The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#286 – Rank Math Drew Scrutiny, WP 7.1 Released, Core Security Initiative, WP Signs Open Weights & American AI Leadership Letter

Issue #286   |   September 2, 2026   |   Reading time: 27 mins

Hello!

This week on The WP Week Newsletter, we cover the community discussion around Rank Math plugin, the release of WordPress 7.1, WordPress signing the Open Weights and American AI Leadership Letter, the pushback faced by the official WordPress.org X account, a new API proposal, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HostPapa and HireZoot

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

Sybre Waaijer (founder of The SEO Framework plugin) said Rank Math 1.0.277 closed about a dozen security issues while also introducing functionality that gives group.one administrative access to connected sites. He said opening Help & Support while logged into a free Rank Math account automatically creates a WordPress Application Password for the administrator and sends it to group.one’s servers, without asking for permission first. Waaijer noted that the password provides administrator-level access and does not expire automatically, and advised affected users to revoke Application Passwords beginning with “WAP –”.

Rank Math has now temporarily removed its Support Agent after users raised concerns. Version 1.0.277.2 and later stops new credentials from being created while Rank Math rebuilds the access-request flow to make permissions and user consent more explicit.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

WordPress.org X account once again faces pushback from the community

The issue stems from downtime faced by sites using the WP Rocket plugin after the release of WordPress 7.1, where a bug that was reported months ago went unpatched.

With regard to the issue, the official WordPress.org account tweeted, “ Ouch, telling people not to update… this wasn’t a bug in 7.1. Perhaps consider your usage of @wp_rocket. This is also part of the risk of using plugins outside the official plugin directory, which has many alternatives that seemed fine on the 7.1 release day.” A day before this, Matt Mullenweg also tweeted, “Did your rocket explode? Get a @Jetpack. 🚀”

Later, WP Rocket published a post-mortem on the outage explaining that a change in WordPress 7.1 caused its Cloudflare module to pass an integer to PHP’s substr() function under specific plugin combinations, resulting in fatal errors. The company estimates that around 27% of WP Rocket sites were at risk and roughly 10% were impacted, while acknowledging that its testing failed to catch the issue because it did not cover some widely used plugins, including Elementor Pro. WP Rocket has since released a fix and outlined changes including assigning ownership of GitHub reports, expanding compatibility testing, and preventing the Cloudflare module from running when the Cloudflare plugin is inactive.

