tools for migrating and cloning WordPress sites, creating staging environments, and restoring backups with one click.
- New blogging theme on WordPress.com: Dave Martin and Joseph Scott have introduced the Blurt theme, designed for short-form blogging, offering a simple way to publish quick posts, replies, and reblogs.
- All new Concilium: A new project by Jonathan Bossenger as a part of the Radical Speed Month at Automattic, this is a locally-installed multi-agent orchestration dashboard.
- The design team at Woo has officially joined X: They will use the platform to share their work and hear feedback from the community.
- Anita on why WordPress plugin developers are missing their real buyers: She questions why many plugin developers focus mainly on technical audiences while overlooking end users like bloggers, DIY site owners, and small businesses who actively buy WordPress products. She contrasts this with theme designers who consistently market, collaborate, and use multiple channels to stay visible and reach buyers.
- Rayhan Arif on the rise of “Leaving WordPress” posts: He questions the growing number of such posts that point to Astro, noting that many don’t show any clear history of actually using WordPress and suggesting the trend feels less organic and more like a coordinated push or narrative.
- Jason Coleman seeking developer for EmDash and Astro project: He is looking for a developer to build membership and payment features for EmDash and Astro, offering funding and guidance to someone willing to actively collaborate with the EmDash team and contribute to their open source vision.
- Secure Custom Fields has a handbook on WordPress.org: It is the fork of ACF, and Cameron Jones highlighted how it has a handbook page.
- vlt doubles open source pledge to $14,000: vlt has increased its contribution to $14,000 for 2025–2026, committing $3,500 per engineer through the Open Source Pledge and reinforcing its commitment to funding the open source projects it relies on.
- Ghost is now a digital public good: Ghost has been reviewed and is now recognized by the Digital Public Goods Alliance (DPGA) as a digital public good.
🚀 NEW PROJECTS
| “What started as a small replacement for an abandoned plugin slowly turned into something much bigger: a flexible image creation system for WordPress publishing workflows.“ Xaver about creating the CoverKit. |
- CoverKit: Created by Xaver, it allows users to turn their posts, products, and custom fields into repeatable, branded visuals on their own server, within their existing workflow.
- WP HealthKit: This is an AI-powered WordPress plugin and theme security audit tool that runs 39 verification layers using 26 deterministic scanners and 4 AI engines. It analyzes uploaded ZIP files to deliver findings, severity levels, and exact code fixes, with features like an autofix engine and continuous site monitoring.
- Recently Edited: Developed by Jon Schroeder, the plugin is designed to speed up site development by making it easier to navigate, manage, and edit content from anywhere, with features like quick navigation, inline editing, and one-click access to key post details.
- EU Withdrawal Compliance: The plugin by Fernando Tellado, adds the EU online withdrawal function required by Directive (EU) 2023/2673, which is mandatory from 19 June 2026 for every online retailer in the European Union.
- WP Block Composer: This is a dynamic WordPress block generation tool for exploring block configurations and generating boilerplate code.
- WP Beacon: A new project by Austin Ginder, it tracks every plugin on WordPress.org, its authors, committers, and releases, to flag ownership transfers, dormant-then-activated takeovers, and release patterns that match known attacks.
- Wp-block-grab: The new tool by Slava Abakumov helps AI coding assistants work more accurately with the WordPress Block Editor by pinpointing the exact source file, component, and line number behind any clicked element, making it easier to identify and edit the right code.
- Shorthand for WordPress: The new plugin brings the Shorthand editor directly into WordPress, thereby allowing users to create and publish stories directly from their website without needing to create stories in Shorthand and later embed them.
- GigPress Reborn: András Guseo has revived the GigPress plugin, and this allows users to manage and display live shows, tour dates, artists, and venues.
- Static Site Importer: Created by Chris Huber, this plugin allows users to import static HTML sites into WordPress block themes.
- YouTube Video Sync for WP: The plugin by WebDevStudios connects users’ YouTube channels to their site and automatically imports videos as native Video posts with complete with titles, descriptions, featured images, and embed-ready links.
- rtCamp has released three new connectors for the WordPress AI plugin: Connector for OpenRouter, Connector for LM Studio, and Universal Open AI Connector are now available.
