The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#273 – WP 7.0 Released, State of WordPress Security 2026, Call for Volunteers

Issue #273   |   May 26, 2026   |   Reading time: 23 mins

Hello!

This week on The WP Week Newsletter, we cover the release of WordPress 7.0, which is the first major release of this year, the call for volunteers for WordPress 7.1, the state of WordPress Security in 2026, the call for testing of the new media editor modal, new projects, and more.

As WordPress turns 23 tomorrow, we’re also celebrating a milestone of our own, we turn 6 🎉. A huge thank you to our readers for being with us throughout this journey🥰. As we look ahead, we’d love to hear your feedback and learn how we can continue improving.

To mark the occasion, our founder, Aravind Ajith, shared a few reflections on the journey:

“23 years of WordPress. 6 years of WP-Content.co.

I found WordPress when it was only about 6 years old. Years later, our own little contribution to the ecosystem reaches the same milestone.

Happy birthday, WordPress. 🎂”

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

WordPress 7.0 “Armstrong”, the first major release of this year, has been released. Named in honor of Louis Armstrong (jazz trumpeter and vocalist), this version brings improved AI capabilities, new blocks, improvements to the Font Library, a new Connectors UI, a modernized dashboard, visual revisions, and an enhanced developer toolbox.

The release was originally scheduled to debut during Contributor Day at WordCamp Asia, but was later postponed to allow more time for refining the anticipated real-time collaboration feature. However, real-time collaboration was eventually dropped and did not make it into the final release.

At the same time, Oliver Sild warns that WordPress 7.0, combined with vulnerable plugins, could increase attacks aimed at stealing AI API keys, sparking a wider discussion that saw the involvement of Matt Mullenweg and several community members.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Planning for WordPress 7.1 is underway with a proposed final release date of August 19, 2026, alongside a call for volunteers to support the release process. Contributors are invited to participate in roles including Release Lead, Release Coordination, Tech Lead, Triage Lead, and Test Lead as the project continues using a smaller, focused Release Squad model.

  • WordPress explores expanded Unicode email support: This will allow people to use names and characters beyond the traditional A–Z range. The proposal aims to update WordPress email validation and sanitization to align with modern standards and broader UTF-8 adoption, and also highlights the challenges.
  • Media Editor Modal: Call for testing: A new experimental Media Editor Modal is available for testing in Gutenberg, introducing a dedicated image editing workflow in the Block Editor. It replaces the current inline crop tool with features such as freeform and aspect-ratio cropping, rotation, flipping, and metadata editing, while also moving toward a WordPress-native image editing system that reduces reliance on third-party libraries.
  • WordPress drops “Beta” label for PHP Support: John Blackbourn announces that the “beta” label for PHP support has been retired and removed retroactively across all WordPress versions. WordPress 6.9 and 7.0 now document full support for PHP 8.5, 6.8 and later for PHP 8.4, and 6.4 and later for PHP 8.3.
  • What’s new in AI 1.0.0: This release introduces a new Request Logging experiment that provides observability into AI activity, along with a new Connectors Approval experiment and expanded comment moderation features. It also integrates AI-generated alt text into the media editor, refines editorial workflows, and so on.
  • What’s new in Gutenberg 23.2: The release introduces responsive global block styles with states, adds motion design tokens, and much more.
  • WooCommerce.com is now running on nightly WC Core: It is now running on nightly WooCommerce Core builds in production, allowing the team to catch regressions and performance issues earlier than traditional release cycles. A daily automated pipeline deploys Core updates, runs tests, and uses AI for patch replay, code review, and exploratory testing, while humans still approve merges.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (May 11, 2026 to May 17, 2026): There were 78 vulnerabilities disclosed in 62 plugins and 2 themes.
  • WordPress.com released three new features: Firstly, the Blueprints Gallery is now available in WordPress Studio, making it easier to browse, preview, and launch reusable WordPress site setups directly within the app. Secondly, they have introduced Lately, a new beta feature for creating and sharing weekly letters with close friends. Users can build these letters by messaging the WordPress Agent on Telegram. Finally, the Easy Site Editor, launched in beta, is a new conversational editing experience designed to simplify website creation and customization. The tool lets users describe changes in plain language while viewing updates through a live site preview.
  • Wix to cut 1,000 jobs in largest layoff round in company history: The company will reduce roughly 20% of its workforce after a steep stock decline and rising AI-related costs.

