Issue #271 | May 12, 2026 | Reading time: 23 mins
Hello!
This week on The WP Week Newsletter, we cover the real-time collaboration feature being dropped from WordPress 7.0, the meta-janitors initiative, the release of WP 7.0 RC3, WooCommerce designer’s request for feedback, new projects, and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
🗣️TALK OF THE TOWN
Envato has announced one of the biggest structural changes in the history of its marketplace ecosystem, ending its long-standing exclusive author model and moving all marketplace authors to a flat 50% revenue share starting July 1, 2026.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
It is ready for download and testing. The final release as of now is scheduled for May 20, 2026.
- Real-Time Collaboration Dropped From WordPress 7.0 Following Matt Mullenweg’s Decision: WordPress 7.0 will no longer include real-time collaboration after the feature was removed from the release following a decision by Matt Mullenweg.
- Meta Janitors initiative by Matt Mullenweg to revamp WordPress.org:The initiative gives a selected group of contributors sandbox access to make changes without traditional approval processes on WordPress.org. The goal is to move fast, encourage experimentation, and evolve WordPress.org into a world-class community hub that is simple to contribute to and use, with a long-term vision of being the largest and most secure repository of free GPL code, welcoming to newcomers, technically strong, and sovereign in identity.
- Proposal: Auto-generate Block Editor Handbook docs from block.json: JuanMa Garrido proposes auto-generating Block Editor Handbook documentation from each block’s block.json file to keep Core Block docs always up to date. The system would create per-block API reference pages automatically, reducing manual documentation work.
- Automating WordPress Campus Connect application processing: Isotta Peira outlines work to automate the WordPress Campus Connect (WPCC) application process to reduce delays caused by manual steps like vetting, logging notes, emailing, and site creation. The plan includes AI-assisted first-pass review, a simpler status list, automatic approval actions, and a required agreement checkbox on the application form, all aimed at speeding up and streamlining approvals.
- Mary Hubbard announces Make WordPress Slack is becoming multilingual: It is becoming more multilingual, allowing local WordPress communities to connect in their own languages while being part of the broader contributor ecosystem. This includes bringing Meetup communities, regional WordCamp Slack spaces, and flagship event communities like WordCamp Europe, WordCamp US, and WordCamp Asia into Make Slack. The goal is to centralize contributor collaboration, improve cross-locale collaboration, strengthen ties with global teams, provide access to Slack Pro tools, and preserve knowledge and history, while continuing to support existing local communities.
- Guide to talking at WordPress meetups and WordCamps about the Core AI projects: The guide outlines how to present WordPress Core AI projects at meetups and WordCamps, covering Abilities API, MCP Adapter, AI Client, and related tools, along with talk ideas and demo approaches.
- What’s new in Gutenberg 23.1: This release introduces a custom taxonomies management screen, a new media editor, faster image upload finalization, along with several bug fixes and enhancements.
- WooCommerce REST API docs have a new home: The team has moved the WooCommerce REST API documentation from its standalone site to the main developer documentation site.
- WP Engine and Audrey dispute document production and spoliation allegations: In a joint filing submitted to the U.S. District Court, WP Engine alleges that Audrey HC, LLC and Audrey Capital, LLC failed to produce subpoenaed documents and raises concerns of possible spoliation. While Audrey disputes the claims, arguing that all responsive materials have already been produced through party discovery and that no additional non-duplicative documents exist.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026): Last week, there were 87 vulnerabilities disclosed in 198 plugins and 5 themes.
- Austin Ginder’s analysis found no backdoor in WPFactory’s 83 closed plugins in the WordPress.org repository: The suspected file seems to be only in the premium version, but the analysis did identify guideline violations in 51 of the 83 plugins, involving promotional libraries that silently fetch external content without user consent.
- Authenticated arbitrary file upload vulnerability patched in Slider Revolution 7 WordPress plugin: The vulnerability that makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution has been patched. Users are advised to update to the latest version immediately.
- Hackers abuse Google ads for GoDaddy ManageWP login phishing: A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy’s platform for managing fleets of WordPress websites. The threat actor is using an adversary-in-the-middle (AitM) approach where the fake login page acts as a real-time proxy between the victim and the legitimate ManageWP service.
