The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#293 – Community Remembers Eric Binnion, Matt Tells Contributor to Work Elsewhere, Rank Math & Updraft Security Issues

Issue #293   |   October 20, 2026   |   Reading time: 27 mins

Hello!

This week on The WP Week Newsletter, we cover the supply chain attack faced by Rank Math and Updraft, Matt Mullenweg telling contributor Andrea Fercia to contribute elsewhere, WordPress usage across 32 European countries, along with new projects and more.

Submissions are now open for Black Friday 2026! Share your deals on plugins, themes, hosting, WooCommerce tools, SaaS, and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

🗣️TALK OF THE TOWN

Matt Mullenweg has called for the reversal of WordPress accessibility improvements proposed by longtime contributor Andrea Fercia six years ago, and also told Fercia to take his talents to another project.

Fercia’s account was temporarily locked, and Mullenweg later apologised for the incident on the WordPress Core Slack channel, explaining that the account lock had not been meant to happen.

Darrell Hilliker (Accessibility Engineer) has published an open letter to Matt Mullenweg raising concerns about the handling of WordPress accessibility improvements and the removal of Andrea Fercia’s roles in the project. He asks Mullenweg to clarify WordPress’s commitment to accessibility, the future role of the Accessibility Team, plans to address accessibility issues affecting screen reader and keyboard users, the process behind Fercia’s removal, and how WordPress will ensure its tools remain accessible to people with disabilities.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Eric was the 21st recipient of the Distinguished Janitor Award, Automattic’s highest honor. Mullenweg shared that  Automattic.com would display a mourning band and its servers would add an X-Remembering header.

Last month, Eric had shared in his blog, “Alas, that asshole tumor out-juggernauted me.” Eric joined Automattic as a PHP engineer in 2014 and later became Payments Engineering Director.

  • WordPress 7.1 “Mary Lou” retrospective: Benjamin Zekavica has published the feedback received from the WordPress 7.1 retrospective. The feedback includes not releasing WordPress at live events, bringing back the official Docs role and placing more emphasis on user documentation and completing it on time.
  • Justin Tadlock’s October developer roundup: It highlights the WordPress 7.2 roadmap, major updates to HTML sanitization, responsive block controls, design-tool support, automated plugin security reviews, and new Playground tools, while flagging several APIs and components developers should test or migrate before 7.2.
  • WordCamp Asia is looking for Contributor Stories: They are looking for contribution experiences that contain something useful, interesting, or unexpected that could help someone start, continue, or find their way in WordPress contribution.
  • Exclusive workshop for girls at WordPress Youth Day Nicaragua: For the first time, the event had workshop for girls from 15 to 20 years old who already have an enterprise, or who support their families in their ventures. The mission this year was to close the digital gender gap and convert local businesses into international brands. 52 girls and adolescents (46.0% of the total) participated in the workshops.
  • Jonathan Desrosiers calls for help reviewing Gutenberg workflows across WordPress release branches: The effort aims to restore broken GitHub Actions workflows and testing infrastructure across wp/X.Y branches, with roughly 500 pull requests covering CI fixes, workflow hardening, test environment updates, and test suite repairs. Contributors are invited to review related fixes across branches, with a second phase planned to adopt reusable workflows.
  • WordPress Contributor Toolkit 2.0.0-beta.1 redesigns the interface and adds new settings: The beta release introduces a dark theme, customizable appearance options, and settings for language, PHP version, debugging flags, and local development server behavior. It also adds seven languages, updates several interface elements, fixes bugs affecting local environments and debugging, and includes security improvements.
  • WordPress explores three sync engines for real-time collaboration: The experimental gutenberg-sync-engines plugin lets testers compare Yjs-server, DE-RTC, and intent-log, which differ in how they merge edits, handle conflicts, and support external tools. The Gutenberg team is seeking feedback to help choose an engine for future server-side real-time collaboration in WordPress.
  • Gutenberg 24.2 adds collaboration and design improvements: The release moves notes into a margin beside the editor canvas, simplifies navigation menu link searches, and adds image sorting and duotone support to the Gallery block. It also extends design tools to more blocks, enables React 19 by default, introduces enhancements to the Interactivity API, along with several other improvements and bug fixes.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026): There were 655 vulnerabilities disclosed in 406 plugins and 100 themes.
  • 600,000 WordPress sites affected by SQL injection vulnerability in Backuply WordPress plugin: The vulnerability allows authenticated attackers with subscriber-level access or higher to store a malicious SQL payload in the Biographical Info field, which executes when an administrator later restores a database backup. This can enable attackers to change the default user role to administrator, allowing them to take over the site. The vulnerability affects all versions up to and including 1.5.8 and is patched in version 1.5.9.
  • A security incident in Rank Math Pro 3.0.123: The security issue affected a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC. Rank Math removed the affected files and released a clean version, v3.0.124.
  • Stolen UpdraftCentral keys are backdooring WordPress sites: Patchstack reported that an attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Several users on the WordPress subreddit also reported the issue (first report and second report).
  • Judge denies Automattic’s request for a two-month extension of case deadlines: Automattic sought more time to complete expert discovery and file summary judgment and Daubert motions, arguing that newly retained counsel needed time to review the case’s extensive factual and expert records. Judge Araceli Martínez-Olguín denied the motion. The defendants had argued that the extension would not unduly prejudice WP Engine and would leave the October 19, 2027, trial date unchanged.
  • Getty Images files for bankruptcy: The company is filing for bankruptcy after its planned $3.7 billion merger with Shutterstock collapsed over regulatory requirements.
  • LiquidWeb’s new pricing plans: Every plan includes the full package: Give, The Events Calendar, LearnDash, and Kadence. Difference is in the number of websites.