🔧 TIP OF THE WEEK

Use esc_attr() for Attributes

Tip: Not just esc_html()

<input value=”<?php echo esc_attr($value); ?>”>

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

 The report analyzed 1,981 websites, including 424 confirmed WordPress sites, and found that 52.8% were running at least one plugin with a known vulnerability. The findings also reveal that 93.2% were missing modern security headers, 55.9% exposed their WordPress version, and 35.8% still had XML-RPC enabled, and more.

  • GoDaddy joins Agentic AI Foundation: GoDaddy has joined as a new Gold Member. The company was among four organizations added this quarter as AAIF membership grew to 190 organizations. The new members are joining a neutral community focused on collaborating around open-source protocols, tools, and frameworks that support interoperable agent-based AI systems.
  • InMotion Hosting launches new Agency Partner Program: It differs from standard hosting affiliate programs because benefits scale with the total value of client accounts an agency manages, rather than offering a flat fee per signup.
  • Do the Woo becomes a standalone podcast: Do the Woo has become an independent podcast, moving out of the Open Channels FM network and into its own website and feed at DoTheWoo.com. Future episodes, show notes, and transcripts will be published there, while archives will remain available on Open Channels FM.
  • All new Angie Cloud Library: It introduces a reusable workflow that lets users save AI-generated snippets and reuse them across multiple sites without rebuilding them.
  • Introducing AI Answers in Jetpack Search: The new feature provides direct, AI-generated responses based on a site’s content instead of only showing search results.
  • Modular DS 3.0 launched: The release adds integrated security tools (malware scanning via Imunify alongside existing Patchstack protection), broken link detection with redirect fixes, bulk site onboarding, a new global management screen for effectively managing multiple sites, and new data regions.
  • FluentBoards 1.95 is live: The release introduces a new Gantt Chart view,  MCP support for AI agents, the ability to pin tasks, and several other improvements.
  • Bit Form V3 is now available: This is a major update that improves form building with a redesigned dashboard and rebuilt builder UI. It also adds multisite support, email OTP verification, responsive previews, improved conditional logic and export controls, and more.
  • Etch 1.4.19 released: The update adds file support to the AI Assistant, including drag-and-drop uploads and CSV reading from the Media Library. It also introduces a new onSave hook in the builder controls API, along with other fixes.
  • Novamira v1.3.0 is here: The latest version introduces “Skills”, allowing users to create their own using Markdown, upload existing ones, or generate them via AI for a WordPress site, with a built-in skill-creator guiding the process step by step.
  • WPScan 4.0.0 has been released: The update brings explicit scan control, authentication-based enumeration, and real-time results.
  • Gato AI Translations for Polylang v18.0 now available: This expands support to translate almost any block, element, or widget across WordPress with minimal setup. It adds out-of-the-box support for ACF blocks, PHP-only blocks introduced in WordPress 7.0, and automatic translation for plugins that provide wpml-config.xml, including full compatibility with Kadence and Greenshift blocks.
  • Five new modules released for Divi 5: The new additions include the Timeline, Breadcrumbs, SVG, Table of Contents, and Instagram Feed modules.
  • WordPress plugin review queue saw a sharp drop as Reddit users share faster review experiences: Some users shared their experiences of faster response and approval times compared to previous submissions. They speculated about the role of AI in early-stage screening and discussed how submission practices can affect the review process. Andrew Hoyer also shared plugin review figures, reporting 457 approved plugins, 709 new submissions, and 4,846 submissions pending changes after initial review.
  • José Conti opens global nonprofit programme for free WordPress plugin licences: He has expanded his long-running nonprofit initiative from Spain to organisations worldwide, offering free lifetime licences, updates, and direct support for legally registered nonprofits. Rather than a discount programme or marketplace offering, the initiative operates as a personally managed donation model, with each application reviewed individually and licences granted directly by the author.
  • Ross Morsali reflects on over a decade of building Search & Filter: He recalls initially resisting WordPress, then creating a free filtering plugin for a client project, and later developing a Pro version during a difficult period for his agency, which helped sustain him financially. He also reflects on changes in the WordPress ecosystem and discusses his growing focus on experimenting with AI tools and documenting what he learns.
  • Zeeshan says LearnDash is losing traffic and responds to removal of the Experts page: He highlighted that LearnDash.com is losing thousands of visits daily. He also stated that the LearnDash Experts page, which previously drove referrals for him and others, has been removed, and says he has spoken with others who were affected. He added that they plan to recreate a similar page listing the same companies as an SEO experiment.
  • Brad Williams on WordPress product companies moving to subscription services: He says prominent WordPress product companies are not releasing new products to buy and download, but are instead releasing services with ongoing recurring billing subscriptions. He adds, “They already see the writing on the wall. Do you?”
  • All new FrontPress Studio: This is a new Flat-file CMS by Marko Krstić.