- TanStack details a major npm supply-chain compromise affecting 42 packages: TanStack published a detailed breakdown of a supply-chain attack that led to 84 malicious versions being published across 42 @tanstack/* npm packages on May 11, 2026. The malicious packages were capable of stealing credentials and spreading to other npm packages before being detected and deprecated within about 20 minutes.
- Critical Apache HTTP server flaw exposes millions of servers to RCE attacks: The Apache Software Foundation has released a critical security update for Apache HTTP Server, patching five vulnerabilities, including a dangerous double-free flaw capable of enabling Remote Code Execution (RCE) in version 2.4.67, released on May 4, 2026. All users running version 2.4.66 or earlier are strongly urged to upgrade immediately.
🔧 TIP OF THE WEEK
Use wp_body_open() (Important)
Tip: Add right after <body>.
<?php wp_body_open(); ?>
Needed for:
- plugins
- analytics
- accessibility
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
The benchmarks are built on 365 days of continuous monitoring data collected from January 1 to December 31, 2025. A total of 30 hosts were tested, of which 17 hosts with full year 365 days data and 13 new providers with Q4 2025 data. A few of the findings are that WP Engine recorded the fastest full-year TTFB at 365ms, Templ achieved the highest uptime at 99.9996%, while Q4 2025 testing showed Pressable leading new providers with a 341ms TTFB and 100% uptime.
- 2026 WordPress Security Survey by MelaPress: The survey consists of 10 questions aimed at gathering insights to improve security across the ecosystem. Also, 3 lucky participants will be selected after the survey ends to win prizes such as Amazon gift vouchers and free plugin licenses.
- EventKoi Tickets Lifetime Deal: The sale will start on May 18th and includes exclusive waitlist offers, including 20 single-site lifetime deals priced at $99 and an additional 20% discount on 3, 10, and 50-site licenses for the first 50 customers.
- WPBakery Birthday Sale: WPBakery is celebrating its 15th anniversary with a birthday sale running from May 11 to May 25, featuring discounts on lifetime licenses, Support Plus subscriptions, and Theme Integration licenses.
- Changes to Envato Market revenue share and exclusivity: Envato announced that from July 1, 2026, it will remove exclusivity requirements and move all Envato Market authors to a single 50% revenue-share model.
- WordCamp Asia 2027 call for organisers received over 160 applications: Julian Song highlighted this, and the applications are open until May 31,2026.
- GravityKit adds cryptographic verification to plugin updates: All plugin installs, updates, and downgrades are now cryptographically verified before installation, blocking any tampered packages to protect WordPress sites from supply-chain attacks. It uses Ed25519 cryptographic signatures to ensure every update is authentic and unaltered before it reaches a site.
- Rocket.net launches Developer Hub and MCP Integration: The MCP Integration allows customers to manage their WordPress sites directly from Claude, ChatGPT, and other MCP-compatible AI assistants or agents, and is available to all customers at no additional cost. The Developer Hub provides documentation and integration resources for the platform’s API and MCP capabilities.
- SiteSkite V2 launches with AI and MCP support: The update enables developers and agencies to connect their own AI models instead of relying on a single provider. The update also adds sandbox creation from backups, safe mode access for crashed sites, staging and production environments, and a redesigned platform experience.
- WPConsent 1.1.5 now available: This introduces a Cookie Inspector for tracking and configuring all site cookies, a redesigned dashboard, a docs overlay for in-admin help, and improved multilingual support.
- SureForms v2.8 launched: This release introduces multiple payment types in one form, new hidden field capabilities for dynamic pricing and calculations, minimum character limits for textarea inputs, and more.
- Pattern Wrangler v2.4.5 live: The update introduces a new quick toolbar in the lightbox pattern preview, the ability to disable pattern revisions network or site-wide, and more.
- Splash Popup 2.0 is now available: It is a complete rebuild and now allows users to create as many pop-ups as they want, each with its own conditions, triggers, schedule, and appearance, along with a dedicated popup editor, five trigger types, new appearance controls, and more.
- Beaver Builder 2.11 beta.1 is out: This introduces new rendering hooks for custom attributes, performance improvements, and several other fixes too.
- Themify introduces multiple backgrounds feature: This features allows users to combine images and gradients within the same element for more advanced designs.
