Issue #260 | February 24, 2026 | Reading time: 24 mins
Hello!
This week on The WP Week Newsletter, we cover the launch of the SudoWP initiative, Matt Mullenweg and Automattic’s response to WP Engine’s third amended complaint, the release of WP 7.0 Beta 1, new board members of The WP Community Collective, new projects, and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
🗣️TALK OF THE TOWN
SudoWP is a community-focused initiative that takes over abandoned WordPress plugins to secure and maintain them. The project patches high-severity vulnerabilities to ensure the code remains safe and functional for the community. It also integrates large language model (LLM) capabilities to support plugin management. The initiative was launched by WP Republic and AmIHacked.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
He states that certain paragraphs of the Third Amended Complaint by WP Engine contain confidential information about negotiations with hosting companies that seek endorsement on WordPress.org and that public disclosure of this information could harm his business by giving competitors or counterparties an unfair advantage, and he supports the sealing of these sections.
Also, Automattic, Matt Mullenweg, and WooCommerce filed their response to WP Engine’s latest filing.
- WordPress 7.0 Beta 1 released: Beta 1 is now available for testing and the release was delayed at first due to core unit test failures. The Test Team has also released a detailed post on the key features to test.
- WordPress 7.0 likely to introduce a Connectors Settings page: Matt Mullenweg outlined plans for WordPress 7.0 to include a new Connectors settings page, giving users a single location to manage API keys and OAuth connections for core and premium plugins. Jason Adams (AI Team Lead at Automattic) confirmed that the Connectors flow Matt described is now a part of the 7.0 work.
- Unifying WordPress Community Slack Spaces: Matt Mullenweg has suggested moving separate WordCamp Slack groups into the main WordPress.org workspace.
- Matt Mullenweg calls for ground-up reset for WordPress Translation strategy: This is in light of rapid advancements in large language models, and the goal is to accelerate global access to WordPress and its ecosystem by identifying what should be automated and when human oversight is needed.
- Monthly Education Buzz Report – January 2026: Destiny Kanno highlighted the global growth across WordPress Campus Connect, WordPress Credits, and WordPress Student Clubs, including expanded partnerships, with WordPress Credits now a mandatory component at Fidélitas University Technology and Society course.
- Early release of WordPress AI Connectors: James LePage shared that early versions of the WordPress AI Connectors and Providers have been released in preparation for the upcoming WordPress AI client in 7.0. The initial plugins include AI providers for OpenAI, Google, and Anthropic.
- Vulnerability patched in Solid Central (formerly iThemes Sync): A low-risk vulnerability in the post duplication feature of the Solid Central formerly iThemes Sync plugin, affecting versions 3.2.8 and below, has been resolved in version 3.2.9, which permanently removes the feature, and users are advised to update immediately to ensure site security.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (February 9, 2026 to February 15, 2026): Last week, there were 175 vulnerabilities disclosed in 140 plugins and 28 themes.
- WooCommerce 10.5.2: Dot Release: This release reverts a change in 10.5 that caused compatibility issues for stores with plugins or custom code that modified product variation selection. The team has also outlined what’s coming for developers in WooCommerce 10.6, scheduled for release on March 10, 2026. Also starting with WooCommerce 10.6, images from the Product Image block will be lazy-loaded by default.
- WordPress.com has launched a new AI Assistant: It is now built directly into WordPress.com, allowing Business and Commerce plan users to generate content, refine layouts, edit images, translate text, and collaborate with AI inside the editor and Media Library without leaving their workflow. The team has also released several new updates to Telex.
- Antitrust filing says Google cannibalizes publisher traffic: Antitrust filing by Penske Media Corporation claims Google is cannibalizing search traffic of sites repackaged into AI search answers.
🔧 TIP OF THE WEEK
Always Escape Output (Even ACF Fields)
Never output raw data—even if it comes from ACF or trusted sources. Escaping protects your theme from XSS vulnerabilities and keeps your frontend secure.
esc_html() for text
esc_url() for URLs
wp_kses_post() for rich text
Example:
echo esc_html(get_field(‘subtitle’));
Sanitize on input, escape on output.
This simple rule prevents most theme‑level security issues.
💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS
- ManageWP partners with Patchstack: With Patchstack’s RapidMitigate protection, ManageWP users gain automatic, proactive protection for their sites against vulnerabilities in plugins, themes, and WordPress core, even before exploits go public.
- HubSpot acquires YouTube-based media brand Starter Story: Starter Story, founded in 2017 by Pat Walls, is a video-first brand with a large YouTube and newsletter audience, and its three-person team will join HubSpot Media as part of the acquisition.