🚀 NEW PROJECTS
“The idea is simple: keep WordPress as the CMS/backend, build the app layer with modern tools.“

Justin Nealey about creating DesignSetGo Apps.
  • DesignSetGo Apps: The plugin by Justin Nealey allows users to deploy Astro, React, or plain HTML apps into WordPress as sandboxed apps with a permissioned bridge to WordPress data.
  • Vercel AI Gateway Provider: This plugin allows your WordPress site to connect to the Vercel AI Gateway. It enables your WordPress site to use hundreds of generative AI models from over 40 different providers, to generate text, images, video, and more.
  • Baton: A workflow orchestration plugin for the WordPress Abilities API built by Nik.
  • Block MCP: GravityKit has open-sourced Block MCP, a WordPress MCP server designed to let AI agents edit posts at the block level without breaking Gutenberg block structure.
  • DynoMenu: With this, users can build responsive WordPress and WooCommerce menus automatically from posts, pages, categories, product categories, taxonomies, and saved menus.
  • Mocursor Smart TOC: Developed by Moses Cursor Ssebunya, the plugin automatically generates a linked table of contents from the headings in the posts and pages.
  • VariantFlow: A zero-bloat A/B testing tool built natively for the WordPress Gutenberg editor.
  • WordPress Hooks Graph: A project by Panagiotis Synetos and Chris Lilitsas, it’s a tool that scans a WordPress codebase, pulls out all actions and filters, and converts their relationships into a graph for visual exploration or LLM use via MCP.
  • Theme Blockaide: Developed by Marcel Oudejans, this is a lightweight WordPress helper utility that automatically disables the Full Site Editor (FSE) on staging and production environments, thereby avoiding accidental database template overrides.
  • Haydi: Created by Cem Ünalan and Boro Sitnikovski, it’s an AI autopilot plugin that allows users to use any AI provider via WordPress 7.0 Connectors to generate and debug plugins and themes directly from WP Admin, without requiring shell access.
  • Push MD: The plugin by Artur Piszek and Adam Zielinski turns a WordPress site into a Git remote, allowing authenticated users to clone, pull, and push content using standard Git commands through a WordPress REST API endpoint.
  • ActiveLayer: A new AI spam protection for forms and comments, works across WordPress and other platforms via API, and supports major form plugins.
  • JetMessenger: A new plugin by Crocoblock that adds a private, context-aware messaging system where conversations are tied to specific site objects like orders, products, posts, or users. It is designed for use cases such as marketplaces, directories, LMS platforms, and booking sites, with all conversations stored on the site’s own database without relying on third-party services.
  • TranslateXYZ: Cool Plugins has launched TranslateXYZ, a new umbrella brand for its WordPress AI translation addons, including AutoPoly, AutoMLP, AutoTP, and LocoAI. These tools integrate with multilingual plugins such as Polylang, WPML, TranslatePress, and Loco Translate, and enable automated translations using AI providers like OpenAI, Gemini, Chrome AI, Google Translate, and others.
  • Strakture Minimal theme: A minimal travel blog child theme with a monochrome palette, soft blush accent, sharp editorial lines, and Plus Jakarta Sans typography.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • On this episode of Seriously, BUD?, Bud talks with AmyJune Hineline about her work in engineering, nursing, Drupal, and open-source communities, and how she later transitioned into communications and her current role at the Linux Foundation.
  • Robert Abela is joined by Vova Feldman, Founder and CEO of Freemius, in this episode of the Melapress Show, to discuss how AI is reshaping the development, maintenance, and support of WordPress plugins and products.
  • In this episode of WordCamp Europe Insights, Kasia Janoska talks with WordPress Executive Director Mary Hubbard about WordPress Credits, Campus Connect, mentorship, contributor onboarding, AI, and the growing push to make WordPress education more accessible and practical.
