The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#281 – WP 7.0.2 Security Release, WP.org Cuts Cooldown Period, Popular Themes List Irregularities, Elementor Draws Criticism

Issue #281   |   July 21, 2026   |   Reading time: 26 mins

Hello!

This week on The WP Week Newsletter, we cover the release of WordPress 7.0.2 that fixed two vulnerabilities, the cooldown period for the Protect the Shire initiative being cut down to 6 hours, irregularities in the WP.org themes list, several new surveys, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

WordPress 7.0.2 was released to address two security vulnerabilities: a high-severity SQL injection flaw affecting WordPress 6.8 and later, and a critical pre-authentication remote code execution (RCE) vulnerability affecting WordPress 6.9 and later. The two vulnerabilities can be chained together to allow unauthenticated attackers to execute code on a standard WordPress installation without plugins or other preconditions.

Adam Kues of Assetnote / Searchlight Cyber discovered the RCE vulnerability and later shared details about how the exploit chain, dubbed “wp2shell,” was uncovered. Patchstack CEO Oliver Sild said his team was tracking more than 1,200 unique IP addresses involved in the mass exploitation of the vulnerability.

Due to the severity of the vulnerabilities, WordPress.org pushed forced updates through its auto-update system. Cloudflare, GoDaddy, and InstaWP also deployed additional protections, with InstaWP releasing a tool to help site owners check for signs of compromise. Matt Mullenweg described the pre-authentication RCE as a rare type of vulnerability in WordPress’s history and highlighted the cooperation between different organizations during the response.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Konstantin Obenland (Director of Software Engineering at Automattic) said on Slack on July 16 that he had reduced the cooldown period for Protect the Shire to six hours as an initial step, with further reductions being explored through Gandalf. Ajay D’Souza later highlighted the change on X on July 18 when he pushed an update for one of his plugins.

🔧 TIP OF THE WEEK

Audit Third-Party Scripts Regularly

Common LCP killers:

  • Chat widgets
  • Tracking scripts
  • Heatmaps
  • Social embeds

Ask:

Does this script affect above-the-fold content?

If not, defer or delay it.

💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

Based on two years of data, Ciorici points to a recurring group of themes gaining active installs far faster than their download numbers would suggest, moving up and down the rankings together, and showing large gaps between WordPress.org’s claimed install counts and independent measurements. He also points to shared analytics data across several theme websites and says the numbers were reset in May 2026 before beginning to rise again.