- Canva has acquired Cavalry and MangoAI: The Australian design company has bought Manchester-based Cavalry, a 2D animation platform used by teams at Amazon, Meta, Google, and Netflix, and U.S.-based MangoAI, which specializes in performance-improving video ads. Last year they acquired creative software platform Affinity.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
This marks the first expansion of the board since the organization was founded in 2022, with Reynolds also taking on the role of Interim President.
- Plugin Jam Hackathon session two is now live: This month’s theme is “ FEED” and submissions can be submitted till February 25.
- The State of the Agency 2026 survey: The survey by Elementor is now open, and responses can be submitted till March 6th. The goal is to better understand the challenges agencies working with WordPress encounter today and to highlight the key trends defining the industry in 2026.
- Kinsta Awarded #1 Web Hosting Provider in G2’s 2026 Best Software Awards: Kinsta jumped from #8 last year to #1 this year in G2’s Best Web Hosting Software Products category, out of 1,461 products. It was also named in the top 100 of G2’s Best Global Software Companies from over 116,000 vendors.
- Self-serve site transfers between accounts introduced by Rocket.net: Rocket.net now lets site owners transfer sites between accounts directly from the control panel, without involving support. The process updates ownership at the database level in under a second, requires no downtime or migrations.
- Pressidium EDGE early access now available: Pressidium EDGE provides enterprise-grade speed and security for any WordPress site, regardless of where it is hosted.
- WordCamp Asia announced the fifth round of speakers: The newly introduced speakers are Mahangu Weerasinghe (Automattic). Maitreyie Chavan (rtCamp), Nabin Jaiswal (Codewing Solutions), and Saif Hassan (Awesome Motive Inc.). The team has also announced a panel discussion on Education Initiatives in the WordPress Ecosystem.
- Jotform Turns 20: Their journey started back in 2005, with Jotform 1.0 being released on February 17, 2006. The team has created a dedicated webpage to celebrate and showcase its 20-year journey.
- New r/WordPressBlocks on Reddit: Johanne Courtright announced the launch of r/WordPressBlocks on Reddit, a community for anyone working with Gutenberg blocks, FSE, theme.json, themes, and plugins, welcoming all skill levels from beginners to experienced developers.
- CheckoutWC partners up with Convesio: This will give CheckoutWC users 90 days of free access to Convert, plus a permanent discount on Convert as long as both tools are used together.
- Northbound launched by Remkus de Vries: Northbound is a long-term advisory service that helps companies navigate the WordPress ecosystem. It focuses product strategy, partnerships, market positioning, visibility, and the broader impact of key decisions.
- Introducing the Advanced Professional WordPress Developer Certification: This new certification sets a standardized benchmark for enterprise-level WordPress development, providing an objective way to validate advanced skills in scalability, performance, security, and system architecture.
- WordPress South Africa Slack Community: Jonathan Bossenger highlighted the WP South Africa Slack community, inviting WordPress enthusiasts across South Africa to connect, collaborate, learn, and discover new opportunities within the local ecosystem.
- Join the new #LGBTQ WordPress.org Slack channel: The new Slack channel is open, and folks can now join.
- Groundworx Carousel 3.0.0 is now available: This release is a ground-up rebuild of the carousel engine and frontend architecture. The update replaces Splide.js with Embla Carousel 8.x, full frontend integration with the WordPress Interactivity API, color system overhaul, and so much more.
- FlyWP v2026.35 released: Key updates include smart retry for failed migrations, fixes for proxy/PHP timeouts and S3 backup errors, CPU usage optimizations, system cron reliability, and security patches for WireGuard and SSL handling.
- ToggleWP V0.4 introduces new AI Modules: The two new AI modules, with the AI Hub managing API keys, token limits, templates, branding, and client site settings, while the AI Writer connects to it in the client’s WordPress dashboard, letting clients generate, rewrite, and insert content using the Hub’s configuration.
- New Cache Report Widget launched by 20i: The new widget provides a quick snapshot of your site’s caching performance, showing cache hit rates, misses by cause, and the percentage of URLs served from cache.
- The MailerPress Public Roadmap is now live: The public roadmap allows users to submit ideas, vote on features, and also track what’s coming next.
- Beaver Team Pro is now completely free and open source: As focus shifts to the continued growth of AB Split Test, this change ensures Beaver Team Pro can keep moving forward, maintained and improved by the community.
- Beaver Builder 2.10.0.7 is live: This is a hotfix update that optimizes cache writes using WP FileSystem APIs, improves button and box module behavior, fixes UI issues such as auto-suggest fields, and more.
- SureForms 2.5.1 released: This version adds an option to change currency position, adds support for displaying calculation results in the HTML block in SureForms Premium, and so on.
- Remove Empty Shortcodes v1.0 released: This release introduces a new admin scanner (with shortcode and post views), an ignore list for specific shortcodes, and fixes false positives by using WordPress’s native regex.