- CraftForms: A new form builder plugin that lets users create professional forms quickly with a visual drag and drop interface, built in spam protection, email template design, and built-in REST API endpoints.
- Introducing The Guild: Remkus de Vries announced The Guild, a paid membership for WordPress builders, developers, and agencies focused on improving their craft through structured learning, practical frameworks, and focused discussions aimed at leveling up real-world skills and decision-making.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- On this episode of Do the Woo, hosts Katie Keith and James Kemp are joined by Patrick Rauland, Remkus de Vries, and Rodolfo Melogli to reflect on Checkout Summit in Palermo and share ideas and practical lessons from the event.
- Robby McCullough, co-founder of Beaver Builder, joined the WP Tavern Jukebox podcast to reflect on over a decade of shaping WordPress workflows, unpack why his team held back on early AI hype, and more.
- On The WP Minute’s Agency Action podcast, Toby and Kurt argue that AI isn’t replacing agencies, but that many are limiting growth through underpricing and should adapt by embracing AI, productizing services, and focusing on recurring, growth-driven models.
- Ivana Cirkovic from WPBakery recaps CloudFest 2026 as a key industry event where the focus shifted to real-world infrastructure challenges, with AI, security, compliance, and digital sovereignty at the center. They also recapped Web Agency Summit 2026 as a four-day deep dive into how agencies must evolve, with key themes shifting from systems and AI adoption to ownership and clarity.
- Daniel from WP103 tested WordPress by installing 300+ plugins on a fresh site, monitoring performance, errors, and server resources.
- Chris Lema argues that while WordPress 7’s AI features improve content creation, they don’t solve the core challenge of design, which is an architectural problem about where design decisions live.
- Daniel Miessler argues that most companies aren’t truly ready for AI, not because of the technology, but because they lack clear goals, structure, and self-awareness.
- Mitchell Hashimoto announces that the Ghostty project is leaving GitHub, citing ongoing outages and reliability issues that have disrupted his workflow.
- Lora Raykova explores how ACF Blocks and native Gutenberg blocks differ in real-world WordPress workflows, highlighting that the choice is less about capability and more about development approach.
- Michal Barus shared why his agency left WordPress for a lean, AI-powered stack, trading plugins and manual work for faster performance, lower costs, and simpler workflows.
- Varun Dubey breaks down how WooCommerce plugin bloat is hurting store performance in 2026, and shows how profitable stores avoid conflicts by running lean, well-audited plugin stacks.
- Remkus de Vries says that AI is no longer just a tool for code or content in WordPress, but is reshaping how WordPress businesses operate, from products and services to support, strategy, and customer expectations.
- Adithya Kane marks the 300th essay of HeroPress by reflecting on Topher DeRosia and his impact in creating a space for people across the WordPress community to share their stories.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- AI for WordPress QA Testers: From Varun Dubey
- Building custom WP-CLI commands for massive data migrations: From DeliciousBrains
- Manage your Media Library with AI: From WordPress.com
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp Europe 2026 on June 4-6: The call for sponsors is now open. The tickets are also now available and the Side Event applications are now open. The full schedule has been published.
- WordCamp US, Phoenix on August 16 -19 2026: The call for sponsors, speakers, and volunteers is now open.
- WordCamp Rajasthan 2026 on 3–4 October: The event is in the early planning stages and call for sponsors has been closed.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors, speakers is open. Also interested folks can apply to be a part of the Translation Team.
- WordCamp Canada 2026 on November 5-6: The call for sponsors is now open.
- CMS Conf 2026 on 12-14 November: The call for speakers is now open and the tickets are now available.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
WordPress development has long been divided into two distinct worlds: the PHP-driven backend that millions of developers built…
Themeum has integrated Droip into Kirki, transforming the widely used customizer toolkit framework plugin into a combined website…
The WordPress Community team has officially opened the call for host cities for WordCamp India, which will debut…
Hostinger has a new deployment solution for developers – “a new way to deploy Node.js apps”—focused on speed,…
Team WP-CONTENT.CO
Issue #270 | May 5, 2026 | Reading time: 22 mins
This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
Built with Newsletter Glue.