- Builderius now generates full static sites from WordPress: Builderius now allows users to export complete sites with optimized HTML, CSS, and assets and deploy directly to Cloudflare Pages, GitHub Pages, or any static host.
- Self-healing backups now live in WP Umbrella: The feature, as announced by Aurelio, automatically verifies backup against the live site and reruns if anything is missing. They have also launched selective restoration.
- WooCommerce designer seeks feedback on order detail page: Jana is asking users to share their top three improvement suggestions for the Order detail page. The feedback form also asks how often the page is used, the user’s role, what one key fix would make the biggest difference, what they like about the current experience, and whether they are open to a follow-up chat. The team has also been exploring a piñata-themed Easter egg that celebrates merchant sales milestones with interactive characters, including a llama for the 1st sale, an octopus for the 100th sale, and a whale for the 1,000th sale.
- Michal Barus highlights WordPress decline as Astro adoption grows: He highlighted that WordPress market share has dropped from 43.6% to 42.2%, while Astro has reached 2.5M weekly downloads, up from 1.4M last year. He also pointed out moving 12 of 42 sites to Astro and noted that businesses need fast sites that rank and convert, not plugin chaos, asking whether you would still build on WordPress today.
- Lumi questions the future of WordPress themes in the AI era: She reflects on whether WordPress themes remain relevant in an AI-driven landscape where website designs can be automatically generated from design systems.
- James Welbes on how WordPress plugin vulnerabilities should be reported: He highlights the difficulty of responsibly disclosing security vulnerabilities in WordPress plugins, noting that many developers lack clear contact channels and that forum posts are sometimes removed, raising concerns about how researchers are expected to report issues safely when direct communication paths are missing.
- Aki Hamano shares progress on his new app project: The app allows users to edit Markdown files using a block editor interface, and the development is still ongoing.
- David Pérez completes three years on the WordPress Plugins Team: A reflection on three years with the WordPress.org Plugins Team highlights massive growth in plugin submissions, major security challenges, and the development of tools like Plugin Check, internal dashboards, and AI-assisted workflows to help manage increasing scale and improve plugin review quality.
- Ooi Peng Hao receives the Yoast Care fund for his contribution to the WordPress community: Ooi Peng Hao, a member of the WordPress community, is the latest recipient of the Yoast Care fund.
- Pledge time to improve WordPress accessibility on Global Accessibility Awareness Day 2026: Equalize Digital is inviting interested folks to participate in Global Accessibility Awareness Day (GAAD) 2026 on May 21, 2026. So far, 49 people have pledged 188.5 hours.
- Meetomattic launched: A new project that shares a public directory of venues where Automattic teams have actually met in person, offering practical notes from real distributed team retreats and aiming to help other remote teams plan their own gatherings.
- FlipQuiz has been relaunched: A tool by Marcus Burnette for creating, customizing, and playing quiz‑board style games. It’s now relaunched with WordPress under the hood, after Marcus closed down the project in 2019.
- Introducing AutoVault: A new project by Jack Arturo, this is a capability library backed by SQLite with local stdio and remote MCP entry points that store filesystem-native skill directories and provide a single place to resolve tools, MCP servers, and reusable SKILL.md files.
🚀 NEW PROJECTS
| “WordPress runs anywhere. Why doesn’t your knowledge base?“ Héctor Prietor about creating the Cortext. |
- Cortext: A Radical Speed Month project by Héctor Prieto and Miguel Fonseca, the plugin that lets you create and manage a knowledge base directly on your own website, with support for nested pages, structured collections, multiple content views, and publishing through WordPress.
- Universally: An AI-powered translation platform for WordPress.
- Rudrastyh Simple Media Library Folders: Developed by Misha Rudrastyh, the plugin allows to easily organize media files into folders.
- Swish Migrate and Backup: A new backup and migration plugin by Deno, with cloud storage support and no limits.
- FrameBlocks: The plugin allows users to embed polished UI mockups directly inside the WordPress editor.
- Feather: A performance plugin for WordPress sites built with Elementor. It stops telemetry, throttles WordPress overhead, cleans the database, and trims your frontend.
- My Favorite Plugin List: Created by Nico Arche, the tool lets users create reusable WordPress plugin installation lists using plugins from WordPress.org and custom ZIP uploads, with one-click deployment across connected sites.