  • WordPress 7.1 “Mary Lou” released: The second major release of the year has been released and includes contributions from more than 800 people worldwide, including over 170 first-time contributors. It brings responsive styling, a new media editing workflow, Playlist and Tabs blocks, improved Notes, accessibility updates, client-side media processing, a public SVG Icon API, and more.
  • WordPress Signs the Open Weights and American AI Leadership Letter: Mary Hubbard announced that WordPress has signed the Open Weights and American AI Leadership letter, joining more than 270 companies and organizations calling on US policymakers to avoid early restrictions on open-weight AI models. The letter also urges greater access to computing resources, shared datasets and evaluation tools, and continued availability of multiple AI models to support innovation.
  • New Secrets API proposal for WordPress 7.2: The proposal would give WordPress a first-party way to securely store and retrieve credentials, replacing the current practice of keeping secrets in plaintext in the options table. It also includes WP-CLI support, encrypted storage, secret versioning, capabilities, and replaceable storage and keyring providers, while leaving a dedicated admin UI for WordPress 7.3.
  • WordPress security Team begins the Core Security Initiative: The initiative focuses on improving the security release process with more automated testing, reducing the backlog of open security reports and known issues, and using AI-assisted scanning and tooling to find vulnerabilities before they can be exploited.
  • WordPress community groups are getting an open-source alternative to Meetup: An early beta based on GatherPress is now available for testing on events.WordPress.org. The team is asking the community to use it as they would a real local community group and provide feedback on usability, missing features, bugs, and design.
  • What’s new in Gutenberg 23.8: The update adds shareable URLs and code diffs to visual revisions, email notifications for users mentioned in notes, major List View improvements for large posts, and more.
  • WordPress Playground can now run legacy releases directly in the browser: The update lets users explore WordPress versions from 0.7 through 6.2 with compatible PHP runtimes automatically selected, including PHP 5.2.17 for older releases.
  • Telex has been retired: First announced almost a year ago by Matt Mullenweg at WordCamp US 2025, the AI-powered project allowed users to generate custom Gutenberg blocks from text prompts. Its homepage recommends WordPress.com’s AI Website Builder for creating entire websites with AI, and WordPress Studio, Claude Code, Codex, or Grok for other generative coding needs. Users can still log in to download projects they previously created.
  • WordPress Accessibility team introduces the Accessibility Lab plugin: The early prototype gives the WordPress Accessibility team a place to test potential Core changes and bring useful accessibility tools together. Its first modules include Media Library view options, block accessibility checks, and heading-order validation, with the community invited to test the plugin and help shape its future.
  • Matt Mullenweg asks WordPress community members to get up to speed on AI: Following WordCamp US, Mullenweg recommended resources on how AI models are trained, uncensored models, and the rise of open-weight models such as Qwen, DeepSeek, Kimi, and GLM. He also encourages readers to run an open-weight model locally and bring what they learn to their next meetup.
  • SC 4.0.3 self-healing WordPress malware that rebuilds itself: MD Pabel provided an analysis report of the malware, documenting how it can rebuild deleted files through multiple persistence mechanisms spanning plugins, drop-ins, themes, the database, ZIP archives, shared memory, and browser service workers. The report also details credential theft, hidden administrator accounts, communication with remote servers, and the ability to spread to other WordPress sites under the same hosting account.
  • Unauthenticated PHP object injection to remote code execution patched in GiveWP: GiveWP versions 4.16.7.1 and below are affected, allowing attackers without an account to execute arbitrary commands on vulnerable sites. The issue was fixed in GiveWP 4.16.7.2, and all users are to update immediately.
  • 400,000 WordPress sites affected by account takeover vulnerability in TranslatePress WordPress plugin: The vulnerability allows unauthenticated attackers to obtain an administrator’s password reset link, reset the account’s password, and log in as that administrator, resulting in complete site takeover. The issue has been aptched and users are to update immediately.
  • Wordfence Argus finds complex 6 step critical RCE in Avada Theme with 1 million sales: The vulnerability affects Avada versions up to 7.16 when used with Fusion Builder up to 3.16, allowing unauthenticated attackers to chain six separate weaknesses into arbitrary PHP code execution and potentially complete site compromise. ThemeFusion fixed the issues in Avada 7.16.1 and Fusion Builder 3.16.1.
  • 100,000 WordPress sites affected by privilege escalation vulnerability in Pods WordPress plugin: The vulnerability allows unauthenticated attackers to gain administrator-level privileges and carry out various administrative actions, including changing the password of any user account, even the site owner’s, potentially resulting in complete site takeover. All users are advised to update to the latest version.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026): There were 240 vulnerabilities disclosed in 184 plugins and 17 themes.
  • Amazon EC2 marks 20 years of powering cloud computing: Amazon EC2 has grown from a single instance type in one AWS Region to more than 1,200 instance types across 39 Regions, expanding into AI workloads, custom silicon, and new deployment models.

🔧 TIP OF THE WEEK

Use WordPress Script Loading Strategies

wp_enqueue_script(
‘theme-app’,
$src,
[],
$version,
[
‘strategy’ => ‘defer’,
‘in_footer’ => true,
]
);

Use defer for scripts that don’t need to execute immediately.

Why it matters:
It gives WordPress control over script dependencies while reducing render-blocking JavaScript.

💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS

  • DuckLabs to Join AWS: DuckLabs, the company behind DuckDB, is joining Amazon Web Services (AWS) in early September. DuckDB, DuckLake, Quack, and other Duck Stack projects will remain free and open source under the MIT license, with the DuckDB Foundation continuing to oversee them.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

The survey presents the results of an independent, anonymous survey of people involved with, building on, contributing to, or interested in the WordPress open source project. Conducted between May 27 and July 17, 2026, the survey received 431 responses to 231 questions. The report highlights 11 findings related to areas including attitudes toward WordPress and open source, community participation, governance and leadership, belonging, AI, and views on the future of WordPress.

  • WordCamp Asia 2028 opens call for host city: The deadline to apply is November 8, 2026, and the host city will be announced during the closing remarks of WordCamp Asia 2027. The team has also shared details about how organizers for WordCamp 2027 were selected, outlining the review process, how team leads and co-leads were chosen, and how the final teams were formed.
  • LoopConf 2026 has been postponed: The organizers said the postponement follows a “crushing turn of events” for the conference’s largest sponsor. All attendees have been refunded and their non-refundable expenses covered, while details about the event’s new direction and 2027 dates will be announced later. The conference is still planned for Grand Rapids, Michigan.
  • WP Accessibility Day is seeking sponsors as the conference faces a funding shortfall: Amber Hinds says WP Accessibility Day is currently running at a loss after a difficult year for sponsorships. She points to last year’s 2,297 attendees from 64 countries, making the virtual conference comparable in size to WordCamp Europe and about 1,000 attendees larger than WordCamp US. Hinds says virtual sponsorship is significantly more affordable than sponsoring a WordCamp while still offering strong reach and access to an opted-in attendee list, and notes that sponsors have only a few days to sign up, with applications able to be fast-tracked.
  • WP Buffs expands its collaboration with Equalize Digital: The expanded partnership will offer accessibility scanning and auditing services, with Equalize Digital conducting the audits and WP Buffs implementing the recommended fixes. The services include Micro and Full Accessibility Audits aimed at helping site owners improve accessibility and meet WCAG requirements.
  • Zooey becomes the first theme to pass the updated Accessibility-Ready Guidelines: Amber Hinds brought this to attention on the #accessibility-testing Slack channel.
  • Contact Form 7 remains the most detected WordPress form plugin in 2026: GravityKit’s analysis of HTTP Archive data from July 2026 found Contact Form 7 detected on 29.74% of WordPress sites, followed by Gravity Forms at 3.53% and WPForms at 2.43%. Gravity Forms was the only plugin with a year of history to gain share, while Contact Form 7, WPForms, Ninja Forms, and Formidable Forms declined.
  • Austin Ginder says WordPress hosts should probe the next core against live plugins: He said WordPress 7.1 caused PHP fatals on 124 of Anchor Hosting’s 332 production WP Rocket sites when Elementor Pro or another plugin introduced integer filter keys that triggered a strict-types error. Ginder said no web hosts caught the issue before the release, despite hosts having access to thousands of real production combinations that plugin vendors cannot recreate in their testing environments. He reproduced the problem by sideloading the upcoming core against a live site’s database, plugins, and theme without replacing the production core, and built a CaptainCore script to probe future releases before deployment.
  • Nathaniel DeHaven says plugin developers providing small WordPress tweaks are on borrowed time: He said he used AI to build his first custom functionality plugin for a specific WooCommerce client need, completing it in two hours without extra database bloat or unnecessary plugin files. He said future features could be added with one to three prompts, and that he and his client avoided the $20–$100 annual cost of paying for a solution. He said the experience led him to conclude that plugin developers providing small tweaks or niche custom functionality to WordPress are on borrowed time.
