The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#277 – Concerns over 24-Hour Update Delay, Plugin Naming Rules Inconsistency, Woo’s Default Block Theme Progress

Issue #277   |   June 23, 2026   |   Reading time: 29 mins

Hello!

This week on The WP Week Newsletter, we cover the concerns and feedback related to the 24hr cooldown period for plugin and theme updates introduced recently, the WordPress 7.1 roadmap, Woo’s default block theme sees progress, plugin naming rules spark discussion, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

Recently introduced 24h cooldown period impacts manual updates as well

The Protect The Shire initiative’s cooldown period is not just for automatic updates, but also impacts manual, one-click updates from the dashboard. Samuel Otto Wood clarified it on the #pluginreview Slack channel saying, “It means an update shown through the update system are delayed 24 hours, that is both manual and automatic.”

Miriam Schwab (Head of WordPress at Elementor) shared feedback on the initiative’s implementation of the 24-hour cooldown period. Schwab voiced that the 24-hour delay on plugin updates could give attackers time to analyze publicly available security fixes before users receive patches. She also highlighted support complications, translation package issues, and the need for clearer guidance around how delayed and expedited security releases are handled. Francisco Torres of the Plugins Team replied to Miriam saying, “ Hi, just for you to be aware that the team is compiling all the feedback and side effects, and is already talking to those involved to see what changes can be made. No decisions have been made yet, but I believe there will be changes”.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

The release squad for WordPress 7.1, scheduled for August 19, 2026, will be led by Anne McCarthy, with contributors from across the WordPress community overseeing coordination, technical leadership, testing, and triage. Compared to the WordPress 7.0 cycle, Automattic’s representation has dropped from five contributors to one, while the roadmap highlights planned work on collaborative editing, AI tooling, responsive design, media enhancements, React 19 adoption, APIs, performance, and block editor improvements.