  • Jean Galea says the boom in WordPress plugin installs is over: After analysing seven years of install data from established plugins, Galea said that the combined install base grew at double-digit rates in the early 2020s before slowing to single digits and then flattening out, with the past year tipping slightly negative. He also says downloads have remained broadly flat at around 5.5 million per day, while about a third of the established plugins he tracks grew their install base over the past three years, 40% remained flat, and more than a fifth declined.
  • GravityKit’s 2026 analysis shows WooCommerce leads while Shopify dominates the top 1 million sites: Using May 2026 HTTP Archive data, GravityKit found that WooCommerce is the most widely detected ecommerce platform across the measurable web, with Shopify in second place. The ranking reverses among the top 1 million sites, where Shopify leads WooCommerce, while Shopify is also the only major platform to record year-over-year growth at scale.
  • WP Umbrella co-founder Aurelio Volle shared the plugins agencies install most on WordPress sites: Data from 80,000 WordPress sites managed through WP Umbrella shows Yoast leading the list, followed by Elementor and Wordfence, with Advanced Custom Fields PRO also ranking highly. The data also highlights some unexpected patterns, including the continued use of Classic Editor, the strong preference for ACF PRO over Secure Custom Fields, the dominance of paid tools in several categories, and the absence of Divi from the list.
  • Elementor widget draws criticism after appearing without permission: Ryan Logan called out the widget, saying it should not appear on his clients’ websites, and questioned what appeared to be an affiliate link to Patchstack. He said Elementor had been installed as a page builder and that he had not installed or asked for the additional site management, accessibility, image optimization, AI, or other services being promoted. Paul Charlton of WPTuts reported a similar issue, while Elementor responded to both, saying that the widget would be removed in the next version, “ This widget will be removed in the next version which is scheduled to be released beginning of next week. We’re truly sorry about this, and our goal is to do better going forward.”
  • CommerceGurus Community Survey is now live: The company has launched its first community survey to gather feedback on how customers build and run their WooCommerce stores, the tools they use, and which features and future directions they want CommerceGurus to prioritise. The survey is open until August 14, with the results and planned actions to be shared afterward.
  • The first-ever State of PHP 2026 survey is now open: The PHP Foundation and PhpStorm have launched the survey to understand how PHP is used today, the tools and frameworks developers rely on, the challenges they face, and the future they envision for the language. The aggregated findings will be published in the State of PHP 2026 report later this year.
  • Nat Miletic asks the community what goes into their maintenance retainers: He wants to know what service mix keeps clients paying long-term and what types of businesses actually need ongoing support, with examples including plugin updates, security monitoring, monthly content edits, performance optimization, and being available when something breaks.
  • Rodolfo Melogli on whether “WooCommerce Days” could give local meetups a new format: He proposes turning existing local WooCommerce communities into yearly, in-person events that bring developers, agencies, freelancers, and merchants together while reducing the pressure on organizers to run monthly meetups. The idea would build on the existing Meetup network, with local communities taking ownership and WooCommerce providing support, without creating another layer of bureaucracy or another WordCamp program.
  • Brian Coords is seeking community input ahead of his WordCamp US 2026 Talk: His upcoming talk will cover block themes, agency workflows, and AI-assisted site building. Through the survey, he is seeking practical experiences from people who build and maintain client websites, including those who use block themes, follow a hybrid approach, or considered block themes but chose something else. Survey responses may be used anonymously in the presentation, unless respondents indicate otherwise.
  • Introducing the “Made on WordPress” Marketplace at WCUS: The curated section of the sponsor hall will feature merchants, makers, and small businesses that run on WordPress. Sponsors can nominate clients or customers, while local merchants and creators can also be invited directly. Participating merchants will receive a complimentary ticket to the event.
  • Jamie Marsland built a Canva-like page builder for WordPress with Fable: The working MVP, called Gogh, lets beginners edit pages directly on the front end with freeform layouts that can be dragged, resized, rotated, and snapped to guides. It publishes real Gutenberg blocks, works with block themes and theme.json, and converts layouts into CSS Grid for responsive pages that ship with zero JavaScript. It also includes undo/redo, shape dividers, section reordering, responsive typography, Media Library support, and more. He is considering releasing it on the plugin repository.
  • Robby McCullough shipped a Mario-inspired side-scroller with Beaver Builder AI: The game has been built locally and pushed to an AI lab using Beaver Builder’s MCP server. Players can try the game and see if they can beat the high score.
  • Daniel Iser turned the familiar highs and lows of WordPress plugin development into a game: In Install Clicker, players ship plugin versions, deal with support tickets, and eventually sell out to private equity, with a live leaderboard tracking how they fare. In its first week, players from 51 countries shipped 2,722 versions, survived 4,444 support tickets, and spent 45 hours clicking “Write Code.”
  • The WP World adds a Friends feature: The feature lets users send and accept friend requests, build private lists of confirmed connections, and see mutual friends who could help make introductions within the WordPress community.