🔧 TIP OF THE WEEK

Cache Expensive ACF / Query Results

If the same expensive data is requested repeatedly, don’t calculate it every time.

$data = wp_cache_get('theme_services');

if ( false === $data ) {

    $data = get_posts([
        'post_type'      => 'service',
        'posts_per_page' => 10,
    ]);

    wp_cache_set(
        'theme_services',
        $data,
        '',
        HOUR_IN_SECONDS
    );
}

Pro Tip:

For persistent caching, object-cache support on the server makes this even more useful.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

The analysis found that WordPress powers 47.6% of the 4.1 million homepages studied, with usage ranging from 59.4% in Estonia to 34.5% in Czechia among countries with at least 3,500 WordPress sites. The report also found that 21.6% of WordPress sites use versions older than 6.9, 23% of sites displaying a PHP version use PHP 7, and WooCommerce usage ranges from 5.9% of WordPress sites in Germany to 26.5% in Bulgaria.

  • Corporate WordPress Security Benchmark 2026: The report draws on the 2026 WordPress Security Survey and examines responses from 141 people working on corporate or brand websites, covering their security practices, concerns, and experiences with security incidents. While respondents reported widespread use of technical security controls, 72.1% had experienced at least one security incident, and only 31.9% reported having a breach recovery plan.
  • Dave Foy returns to web design education after a brief retirement: After leaving web design education to teach primary-school children to play music, Dave says the job helped him recognise how much he values working for himself, and messages from former students also reminded him of the impact of his teaching. He plans to create smaller, focused training sessions, resume collaborations, and help non-coders and others who find technology intimidating.
  • Arūnas Liuiza creates Is WP Dead? website to show WordPress usage statistics: The website answers “NO,” stating that WordPress powers 39.6% of all websites and has a 58.4% market share among known content management systems, citing W3Techs as its source.
  • Dutch web designer and YouTuber Rino de Boer is leaving Elementor: He is best known through LivingWithPixels. His next venture is Living With Prompts – helping web designers and developers use AI without becoming cheap or replaceable. You can now join the list and get the updates first.
  • Day One founder Paul Mayne is leaving Automattic: He created Day One in 2011 to make it easy to privately record memories and experiences and joined Automattic in 2021 following the acquisition of Day One.
  • ‘It Looks Done‘ – an experimental project from WebDevStudios: The project demonstrates how an AI-built website can look finished while missing the less-visible essentials—security, accessibility, forms, SEO, consent, redirects, and maintainability—and argues that AI is great for the visible “20%,” but experienced developers and a proper platform are still needed for the other “80%.” 
  • Elementor is running a contest for sites built with the Elementor MCP: The official Elementor MCP Showoff contest is now open. Build a site with the Elementor MCP and submit it by October 29, for a chance to win an Amazon giftcard of up to $600 and get featured in an Elementor marketing campaign. 
  • WordPress Agent Benchmarks finds official MCP adapter completed 0% of tested AI website management tasks: Andy Peatling benchmarked AI agents on 21 real-world WordPress tasks and found that they successfully completed 79% of jobs using WordPress’s built-in API with an app password, but 0% through the official MCP adapter, because the adapter exposed only a limited set of mostly read-only capabilities. The study argues that the issue is not with AI agents themselves, but with the current lack of core WordPress MCP abilities forcing users to rely on third-party tools or share credentials.
  • Sybre Waaijer criticizes WordPress’s six-hour update release delay: He argues that the “Protect the Shire” delay pushes release verification and troubleshooting outside normal working hours, while leaving the exact publication time uncertain. He wants WordPress to provide the generated package, a rendered readme preview, and validation results during the hold, allowing maintainers to choose when to publish so they can monitor the rollout and address any problems.
  • Rodolfo Melogli opens speaker call for Checkout Summit 2027: Melogli is looking for speakers who can share practical marketing lessons based on real products and clients, including what worked, what failed, and what others can apply to their businesses. He has named people he would like to hear from, including founders and marketing professionals from Woo, Metorik, Kestrel, GravityKit, and other companies. The event will take place in Palermo from April 28 to May 1, 2027. Selected speakers will receive an honorarium of up to €1,000, paid after the event.