  • Merge proposal for new custom post type in WordPress 7.1: The proposal would introduce a new wp_knowledge custom post type in the upcoming version as a shared foundation for storing site knowledge. It includes Guidelines as its first built-in feature, enabling site owners to manage content standards such as voice, tone, image preferences, and block-specific rules within WordPress.
  • WordPress 7.0.1 release schedule: It will be a bug-fix-only maintenance release, and the bug scrubs are scheduled across June 18, June 23, June 26, June 30, and July 7, 2026, with RC1 planned for July 1 and the general release set for July 9, 2026. 
  • The Plugins Team has onboarded three new reviewers: Marcel Tannich, Shiva Shanker, and Shameem Reza have completed onboarding and are now actively helping review plugins and support authors. Their contributions, along with the wider team, helped bring the review queue down from a peak of around 1,050 plugins in mid-April 2026 to nearly zero, even as plugin submissions reached record levels, and applications are now open again for a second round of contributors.
  • WordPress 7.0 retrospective invites feedback from the community: Participants can share perspectives on the WordPress 7.0 release cycle, from processes and team workflows to broader observations, with submissions accepted until July 20, 2026.
  • What’s new in Gutenberg 23.4: This version adds an experimental React 19 testing option, improves media uploads and the media editor experience, updates the Site Editor to follow users’ admin color schemes, and introduces new transforms that allow Columns and Gallery blocks to be converted into Grid layouts. Besides these, there are several other enhancements and bug fixes too.
  • Community Team seeks feedback on measuring the impact of WordCamp advertising: They are exploring ways to better understand how effective WordCamp advertising and marketing efforts are at attracting attendees. Proposed ideas include adding attendee and organizer survey questions to track how people discover events and which promotional channels drive interest, with organizers, attendees, mentors, and program supporters invited to share their experiences and feedback. The team also shared the story behind the gifts from the WCEU 2026 local team.
  • Global Partners across the first half of the 2026 WordPress event season: During the first half of 2026, Jetpack, WordPress.com, WooCommerce, Bluehost, and Hostinger supported WordCamps, the inaugural WordPress Developers Day, and WordPress Campus Connect events across multiple regions.
  • Core Committers restored the removed version history after Gutenberg sync changes disrupted contributor workflows: A restoration effort was completed to bring back previously removed files and reconnect their version history after changes in the Gutenberg sync process introduced significant workflow and build-related issues. Instead of simply reverting the earlier change, a structured merge approach was used to recover both the files and their historical continuity across repositories.
  • Kim Parsell Memorial Scholarship opens for WordCamp US 2026: Applications are now open, and the scholarship supports one eligible woman WordPress contributor with financial need to attend the event for the first time. The scholarship covers travel, lodging, and a ticket, with applications open until July 10, 2026 and the recipient announced by July 24, 2026. WordCamp US will be held August 16–19, 2026 in Phoenix, Arizona.
  • Attackers hijack ShapedPlugin distribution pipeline pushing malware to paying customers: A supply chain compromise at ShapedPlugin has led to backdoored versions of its premium plugin being delivered through the official update system. Attackers were able to inject backdoor code into the pro versions, potentially allowing unauthorized access to affected sites.
  • Attackers actively exploiting sensitive information exposure vulnerability in Gravity SMTP plugin: The flaw allows unauthenticated attackers to access detailed system information, including API keys, secrets, and OAuth tokens configured for email integrations. Wordfence said it has blocked more than 17 million exploit attempts and urged users to update to the latest patched version.
  • WordPress PBN plugin drops dual webshells via database injection: The Sucuri Team details a WordPress malware campaign that used a fake plugin and two PHP webshells hidden in the database to inject spam backlinks and maintain persistent access to compromised sites. The investigation found that the plugin communicated with a remote command-and-control server to deliver hidden SEO content, while the database-resident webshells provided unrestricted filesystem access and helped the malware evade traditional file-based security scans.
  • A deleted 7 KB file led to the discovery of a 13-year WordPress plugin backdoor operation: Austin Ginder recounts how decoding a 7 KB file removed from a closed WordPress plugin uncovered a network of 44 plugins spread across 19 WordPress.org accounts and operating since 2013. The investigation linked multiple seemingly unrelated plugins to the same operator through shared backdoors, infrastructure, domains, and DNS records, revealing that some plugins installed remote-access tools, registered infected sites with external servers, and could execute code remotely.
  • Critical unauthenticated arbitrary file deletion vulnerability patched in Avada Builder WordPress plugin: Unauthenticated attackers can exploit this flaw to delete files on a server, potentially leading to remote code execution if key files are removed. A published Avada form with database entry storage enabled is required for exploitation. Users are advised to update to the latest version immediately.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026): There were 102 vulnerabilities disclosed in 90 plugins and 5 themes.
  • Popular Shopify developer platform Mantle shuts down impacting hundreds of app businesses: Founded in 2023 by former Shopify employees Jordan Graham (CEO), Oren Harris (Head of Operations), and Josh Gosse (Head of Product Engineering), Mantle helped developers manage billing, analytics, customer data, and operational workflows, allowing teams to focus on building products instead of maintaining infrastructure. Most Mantle services will be discontinued within 60 days, on August 14, 2026. Customers using Mantle Billing have been given additional time and will continue to be supported until September 30, 2026.

🔧 TIP OF THE WEEK

Create Dedicated Hero Image Sizes

Avoid:

the_post_thumbnail(‘full’);

Create optimized sizes:

add_image_size( ‘hero’, 1600, 900, true );

Then:

the_post_thumbnail(‘hero’);

Smaller downloads = faster LCP.

💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

A GoFundMe campaign has been launched to support Automattic engineer Eric Binnion and his family after he received a stage 4 esophageal cancer diagnosis and a six-month prognosis from two oncologists. The fundraiser aims to raise $40,000.