  • GoDaddy has launched a developer platform for managing the full domain lifecycle: The platform allows developers to search for, register, configure, and manage domains through terminals, coding assistants, and AI chat experiences without switching to a browser.
  • Pantheon adds ElasticPress to its dashboard through Fueled partnership: The partnership brings ElasticPress.io’s scalable Elasticsearch infrastructure to Pantheon customers, making it easier to deploy fast, relevant search without managing the underlying infrastructure. The collaboration also lays the groundwork for semantic search, AI-generated answers, and search integrations across platforms including WordPress, Drupal, and Next.js.
  • Novamira Chat brings an AI agent directly into the WordPress dashboard for on-the-fly changes: Users can describe what they want in plain language, review the changes the agent plans to make, and approve them before they are applied.
  • Fluent Support 2.3.0 lets AI agents work directly inside your helpdesk: The update adds an MCP server that lets compatible AI agents securely read and manage support tickets within the permissions of the connected WordPress user. It also adds support for Gemini, and Anthropic, introduces new workflow conditions for FluentCart and Easy Digital Downloads, and adds WP-CLI migration tools for Zendesk and HelpScout, alongside improvements and security fixes.
  • FluentCart 1.5.4 adds native Bricks blocks, sharper AI search, and steadier PayPal subscriptions: The update lets store owners build FluentCart storefronts directly in Bricks Builder, gives connected AI assistants more precise access to live store data, and adds cross-site campaign attribution. It also improves subscription and payment reliability, particularly for PayPal, while bringing a range of storefront, reporting, dashboard, and stability fixes.
  • Gravity Forms introduced new AbuseIPDB add-on: The new add-on checks each submission against AbuseIPDB’s global database of reported IP addresses and automatically marks submissions as spam based on configurable abuse scores, country and domain blocklists, and other controls. It also lets site owners report spam submissions back to AbuseIPDB and enable protection globally or on selected forms.
  • AB Split Test 2.6.5 adds Custom Audiences for comparing how different traffic sources perform: The update lets you create reusable visitor segments and filter test results to see how audiences from sources such as YouTube, ChatGPT, Reddit, Meta, and other referrers perform within the same experiment.
  • WordPress Studio makes local sites faster, removes CLI dependencies, and adds Sonnet 5: The latest update makes Studio sites load 30–50% faster while using less memory, adds a dependency-free installation for the Studio CLI, and makes Anthropic’s Claude Sonnet 5 the default model for Studio Code.
  • Radio Station 2.7.1 is now available: The release fixed an issue that caused inline footer styles to break.
  • Wordify introduces server cron and cron Jobs: The new Cron Jobs tab in Console lets users run WordPress’s scheduler on a server-side schedule instead of relying on visitor traffic, helping scheduled tasks run more reliably on quiet and busy sites alike. Users can also create and manage custom cron jobs without SSH, choose from preset or custom schedules, and view queued WordPress tasks, including when they are due, whether they are overdue, and the option to run them on demand.
  • InMotion Hosting launches InMotion Cloud: This is a fully managed private cloud service built on dedicated hardware, offering businesses an alternative to AWS, Google Cloud, and VMware with predictable pricing, senior engineer support, and migration services for customers moving from those platforms or on-premises environments.
  • Ross Morsali launches OperatorKit as a new hub for the AI tools he is building: It is a growing collection of tools for “Operators,” with its current lineup including a Help Scout CLI that lets AI agents manage Help Scout with PII redaction and Dash CLI, which provides shortcuts for the command line. Ross said larger projects are also in development, with more details to come.
  • James Grierson built a full cross-platform task app on WordPress: The app, EndyList, handles everything from user accounts and authentication to data syncing, encryption, passkeys, and APIs through WordPress. Grierson explained how the project evolved from a weekend experiment into a real product, with WordPress providing the underlying infrastructure and AI agents writing most of the code.
  • Bob Dunn and Robert Jacobi launch Open Channels News to cover the wider open-source ecosystem: The new short-form, five- to ten-minute daily video news show will cover recent developments across open-source projects, business topics, metrics, and trends. It launches on July 27, with episodes available on YouTube and through the Open Channels FM podcast network.
  • Matt Zeunert announces the launch of the Website Bottleneck Finder to help identify website performance bottlenecks: The tool measures how individual resources affect milestones such as FCP, LCP, and H1 rendering time, helping developers uncover hidden bottlenecks and identify which requests to prioritize when optimizing page speed.
  • Introducing Coranto: This is an open-source CMS built by SimuCorps in Ruby, currently in pre-1.0 development. It provides a publishing system for teams with support for editorial workflows, portable content, plugins, themes, and self-hosted infrastructure. Dishpit (software engineer at SimuCorps), highlighted the project on X, with one of the images describing it as “the Ruby-powered alternative to WordPress.”
  • Automattic is hosting a fireside chat with Khyati Trehan and Kelly Hoffman on art and technology: The event is scheduled for July 22 at Automattic’s NoHo Space in New York, and interested folks can register now.
  • Patience Nekesa receives the Yoast Care fund for her contribution to the WordPress community:  Patience Nekesa, a member of the WordPress community, is the latest recipient of the Yoast Care fund. 
🚀 NEW PROJECTS
“Most online stores are built for browsing. Shoppers scroll, filter, and compare on their own. When they need help choosing, there is rarely anyone there to guide them..“