  • Ross Morsali explains how his team made Search & Filter up to 30x faster: He said the team spent three months rewriting Search & Filter’s indexer from the ground up, and they moved away from the traditional array-based approach to bitmap-based indexing, introduced different table structures for range fields, choice fields, and WooCommerce product variations, and added native advanced search with fuzzy and typo-tolerant search, BM25 scoring, and autocomplete.
  • Brad Vincent is using AI agents to try to recover FooPlugins’ lost SEO traffic: He said FooPlugins.com lost about 70% of its Google Search clicks year over year, with about 95% of the lost clicks coming from blog posts, documentation, and support content. He outlined an AI-agent setup that uses data from Google Search Console, Google Analytics 4, Microsoft Clarity, Freemius, Elmo, DataForSEO, and the live site too.
  • Satyam Vishwakarma reflects on two years of contributing to WordPress: In his transparency report, Vishwakarma details his journey from attending his first WordCamp to contributing across multiple teams and creating open-source plugins. He also discusses the financial strain and burnout that followed his commitment to contributing, the health crisis that led him to step back, the support he received, and his concerns about contributor opportunities and how some community processes are handled.
  • New milestone for WP Umbrella: Aurelio Volle announced that WP Umbrella has crossed $2 million in ARR, saying the company is bootstrapped and almost entirely organic.
  • Torsten Landsiedel thinks WordPress needs a new approach to security: He proposed creating a new WordPress security team modeled more like the AI team, with a focus beyond reacting to security issues, fixes, and backports. Landsiedel suggested the team could develop new security ideas in a feature plugin and asked others whether they agreed.
  • CookieYes brings cookie consent management to Claude with its new MCP server: CookieYes has launched an MCP server that lets Claude manage cookie consent settings through natural-language requests, including checking banner status, running cookie scans, retrieving embed codes, and updating banner styling. The server is available through Claude’s connector directory and works with Claude, Claude Desktop, Claude Code, and other MCP-compatible clients.
  • ACF PRO 6.8.9 is here: The update makes V3 the default for ACF Blocks without an explicitly set version on WordPress 7.1 and later, while adding a new renderPreview option for V3 blocks to disable live previews. The release also automatically handles certain legacy V2 edit-mode settings, fixes inline editing and other field issues, and includes a temporary compatibility plugin for teams that need more time to move from V2.
  • Easy Digital Downloads adds 10+ ready-made Elementor checkout templates: The new templates give digital stores pre-built checkout layouts with conversion-focused elements, while making each checkout section a separate Elementor widget that can be rearranged and customized with more than 100 native controls. Importing a template also saves the existing checkout as a revision, making it easy to restore the previous design if needed.
  • Beaver Builder introduces Beaver Builder AI: The new AI-powered plugin offers multiple ways to create and refine WordPress websites, including built-in chat, MCP connections with tools such as Claude and Cursor, and imported Design Kits. It also supports Design Systems, editable layouts, targeted section changes, custom modules, and forms.
  • SureCart will apply its 2.9% transaction fee to all Free plan stores: Starting September 7, SureCart will apply its standard 2.9% transaction fee to existing Free plan and legacy stores, replacing the previous 1.9% or 0% rates. The current rates will remain in place through September 6, and no changes are required from store owners.
  • The WP Awards 2026 nominations are now open: The nominations are open till September 19, and the voting period will commence on Oct 01 and remain open till Nov 25, 2026.
  • The WP World launches an iOS app: The free app for iPhone and iPad lets users browse the Presser directory, discover upcoming WordCamps and other events, and connect through friends, Messenger, and push notifications. Users can browse people and events without an account, while sign-in unlocks the app’s more personal features.
🚀 NEW PROJECTS
“After all the WordPress vulnerability mess that happened recently, I built a lightweight plugin called Camouflage that disables WordPress for public users and serves static HTML files directly via the Apache web server.”