  • Tutor LMS 4.0 launch giveaway: Tutor LMS 4.0 launches on July 8, and to celebrate, a giveaway is open where participants can enter via email and complete simple tasks for bonus entries, with prizes including a MacBook Neo and multiple Tutor LMS Pro licenses. Also, their community on Facebook has now surpassed 10k members.
  • The PHP Ambassador Program is open: This is a new Special Interest Group, which focuses on improving the perception of PHP outside the PHP community. It supports community members in advocating for PHP in settings such as local groups, workplaces, and conferences. The first meeting is scheduled for June 30, 2026, and will be used to define goals and plan future meetings, with notes and ways to contribute provided for those unable to attend. Interested folks can now register.
  • The Enterprise WordPress Playbook by Human Made: A guide exploring the strategies, architectures, and operating models organizations use to scale, govern, and future-proof WordPress-powered digital platforms. The playbook covers platform strategy, enterprise operations, and preparing the platform for emerging technologies.
  • GoDaddy’s annual cybersecurity report examines the website malware threat landscape: The report, based on 834,661 infected websites detected in 2025, outlines a major shift in the website security landscape over the year. Malware remained the dominant threat category (41.5%), followed by SEO spam (35.2%), malicious redirects (21.7%), unwanted ads (1.1%), and defacements (0.5%). Key findings include the rise of social engineering attacks such as Fake Browser Updates and ClickFix affecting over 74,000 websites, and gambling SEO spam overtaking Japanese spam for the first time in over a decade.
  • Kinsta’s AI & bot traffic reality check: Based on analysis of over 10 billion requests across Kinsta-managed infrastructure, the report shows bot traffic shifting from simple crawling to inefficient, large-scale automation driven by AI bots and broken crawling patterns. It highlights a 300% rise in AI bot traffic in a year and a jump to 1 in 31 web visits being AI-driven, alongside extreme cases of bots repeatedly hitting dynamic endpoints like add-to-cart pages.
  • Bill Erickson on moving some client sites to Astro: He argues that many websites with mostly static content do not require the infrastructure of a live CMS, plugin stack, database, PHP runtime, admin area, and managed host. He also shared practical notes from a recent WordPress to Astro migration.
  • Upcoming WooCommerce Purple default block theme sees active PR updates:  A recent update highlighted by Brian Coords points to ongoing pull request activity around the upcoming WooCommerce default block theme. Interested folks can also quickly launch a Playground with demo WooCommerce content and the latest block theme.
  • Plugin naming rules spark questions about consistency: Youssef has questioned whether plugin directory naming rules are being applied consistently after three proposed plugin names were rejected for being too generic. He voiced that many existing plugins use similarly broad names and suggested that greater attention should be given to code security rather than strict naming requirements.
  • Jessica Risch reflects on attending two WordPress-focused events in 2026, drawing a sharp contrast between Checkout Summit and WordCamp Europe: She described Checkout Summit in Palermo as inspiring and tightly organized with a strong WooCommerce focus, while WordCamp Europe felt much larger but less engaging, with talks that leaned more on updates than real-world case studies and a noticeably low energy in the rooms. She adds that, given the experience, she would think twice about leaving her family for WordCamp Europe again.
  • Elliott Richmond says WordPress speakers are getting harder to find and its starting to show: He reflects on the Cheltenham WordPress meetup taking a summer break and uses the pause to highlight a growing challenge in the community speakers have become genuinely hard to find. He notes that post-pandemic attendance has dropped and the pool of willing speakers has shrunk, creating a cycle where fewer speakers lead to less variety and declining turnout. While larger events like WordCamp Europe still show strong engagement, he suggests local meetups may need to rethink formats, including workshops and talks that help people learn how to actually use WordPress to build something.
  • Dave Foy launches How WordPress Works course: The self-paced, four-hour video course is divided into four modules covering WordPress fundamentals, core framework concepts, content modeling and site planning, and the creation of a fully dynamic website. Aimed at users of page builders as well as block-based themes, the course focuses on understanding the WordPress systems that power templates, dynamic content, and site architecture.
  • weDevs launches PocketStore to turn WooCommerce stores into native mobile apps: PocketStore is a new service from weDevs that converts existing WooCommerce stores into fully branded native iOS and Android apps. Designed for store owners who want a better mobile shopping experience without the cost and complexity of custom app development, the service handles app creation, store synchronization, and app store submission, with pricing starting at $39 per month.