weDevs about creating CartPilot.
  • CartPilot: A new AI sales agent developed by weDevs for WooCommerce and Shopify that lets shoppers interact through voice or text to find products, compare options, get answers to buying questions, and add products directly to their cart.
  • Crocobuilder: An upcoming AI-native frontend builder by Crocoblock that provides developers with atomic DOM output, unified CSS control, and AI-generated components, while preserving access to the underlying code.
  • elevenX Image Alt Manager: The plugin allows users to identify images missing alt text and add descriptions directly from a dashboard. It also offers AI-powered alt text generation with customizable tones and context, along with filtering, statistics, and accessibility monitoring tools.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • On Seriously, Bud?, Bud Kraus conversed with Lana Miro about life in Ukraine during the ongoing war, her work in WordPress security, her experiences in the WordPress community, and more.
  • Amber Hinds, founder and CEO of Equalize Digital, joined Nathan Wrigley on the WP Builds podcast to discuss building a successful WordPress business in an uncertain market. The conversation covers accessibility, plugin growth, AI disruption, marketing, enterprise customers, and the long-term value of quality, expertise, and relationships.
  • Nathan Wrigley on this episode of WP Tavern Jukebox was joined by Milan Petrović to talk about the security and performance risks of legacy PHP in WordPress, why upgrading to modern PHP versions matters, and how developers and site owners can gradually modernize their sites and plugins.
  • Remkus de Vries on why WordPress builders and developers should look beyond the WordPress community and attend events in adjacent industries to gain a broader perspective on their work.
  • Joost de Valk builds on Dries Buytaert’s distinction between license-only and stewarded open source, arguing that stewardship alone does not reveal who can cut you off from a project.
  • Frederic Sune argues that WordPress agencies should stop treating migration from legacy page builders to Gutenberg and Full Site Editing as optional, making the case that block-based architectures can improve performance, security, maintainability, and client workflows while outlining how agencies can approach the transition safely.
  • Curt Noble argues that WordPress’s recent market-share decline may reflect the removal of spam sites rather than a loss of legitimate users, while the platform remains strong among high-quality websites and has positioned itself for the AI era with new agent-focused infrastructure.
  • Stephen Dumba highlighted the launch of Uganda’s 2026 WordPress Campus Connect at Bright Future Secondary School in Kaliro, where students and teachers explored WordPress, website creation, and digital career opportunities as volunteers began a journey to reach more than 20 schools across Central and Eastern Uganda.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress 7.0.2 Fixes Critical RCE and SQL Injection Vulnerabilities

WordPress 7.0.2 has been released to address two security vulnerabilities, a high-severity SQL injection vulnerability and a critical…

Read more

Developer’s Plugin Submission Flagged Over ‘-Press’ Suffix, Later Approved, Raising Questions About Review Consistency

A Reddit discussion has drawn attention to WordPress.org’s plugin review process after a developer said they received an…

Read more

WordCamp US 2026 Sparks Community Discussion Over Low Ticket Sales and Lack of Schedule

With just over a month remaining until WordCamp US 2026, scheduled to take place from Aug 16-19, low…

Read more

Community Feedback Halts Plans to Phase Out the Classic Block

An earlier decision to hide the Classic block from the block inserter by default in WordPress 7.1 has…

Read more

Team WP-CONTENT.CO

Issue #281   |   July 21, 2026   |   Reading time: 26 mins

This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings

Built with Newsletter Glue.