- AI Prompt: A new Gutenberg block developed by Fatih Kadir Akın that renders interactive AI prompts inline.
- Data Machine: Developed by Chris Huber, the plugin turns a site into an agent runtime.
- Gravity Forms Autogrow: The plugin lets Gravity Forms Paragraph Text fields automatically expand as users type, up to a maximum height you control.
- SheetsPilot: This allows users to manage, update, and automate their WordPress content from one smart spreadsheet with a built-in AI assistant.
- Borges Bibliography Builder: Developed by Dan Knauss, the plugin transforms pasted DOI(s), PubMed/PMID records, BibTeX entries, and citations into a semantically rich, auto-sorted reference list.
- WooCommerce for Claude: A Radical Speed Month experiment by Gary Murray and Lourens, this adds an intelligence layer on top of WooCommerce MCP and introduces analytics skills, a knowledge layer for store context, and an AI-readiness scoring system, all delivered through a single MCP endpoint.
- HelloDolly.fun: A Radical Speed Month project by Ronnie Burt, this explores building an AI agent system on top of WordPress multisite to make Open Claw more accessible.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- In this Melapress Live Show episode, application security professional Matthew Rollings explains RegexXSS, a type of vulnerability where improper use of regular expressions on sanitized HTML can introduce cross-site scripting risks.
- On this episode of The WP Minute+ podcast, Eric speaks with Matt Schwartz, founder of CheckView, about building a SaaS in the WordPress ecosystem. They discuss his transition from agency work, choosing SaaS over a plugin, market research, and lessons for aspiring founders.
- In this episode of Go with WP, Shiva Shanker Bhatta conversed with Katie Keith, who revealed why most WooCommerce stores fail at the finish line and how AI is revolutionizing the checkout experience in 2026.
- Rob Cairns is joined by Michelle Frechette in this episode of the SDM Show podcast for a candid conversation about mental health and the reality of professional burnout.
- Javier Casares argues that while Astro excels in performance for static sites, WordPress remains the better choice as a CMS because it gives users full control and independence to manage and update their content without relying on developers.
- Tyler Leeds from Automattic explains how the team ensured reliable Wi-Fi and livestreaming at flagship WordCamp events like WordCamp Asia, using careful network design, testing, and failover planning to keep both connectivity and streams stable under heavy real-world conditions.
- Jamie Marsland argues that AI is turning everyday communication into a paid utility, where emails, documents, and messages increasingly come with a cost attached to every prompt.
- Dorcus Nalubega shares her experience attending WordCamp Asia 2026 in Mumbai as a Kim Parsell Memorial Scholarship recipient and volunteer, reflecting on community, cultural experiences, and personal growth throughout the event.
- Devin Walker says that WordPress builders should focus on specific business niches and use WordPress mainly as a distribution channel for SaaS products rather than the product itself.
- James Giroux argues that as AI agents increasingly read web content, websites need claim-level receipts that attach trust signals so agents can reliably decide what to believe and act on.
- Brian Coords expands on the case for no-code content modeling in WordPress core, in light of experimental Gutenberg work on a UI for custom post types.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- The missing guide to SEO domain migrations: From Joost de Valk
- Getting started writing WordPress E2E Tests with Playwright: From WordPress Developer Blog
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp Europe 2026 on June 4-6: The call for sponsors is now open. The tickets are also now available and the Side Event applications are now open. The full schedule has been published.
- WordCamp US, Phoenix on August 16 -19 2026: The call for sponsors, speakers, and volunteers is now open. The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The event is in the early planning stages and call for sponsors has been closed.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors, speakers is open. Also interested folks can apply to be a part of the Translation Team.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and speakers is now open.
- CMS Conf 2026 on 12-14 November: The call for speakers is now open and the tickets are now available.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
Envato, a creative marketplace acquired by Shutterstock in 2024, has announced one of the biggest structural changes in…
In a joint filing submitted to the U.S. District Court, WP Engine alleges that Audrey HC, LLC and…
#WPLDN, the monthly WordPress-focused meetup in London running since 2008, has issued a call for sponsorship following shifts…
WordPress 7.0 will no longer include real-time collaboration after the feature was removed from the release following a…
Team WP-CONTENT.CO
Issue #271 | May 12, 2026 | Reading time: 23 mins
This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
Built with Newsletter Glue.