  • SureCart launches SureCart EU Helper plugin to help merchants comply with new EU withdrawal rules: This adds a withdrawal option to the customer dashboard, guiding shoppers through a two-step request process while providing confirmations, merchant notifications, and request records to help stores address new EU withdrawal requirements.
  • Novamira Pro adds SEO specializations: The update introduces dedicated SEO capabilities for major SEO plugins, including Yoast SEO, Rank Math, All in One SEO, and SEOPress. The AI agent can now read and update SEO settings across pages, posts, categories, and tags, including titles, meta descriptions, focus keyphrases, canonicals, social previews, indexing status, and more. It also supports advanced features like redirect management, including regex patterns, for Yoast SEO Premium, All in One SEO Pro, and SEOPress Pro.
  • FluentCart 1.4.2 expands support for EU customer withdrawal rights: The release introduces the new Customer Rights add-on, enabling German and EU stores to handle withdrawal requests through a dedicated customer-facing workflow and built-in management tools. It also delivers payment improvements for Paddle and Authorize.net, new developer extension points, and a range of stability, security, and maintenance updates.
  • SEOPress 10.0 is now available: The update adds support for WordPress Abilities API, a new AI Assistant for content and SEO workflows, a built-in AI credits system, XML sitemap health checks, and so on.
  • Heroic Inbox 3 is now live: The plugin has been rebuilt from the ground up, and the update introduces a redesigned interface, automated workflows, one-click mailbox connections, agent tagging, saved replies, and enhanced user management. To celebrate the release, new subscribers can get 60% off plans starting at $79.60 per year.
  • Introducing GTmetrix MCP: The MCP server allows users to connect their preferred AI tools directly to GTmetrix, enabling AI-assisted performance testing and analysis. This enables AI-assisted workflows for running tests, analyzing performance metrics, comparing historical results, and more.
  • DocsBot introduces AI Credits: The update introduces AI Credits, add-ons, and BYOK support, giving teams more flexibility to scale AI usage, bots, source pages, and user access as their requirements grow.
  • Ollie Pro brings AI-powered design and content creation: The update introduces AI tools that can generate layouts, write new content, and edit existing copy within the block editor, while using contextual information to align outputs with a site’s content and brand voice.
  • Builderius ships the Remote Sync feature: The feature lets users push a Builderius project from one WordPress installation to another in a single action. It supports deploying templates, components, dynamic data structures, and optionally selected WordPress data, while allowing users to choose exactly what gets transferred.
  • WPForms now lets AI assistants build and edit forms through the Abilities API: The new update adds write support for the WordPress Abilities API, allowing MCP-compatible AI assistants such as Claude, ChatGPT, and Cursor to create forms, add and edit fields, and update key form settings directly in WPForms.
  • RunCloud AI Monitoring launches in beta: The new feature continuously analyzes servers to detect anomalies, diagnose likely root causes, and recommend remediation steps. Designed as a read-only assistant, it provides guidance without executing commands or making changes automatically, while users remain responsible for reviewing and applying any suggested fixes.
  • Preview of the upcoming FlowMattic 7.0 release: The upcoming version will introduce a range of features, including Jaadu, an AI agent designed to assist across multiple builders, alongside a new image template builder, a reimagined PDF template builder, enhancements to the form builder, and many more.
  • Variety and Automattic will host a preview screening of Code for the People in New York: The event will feature the documentary short about the open web and its future, followed by a panel discussion with director Bao Nguyen, WordPress co-founder and Automattic CEO Matt Mullenweg, and other guests exploring questions of internet ownership, open source, and the forces shaping the web. Interested folks can register now.
  • Future of the Web 2026 report by WordPress VIP: The report on AI brand visibility finds that 74% of consumers believe the internet feels less human than it did a decade ago, with users experiencing bot fatigue after an average of 40 minutes online. It also found that 61% of consumers cannot name a brand that uses AI effectively in its messaging, while enterprise teams spend an average of 16.6 hours per week improving AI visibility.
  • The WP World has opened a limited number of new sponsorship opportunities: Only three new sponsorship spots are currently available, with annual sponsorships priced at $999 before the regular rate increases to at least $1,999+.
  • Andrew Garcia receives the Yoast Care fund for his contribution to the WordPress community:  Andrew Garcia, a member of the WordPress community, is the latest recipient of the Yoast Care fund. 
  • All new Inspeck: A new browser extension by Pulkit Mittal that allows users to measure, inspect, and edit any live page without opening DevTools.
🚀 NEW PROJECTS
“WordPress runs anywhere. Why doesn’t your knowledge base?”