- Fathom Analytics has launched Google Search Console integration: This integration brings search performance data directly into the dashboard, letting you view clicks, impressions, CTR, average position, and search terms alongside your regular analytics.
- Sneak peek of what’s coming in Accessibility Checker: Steve Jones shared a sneak peek of upcoming updates to Accessibility Checker, aligning it with the modernized admin UI in WordPress 7.0.
- Mamba Cache is now available on the plugin repository: This release marks the shift to a freemium model.
- JetPlugins for Divi Builder 5 early access: Interested folks can sign up now for the pre-sales.
- Anjana Hemachandra raises concerns about WordPress plugin download counts: Anjana questioned discrepancies in WordPress.org plugin download statistics, citing cases where newly approved plugins showed downloads before any version was available. In response, Dion Hulse explained that automated bots, security scanners, and monitoring tools frequently request plugin ZIP files, and the downloads API records these attempts even if the file returns a 404 error.
- Maarten Belmans shares findings from a study of nearly 10000 WooCommerce sites: He analyzed websites that currently use or previously used WooCommerce and found that 5% migrated to Shopify, 87% remain on Classic layouts, and 13% use Block layouts.
- New block support in WordPress 7.0: Aki Hamano highlighted upcoming features in WordPress 7.0, including block-specific custom CSS and responsive visibility controls for hiding blocks at different breakpoints.
- Rodolfo Melogli asks why 2FA login for Admins is not in WordPress Core: He points out that in 2026, it is a much-needed feature. While he has relied on plugins for years, he believes this is something WordPress should seriously consider adding to core.
- Woo/eCommerce pattern collection coming to OlliePro: Mike McAlister has confirmed that the WooCommerce pattern collection will be released within a week or two as a paid feature for Ollie Pro members.
- Sandeep Kumar receives the Yoast Care fund for his contribution to the WordPress community: Sandeep Kumar, a valued member of the WordPress Community Team is the latest recipient of the Yoast Care fund.
- All new TaskFade: An upcoming new task app developed by Malcolm Peralty.
- Introducing Deeper: A macOS messaging analytics app for Beeper developed by Fatih Kadir Akın.
🚀 NEW PROJECTS
| “It indexes every action, filter, and JS API call from the actual source code and lets your AI query it before writing code. No more guessing. No more phantom hooks.“ Marcel about creating the wp-devdocs-mcp |
- wp-devdocs-mcp: Developed by Marcel, this is a local MCP server that provides AI coding assistants with a verified WordPress hook database instead of relying on guesswork or training data.
- WP WebMCP Layer: Created by Vikram, the plugin allows WordPress sites to expose structured tools via WebMCP (Web Model Context Protocol) so AI agents can interact with your site safely. There is also support for WooCommerce and Paid Membership Pro.
- IncidentWP: This delivers real-time WordPress error monitoring, helping you monitor PHP errors, user activity, plugin updates, and security events. Craig Gomes has announced that “Early Access” will be launching soon.
- PublishPress Shortlinks plugin: The plugin lets you create custom branded, trackable URLs for both WordPress posts, including drafts and external links, with features like custom slugs, password protection, expiry dates, and much more.
- WP Notificator: A project by Vagelis, which connects WordPress with real-world, physical notification devices. Early access is now available, and interested folks can sign up.
- Ozinexus Missed Enquiry Detector: Developed by Simmi Ahuja, the plugin scans your site for common enquiry blockers and provides a diagnostic report inside your dashboard, with no tracking, data sharing, or intrusive actions.
- VigiGuard Security: The plugin developed by Kashif Ahmed Khan provides one-click hardening, brute force protection, file integrity monitoring, activity logging, and a visual security health score.
- Osom WP/Woo Detector Pro: A Chrome extension developed by Łukasz Kaczmarek, that detects WordPress & WooCommerce instantly and provides a full tech stack analysis, security audit, and one-click exportable reports.
- FluentPlayer: An upcoming video player plugin that includes video playlists, chapters and timestamps, resume playback, overlays and buttons, email capture, and so on. Interested folks can join the waitlist now.
- Sudo for WordPress: The plugin by Daniel Knauss adds a zero-trust layer by requiring re-authentication for all critical actions, protecting your site regardless of user role or session compromise.
- Two new plugins by Per Søderlind: Talking Head plugin lets you write multi-speaker conversations in the WordPress block editor, then generate podcast-quality audio using AI text-to-speech, and the Color Me Beautiful plugin allows you to personalise the WordPress admin with your own accent colour.
- ClawPress: This is an AI assistant plugin developed by Brad Vincent that works directly inside the admin area. It provides a floating chat panel, slash commands, and more.