  • Brad Vincent says FooPlugins’ own plugins once DDoSed its website: He explains that the company’s self-built licensing system struggled when hundreds of thousands of plugin installs checked for updates through its website. Moving to a paid licensing platform freed up time that had been spent maintaining the system. He also reflects on how AI agents make building custom solutions more accessible, while noting the ongoing cost of maintaining them. Vincent also explained that the FooPlugins naming convention began with FooBar, a jQuery plugin inspired by Hello Bar that the company sold on CodeCanyon. The product reached the platform’s top 10 and the name stuck, leading to products including FooBox, FooGallery, FooConvert, and FooPixel.
  • Sunil Kumar Sharma receives the Yoast Care fund for his contributions to the WordPress community: He is a WordPress developer and technical architect who runs WPSimplified, where he provides free WordPress education in Hindi and Hinglish through videos, workshops, training programs, and certifications. He also runs a podcast featuring members of the WordPress community.
  • Syed Balkhi says WP Crontrol will remain free as all Pro features become free: The latest release makes all previously Pro features available to every user for free, including Cron Logs, Cron Alerts, and the newly added Cron AI.
  • GoDaddy, Infoblox, Google and Cloudflare demonstrate secure AI agent transactions: The companies worked with Singapore’s IMDA to demonstrate an open architecture that uses existing internet standards to verify AI agent identities, authorize purchases, and track transactions across platforms. The demonstration included simulated fraud scenarios, with the system stopping a look-alike seller and forged credentials before a transaction occurred. Also, GoDaddy has expanded its Developer Platform with APIs for hosting, professional email, and commerce, building on its existing domain APIs.
  • Md Shahjahan marks FluentCart’s first anniversary with more than 9,000 stores: The e-commerce plugin has shipped more than 50 releases in its first year, with anniversary updates introducing Dynamic Pricing, on-page checkout, and multi-currency support in FluentCart 2.0. Shahjahan says the plugin was built to simplify selling on WordPress without requiring multiple add-ons or charging a percentage of each sale. Besides this, he also published a detailed anniversary post.
  • New milestone for WPVibe: The plugin now has over 80,000+ active installations.
  • CookieYes rebuilds its Shopify app and makes essential consent features free: The app now carries Shopify’s Built for Shopify badge and lets merchants manage consent directly from their Shopify admin, without a separate login or coding. Its free plan includes geo-targeted banners, automatic script blocking, consent logging, Google Consent Mode v2, and support for multiple privacy regulations, within fair usage limits.
  • Novamira Pro has introduced new Read Mode: It lets AI agents inspect a WordPress site through read-only abilities, including reading files, viewing content and options, and querying the database. It blocks Novamira abilities that modify content, files, or settings, but it is not a security feature because agents still have administrator-level access outside Novamira.
  • Divi 5 introduces multi-select and bulk editing: The update lets users select multiple elements and bulk edit their settings, apply presets, duplicate or move elements, and reset design attributes. It also brings multi-selection to the Inspector, which can display attributes across selected elements, and the Divi AI Agent, which can work with the selected elements as its scope.
  • WPFolks is now on Android: The Android app is now available, and there is also an app available for iOS users too.
  • Two-Factor Authentication is now on for every PushEngage account: They have introduced the requirement to help protect accounts against phishing, password guessing, and the reuse of leaked passwords. Users must set up 2FA and enter a one-time passcode when logging in with their email and password. Also PushEngage MCP server is available now on every PushEngage plan
  • AI Literacy through WordPress – new course from WordPress: This course gives you a practical foundation in AI literacy built around real workforce goals.
🚀 NEW PROJECTS
“Lesson: a comment section you don’t host is one you can lose.“