Héctor Prieto about creating Cortext.
  • Cortext: A plugin by Héctor Prieto, this enables users to build and manage knowledge bases directly within WordPress. It supports nested pages, typed collections, multiple content views, and WordPress-based publishing for organizing and presenting documentation.
  • Withdrawal EU Law: Developed by Danilo Ulloa Pérez, the plugin helps websites to comply with EU consumer withdrawal regulations, including current requirements under Directive 2011/83/EU and upcoming June 2026 changes. It provides features such as a withdrawal request button, confirmation workflow, model withdrawal form, consent checkboxes for digital products and services, product exclusion notices, and administrative tools for managing withdrawal requests.
  • Governance Guardrails: The plugin by Malcolm Peralty provides file-based rules for managing admin behavior, capabilities, uploads, and operational hardening from code.
  • Comma Sense: Developed by Troy Chaplin, the plugin lets users populate the core Table block from a CSV file stored in the Media Library. The plugin automatically builds table headers and rows from the CSV and keeps the displayed data synchronized with the source file, while retaining the controls and styling options available in the core Table block.
  • BuddyNext: Created by Wbcom Designs, this is a community platform plugin for WordPress that combines activity feeds, groups, member profiles, messaging, moderation, and other social networking features into a single plugin designed to help sites build and scale online communities.
  • Pressship: A Radical Speed Month Project by Fatih Kadir Akın, this is a command-line tool designed to streamline the WordPress.org plugin publishing process. It supports tasks such as validation, packaging, review submission, SVN-based releases, submission tracking, and testing plugins in WordPress Playground from a single workflow.
  • WP Trend Watcher: An open-source CLI workflow by Damon Cook that helps WordPress developers stay informed about ecosystem developments through AI-assisted analysis and human review. It collects articles from six configurable sources, generates summaries, and produces weekly reports.
  • Nahnu Asset Scanner: A new plugin by Jaime Alnassim that scans a site’s front end and creates an inventory of front-end assets that were loaded. It identifies JavaScript files, stylesheets, cookies, and third-party domains.
  • ShortPixel AI Alt Text Generator: The plugin automatically generates ALT text, captions, titles, and descriptions for every image on your site.
  • Kutchara: A new WooCommerce theme by Aleksandr Samokhin, crafted for cookware, kitchenware, interior, and home decor stores.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • Marcin Dudek reviewed 11 free WooCommerce plugins that help stores comply with the EU’s new withdrawal-button requirements. Testing each plugin on a real WooCommerce site, he compared their compliance features, usability, and limitations to identify the strongest options for EU merchants.
  • Robert Abela is joined by Adam Zieliński, in this episode of the Melapress Show, WordPress Core Committer and the architect behind WordPress Playground, to explore what Playground actually is, why it was built, and how it’s already changing the way people learn, test, and contribute to WordPress.
  • In this episode of the WP Tavern Jukebox podcast, Rahul Bansal, founder and CEO of rtCamp, discusses the future of enterprise WordPress agencies and the growing role of AI in their operations. The conversation explores rtCamp’s approach to hiring, specialization, client selection, and how the company is using AI across areas such as sales, project management, and development.
  • Casey Burridge argues that AI is putting pressure on the traditional WordPress plugin model of selling updates and support. He suggests that plugin companies may increasingly differentiate themselves through MCPs, SaaS-backed products, expert services, and other offerings that AI cannot easily replicate.
  • David McCan tells the story of Builderius, shaped by three founders aiming to give professionals full control over HTML, CSS, and data-driven web design.
  • Louise Linehan reports that llms.txt adoption is rising, but real usage data from 137K domains shows almost no actual demand for the file.
  • Maria Ansari examines WPBeginner’s decline from an estimated 2.6 million monthly Google clicks in 2021 to around 27,000 in June 2026, exploring the factors she believes contributed to the site’s dramatic loss of traffic.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

Popular Shopify Developer Platform Mantle Shuts Down, Impacting Hundreds of App Businesses

Mantle, the AI-powered business layer built for Shopify app developers, has announced plans to wind down its operations,…

Read more

WordPress 7.1 Release Squad Announced, Focus Shifts to AI, Collaboration, Media, Performance, and More

The release squad for WordPress 7.1, the second major release of 2026, has been announced, with the final…

Read more

Attackers Hijack ShapedPlugin Distribution Pipeline, Push Malware to Paying Customers

A supply chain compromise at ShapedPlugin has led to backdoored versions of its premium plugin being delivered through…

Read more

Uncanny Automator Breach Confirms Five Awesome Motive Products Compromised in Security Incident

Uncanny Automator has issued a security incident notice after discovering unauthorized access involving a third-party service used by…

Read more

Team WP-CONTENT.CO

Issue #277   |   June 23, 2026   |   Reading time: 29 mins

This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

Built with Newsletter Glue.