- Carousel Kit: A modular, high-performance carousel block for WordPress created by rtCamp that is powered by the Interactivity API and Embla Carousel.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- Matt Mullenweg on WordPress, AI, plugins, and the future of software engineering.
- In this episode of Seriously, Bud?, Luca Rodino shares his professional journey from working at a small startup later acquired by Ernst & Young to helping grow SiteGround into a top hosting provider in Italy.
- Matt Medeiros talks with Gabriella Laster on this episode of The WP Minute+ podcast about her journey in WordPress and the launch of Elementor One. They explore user feedback, product development challenges, AI integration, and balancing technical features with a smooth user experience.
- In this episode of WP Tavern Jukebox, Matt Cromwell shared his journey from co-founding GiveWP to launching Roots and Fruit.
- Jonathan Denwoon and Kurt von Ahnen, in this episode of WP-Tonic, conversed with Matt Mullenweg, where they explored the future of WordPress in an increasingly AI-driven landscape.
- Kyle Van Deusen shared insights from a survey of 12,000+ agency owners on how they actually optimize images for WordPress sites.
- Elliott Richmond on how Automattic’s new Claude Cowork plugin builds block themes from a prompt.
- Rino de Boer shared his take on Elementor One after several weeks of testing and reviewing community feedback.
- Lawrence Ladomery argues that while 2025 was all about brand, 2026 is the year for creativity in WordPress marketing.
- Kari McMahon reports on how AI generated low quality contributions are straining open source projects, pushing maintainers toward burnout and prompting platforms like GitHub and communities such as WordPress to introduce new safeguards.
- Lena Iñurrieta reflects on the recently concluded WordCamp Valencia 2025, highlighting two inspiring days of innovation, community, and collaboration within the WordPress ecosystem.
- Basiq Ali explains how CMS detector tools help users quickly identify the software behind any website, including its CMS, themes, plugins, hosting, and other technologies.
- Boris Tane argues that AI agents haven’t just sped up software development, they’ve fundamentally replaced the traditional SDLC.
- Jonathan Bossenger explored the WordPress Studio MCP server and how it connects WordPress Studio with AI tools. After setting up MCP in VS Code, he uses an AI agent to build a custom block theme for a small coffee shop.
- Scott Jehl and his team at Squarespace are advancing a proposal to bring native lazy-loading to HTML video and audio.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- Taming the Heartbeat API: Preventing `admin-ajax.php` Overload: From Delicious Brains
- How to build custom WP-CLI commands and automate WordPress maintenance with Acorn: From Kinsta
- 9 Steps to prepare your WordPress site for AI Search Engines: From WordPress.com
- WordPress REST API Authentication: Complete guide to secure API access: From AttoWP
- WooCommerce crawl bloat: The ultimate 2026 guide to reclaiming your crawl budget: From HostWP
- Website sticky header tutorial: From Jamie Marsland
- How to add custom entries to the editor Preview dropdown: From WordPress Developer Blog
- Semantic HTML for accessible web design: From Elementor
- Client-side navigation with the Interactivity API Router: From WordPress Editor and Blocks
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp Nice on March 06, 2026: The call for sponsors is now open, and tickets are also available now.
- WordCamp Madrid on March 06-07, 2026: The call for sponsors is now open. The tickets are also available now.
- Women WordPress Day San José 2026 on March 7: The tickets are now available.
- WordCamp Asia 2026 on April 9-11: The call for sponsors and participants for the Speed Build Challenge is open. The tickets are still available, and visa information details have been published, and also the list of speakers has been announced.
- Pressconf 2026 on April 8-11, 2026: The tickets are now available, and the first round of speakers has been announced, with more to be revealed soon.
- WordCamp Vienna 2026 on April 10-11: The tickets are now available, and the call for sponsors is also open.
- Checkout Summit 2026 on April 23-24, 2026: The call for sponsors is now open. The tickets are now available.
- WordCamp Europe 2026 on June 4-6: The call for sponsors and volunteers is now open. The tickets are also now available. The Kim Parsell Memorial Scholarship applications are also now open.
- WordCamp US, Phoenix on August 16 -19 2026: The event is in the early planning stages.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
WP Engine has filed a new amended complaint in its lawsuit against Automattic and WordPress co-founder Matthew Charles…
A recent post by Matt Mullenweg on the Make WordPress Community blog has sparked discussion across the WordPress…
The AI content assistant Bertha.ai is exiting from the WordPress plugin repository after a compliance review identified code,…
WPvivid Backup & Migration plugin, with more than 900,000 active installations, has patched a critical vulnerability (CVE-2026-1357) that…
Team WP-CONTENT.CO
Issue #260 | February 24, 2026 | Reading time: 24 mins
This weekly newsletter is kindly sponsored by Kinsta, ProfilePress, and WP Job Openings
Built with Newsletter Glue.