Foxe Labs about creating Convocept.
  • Convocept: Created by Joel James, the plugin replaces your theme’s comment section with a fast, server-rendered comment system. It adds threaded replies, upvotes, pinned comments, email subscriptions, in-place moderation, and a Disqus importer.
  • Aegis Block Theme: A multipurpose WordPress block theme with a complete design system, ready-made templates and patterns, and WooCommerce support.
  • Playground-usertest app: A new app by Jamie Marsland for user testing WordPress. Every tester gets their own real WordPress, running right in their browser with WordPress Playground. And the app itself runs on Spacefast.
  • Migrateme.tech: Developed by Mike Demo, is an open-source, AI-assisted CMS migration toolkit designed to move content between platforms in either direction. Its first migration route converts WordPress WXR exports to Markdown/MDX. It offers dry-run risk reports, approval controls, checkpointed migrations that can resume after interruptions, and validation that reconciles counts, fields, assets, and checksums between the source and destination.
  • Easeful Themes for ACF: The plugin by Valentín García lets users style and display Advanced Custom Fields groups on the front end without hand-coding CSS. It includes four built-in themes, a live theme editor, drag-and-drop field ordering, adjustable field widths, automatic display options, and support for both ACF and ACF PRO.
  • AuditWand Accessibility: A WCAG accessibility checker for WordPress that offers 16 one-click fixes and includes a Media Library Audit for reviewing and editing image alt text. Page checks run locally in the browser, while its Pro plan adds cloud-based scans of the entire site, monitoring, regression alerts, and PDF reports.
  • Pantheon Public API: It is a REST API for managing your Pantheon account, sites, and environments. Users can use it to build their own scripts, automation, and integrations, such as CI/CD pipelines or internal dashboards.
  • UXfolio Portfolio Generator: An AI-powered Portfolio Generator that turns Figma files, CVs, research documents, slide decks, and screenshots into a portfolio website draft. It generates case study content, arranges visuals, offers multiple templates, and asks follow-up questions to fill in missing details before users edit their portfolio.
  • Accessibility Study Buddy: A new project by Jacques Chappell Jacques Chappell, it is a quiz tool with 250 questions covering WCAG, accessibility laws and policy, CPACC, document accessibility, universal design, assistive technology, and ARIA. It focuses on scenario-based questions, with sessions that end when accuracy drops to 70% or below and a final review providing correct answers, explanations, and source links.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • On this episode of Seriously, Bud?, Eleonora Anzini talks about her creative journey across music, graphic and brand design, photography, and contemporary art. She also shares her experiences with travel, WordPress community events, and the role of emotion and communication in design.
  • Robert Abela joins WP Tavern Jukebox to discuss findings from the 2026 WordPress Security Survey, including common security threats, security incidents, and gaps in preparedness. The episode also explores AI’s impact on WordPress security and the steps site owners, freelancers, and smaller teams can take to protect their websites.