  • On the WP Product Talk podcast, Drew Wilde (Director of Product Management at GoDaddy) discusses GoDaddy’s AI Troubleshooter for managed hosting for WordPress and explores how AI can help detect, diagnose, and resolve site issues while keeping humans in the loop.
  • Marcus Burnette joined Eric on The WP Minute+ podcast to discuss his journey in the WordPress community and the business model behind WellPlayedWP. The conversation also explores the included plugins, their use cases, and the role of customer feedback in shaping the service.
  • In this episode of the PublishPress Podcast, Steve Burge spoke with Austin Ginder about how AI is reshaping WordPress security. Austin shares how his perspective shifted from skepticism to adopting AI tools like Cloud Code, while also discussing increasingly sophisticated attacks and the potential for AI to improve WordPress security.
  • Maarten Belmans (founder of Wombat Plugins) examined the estimated cost of running a WooCommerce store in 2026 based on data from 5,000 real sites. The article breaks down costs across hosting, themes, plugins, email tools, and other factors.
  • WPapac reports that local representation at WordCamp Asia 2026 increased significantly compared to previous years, reflecting a stronger presence of speakers from the APAC region and the host nation at this year’s event.
  • Crocoblock reflects on eight years of building dynamic WordPress websites, sharing insights from support conversations, analytics, and product decisions.
  • Sarp Efe explains why edge caching alone doesn’t solve WordPress performance, highlighting that uncacheable requests like logged-in users, checkout flows, and REST API calls still impact real-world site speed.
  • Adam Zieliński shared about using AI to generate hundreds of redesign concepts for WordPress Playground. Instead of repeatedly refining one design, he explored a high-volume approach, creating 400+ variations.
  • Justin Nealey explains how WordPress 7.0 introduces three load-bearing APIs, Connectors, WP AI Client, and the Abilities API, that together change what a plugin is allowed to assume.
  • Jamie Marsland covered Automattic’s “Radical Speed Month” experiment, where teams are stepping outside normal workflows to rapidly build and ship ideas using modern AI tools.
  • Noah Davis argues that as AI makes website creation faster and more accessible, the value of much of the traditional work around building WordPress websites is changing. He suggests that the bigger differentiator will be judgment and the ability to decide what should be built.
  • Malcolm Peralty discusses two infrastructure factors he believes can significantly affect WordPress and WooCommerce performance: single-core CPU speed and the proximity of Redis to PHP.
  • Rizèl Scarlett on banning AI-assisted pull requests is not a long-term solution for open source projects.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress 7.0 Released: New Features and Changes

WordPress 7.0 “Armstrong”, the first major release of this year, has been released. Named in honor of Louis…

Read more

Official WordPress Browser Extension Aims to Prevent the Admin Bar From Affecting Front-End Viewing

An official WordPress browser extension is currently in development, which aims to provide access to commonly used site…

Read more

“What Is Going On With This Website?”: Community Criticism Forces WordCamp US Website Refresh

“What in the world is going on with this @WordCampUS website?” That question from Mike McAlister on X…

Read more

Hands-On with 20i Managed WordPress Hosting: Autoscaling, Security and Key Insights

Ask around, and you’ll hear plenty of opinions on which hosting for WordPress to choose. But the right…

Read more

Team WP-CONTENT.CO

Issue #273   |   May 26, 2026   |   Reading time: 23 mins

This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

Built with Newsletter Glue.