Hamza Mairaj about creating Camouflage Security.
  • Camouflage Security: Created by Hamza Mairaj, the plugin disables WordPress for public users and serves a static snapshot instead, blocking every request that is not explicitly allowed.
  • OutbidWP: Created by Alberuni Azad, this is a public, ranked advertising board for WordPress companies, with plugin makers, theme shops, hosting companies, and agencies competing for visibility. Each listing’s spending, clicks, and rank are displayed openly, with rankings determined solely by the total amount paid. Listings start at $1, and moving up requires paying $1 more than the listing currently holds.
  • BoardScribe: The plugin from Equalize Digital, the team behind Accessibility Checker, makes it easy to publish board meeting dates, agendas, and minutes on WordPress in an organized and accessible format.
  • HDY Login Branding: Developed by Mary Mojisola Job, the plugin allows users to customize the WordPress login screen without touching code.
  • Flying Host: A managed WordPress hosting service built by the team behind FlyingPress, offering isolated containers, dedicated resources, Cloudflare Enterprise, Patchstack security, and a WordPress-optimized performance stack.
  • Photo Directory Importer: The plugin allows users to search the WordPress Photo Directory from inside wp-admin and import CC0 photos straight into your site’s Media Library, ready to use as a featured image, in a block, in a gallery, or anywhere else a regular upload would work. The plugin was developed by Topeher DeRosia and others based on an idea put forth by Michelle Frechette during WordCamp US 2026.
  • Plugin Graveyard: A directory tracking WordPress plugins that have gone unmaintained for more than 12 months, along with their active installations and known security vulnerabilities.
  • WebberZone Image Optimizer: The plugin converts the images already in your media library to WebP and AVIF, and serves each visitor the smallest file their browser can read.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • On Seriously, BUD?, Adam Silver joined host Bud Kraus to talk about leaving agency life behind, his unexpected journey from WordPress to ultrarunning, and the new ideas he’s pursuing as he figures out what comes next.
  • In this episode of WP Builds, Sé Reed joined Nathan Wrigley to discuss the WP Open Community Collective’s rebrand, its work supporting WordPress contributors, changing models for open source contribution, the State of the Community survey, and more.
  • Anne McCarthy has shared a decision log documenting the major calls made during the WordPress 7.1 release, from shipping the roadmap through release day.
  • Rodolfo Melogli looks at WooCommerce’s push to tackle its GitHub backlog of more than 2,300 issues and 500 pull requests through the new three-month initiative. He also shared how his first WordPress.org plugin was approved, followed by a second plugin that applies the same cart restriction concept to shipping classes, and how building the second plugin uncovered a settings conflict between the two.
  • Josh Hall explained why he moved from ManageWP to WPUmbrella for managing his WordPress sites, covering its interface, features, security, innovation, pricing, and team.
  • Mike McAlister showcased new Ollie Pro features aimed at speeding up WordPress design workflows, including visual padding controls, access to more than 1,200 custom icons in the core Icon block, and responsive styling options for tablet and mobile layouts.
  • James Laws reflects on his experience at WordCamp US, praising its people and community while criticizing the event’s underwhelming energy and saying he left feeling confused rather than inspired.
  • Craylor reflects on WordCamp US 2026 and the question of whether WordPress is dying, pointing to declining ticket sales and a roughly 3% drop in market share.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress 7.1 Introduces Responsive Styling, Client-Side Media Processing, and More

WordPress 7.1 “Mary Lou,” the second major release of the year, has been released, named after pioneering jazz…

Read more

WPOCC State of the Community Survey Paints a Troubling Picture of WordPress

The WP Open Community Collective (WPOCC) has published its State of the Community 2026 survey, presenting the results…

Read more

Official WordPress Browser Extension Now Available on Chrome and Mac App Store

The official WordPress browser extension is now available on the Chrome Web Store and Mac App Store. The…

Read more

WPForms Lite Faces Backdoor Allegation as Questions Emerge in the Community

Sybre Waaijer has alleged that Awesome Motive introduced a backdoor in WPForms Lite version 2.0.0, which runs on…

Read more

Team WP-CONTENT.CO

Issue #286   |   September 2, 2026   |   Reading time: 27 mins

This weekly newsletter is kindly sponsored by ProfilePress, HostPapa, and HireZoot

Built with Newsletter Glue.