  •  Jason Cohen, founder of WP Engine, joins WP Product Talk hosts Zack Katz and Katie Keith to share practical frameworks and real-world lessons for using pricing to attract the right customers and build sustainable growth.
  • Brad Vincent explains how his Hermes agents took a FooGallery support ticket from reproducing a bug to opening a tested pull request in just over two hours. His workflow uses a fresh local WordPress site to reproduce the issue, identify its cause, test a fix, and prepare a pull request, with merging, releasing, and customer replies still handled by a human.
  • Roddie Ouijital criticizes Automattic’s application for the .php top-level domain, arguing that it could give the company influence over the PHP community. He also raises the possibility of the PHP Foundation objecting to the application.
  • Miriam Schwab explains how WordPress’s existing features, including its REST API, machine-readable content, application passwords, and user permissions, make it well suited for AI agents to read and interact with websites.
  • Devin Walker reflects on his first year at Automattic, discussing Jetpack’s product improvements, team restructuring, challenges, and growth. He also outlines his plans for a simpler Jetpack experience, clearer pricing, and deeper AI integration.
  • Adam Warner argues that WordPress Multisite needs better marketing to help more people understand when it is useful. He outlines potential opportunities for agencies, hosting providers, and entrepreneurs.
  • Hesham Saad outlines the security risks of WordPress AI plugins and shares a seven-step checklist for protecting websites when adding AI features.
  • Nicolas Steenhout shares why automating all accessibility testing is a pipe dream.
  • Matt Mullenweg highlights WordPress’s push for modern web standards and promoting more functionality in the browser.
  • Automattic’s Happiness team benchmarked its AI support assistant Odie and found strong overall performance, but the headline scores hid weaknesses—especially on WooCommerce.
  • Barn2 Plugins shared Shopify vs WooCommerce market share. Shopify is winning with the world’s biggest stores, while WooCommerce leads across the whole web.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

Running a Black Friday deal? Share it here.

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

Matt Mullenweg Tells Contributor Andrea Fercia to Contribute Elsewhere as Accessibility Changes Are Reverted

Matt Mullenweg has called for the reversal of WordPress accessibility improvements proposed by longtime contributor Andrea Fercia six…

Read more

Automattic Applies for .wordpress Top-Level Domain, Seeks Code of Conduct Exemption

Automattic has applied to ICANN for the .wordpress top-level domain through its subsidiary, Knock Knock WHOIS There. The…

Read more

WP Accessibility Day 2026 Draws 2,210 Registered Attendees From 77 Countries

WP Accessibility Day 2026 took place on October 7 and 8 as a 24-hour virtual conference dedicated to…

Read more

Gutenberg Switches JavaScript Unit and Integration Tests From Jest to Vitest

Gutenberg has finished moving its JavaScript unit and integration tests from Jest to Vitest, and the change introduces…

Read more

Team WP-CONTENT.CO

Issue #293   |   October 20, 2026   |   Reading time: 27 mins

This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

Built with Newsletter Glue.