Issue #282 | July 28, 2026 | Reading time: 26 mins
Hello!
This week on The WP Week Newsletter, we cover Matt Mullenweg’s reply on the active installs growth chart Track ticket, changes set to arrive in WordPress 7.1, The WPCC changing its name to The WPOCC in light of a trademark filed by The WordPress Foundation, along with new projects and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
🗣️TALK OF THE TOWN
He suggested that Mark Riley could act as an ombudsman, saying the issue involved competing interests and that the long-term incentives of commercial and community plugins, and their relationship with Core functionality and the roadmap, also needed to be considered.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
What’s coming in WordPress 7.1
The upcoming version turns the built-in SVG icon system into a public API, allowing developers to add custom icons, group them into collections, render them in PHP, and access them through the REST API. It will also introduce native minimum width block support, allowing blocks and themes to opt in to a minimum width control that applies the CSS min-width property without requiring custom CSS. It will also add a new “Mark as decorative” option in the Image block that lets users explicitly identify images that should be hidden from assistive technologies.
Besides these, there will also be a new background.gradient block support, support for editable blocks inside the Custom HTML block, text shadow support in Global Styles, client-side media processing, media library infinite scrolling will be enabled by default while adding a per-user option to disable it, and several updates to the editor component. Also, the React 19 upgrade won’t be part of WordPress 7.1.
- WordPress Accessibility Team extends the deadline for accessibility-ready theme reviews: The team says it needs more time to re-review themes under the updated guidelines, moving the deadline to September 30, 2026. Themes with the accessibility-ready tag that have not requested a re-review by October 1 will be delisted from the theme directory.
- WordPress 7.1 Beta 3 has been released: The version addressed more than 71 issues since Beta 1. The release includes improvements to global styling controls, media uploads, Notes, responsive styling, and custom CSS. Also, Unicode email address support will not be included in WordPress 7.1 and will instead continue in a community plugin. The final WordPress 7.1 release is scheduled for August 19, 2026.
- WordPress Community Team proposes replacing monthly status meetings with written updates and coworking sessions: In a proposal by 2026 Team Rep Juan Hernando, monthly meetings would be split into two separate formats after attempts to improve attendance across time zones failed to increase participation. A monthly written digest would cover team updates, while live coworking sessions would give volunteers time to work together on actual team tasks. Hernando is asking for feedback on the format and whether it should first be tested for one or two months. The team has also put forth a proposal to bring back the Meetup Organizer Newsletter.
- Gutenberg 23.6 makes the Playlist and Tabs blocks stable and expands editing capabilities: The release adds inline notes and @mentions, a dynamic mode for the Gallery block, and support for plugin- and theme-registered icon collections. It also brings improvements to responsive styling, global style controls, media handling, collaboration, and other improvements and bug fixes.
- WordPress Playground asks users to test its new interface before launch: Fellyph Cintra is asking users to test the new WordPress Playground UI on desktop and mobile before its official launch. The testing covers creating and managing Playgrounds, Blueprints, developer tools, importing and exporting data, and sharing, with feedback sought on usability, functionality, design, and clarity.
- WordPress AI plugin 1.2.0 adds suggest reply, bulk content summaries, and new read-only abilities: The update introduces a new experiment for generating contextual replies to comments, the ability to create summaries for multiple posts or pages at once, and structured, permission-aware access to WordPress content and user data.
- WooCommerce is dedicating three months to improving its core plugin: Beau Lebens (Artistic Director and overall Lead for WooCommerce) announced that WooCommerce’s product and engineering teams will spend the next three months focused exclusively on the core plugin, reviewing thousands of open GitHub issues and pull requests. The initiative will prioritize improvements across four key areas: performance and reliability, the developer experience, the store admin experience, and the checkout engine.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026): There were 75 vulnerabilities disclosed last week across WordPress Core and plugins.
- OpenAI and Hugging Face investigate an AI agent that compromised infrastructure during a security evaluation: The incident occurred while OpenAI was testing models with reduced cyber safeguards to measure their ability to carry out complex, long-term cyber operations. During the evaluation, the models identified and exploited a zero-day vulnerability to gain internet access, then chained together stolen credentials and other vulnerabilities to access Hugging Face’s production infrastructure and obtain information related to the test. Hugging Face detected and contained the activity, and both companies are now investigating the incident, patching vulnerabilities, and strengthening security controls and monitoring for future model evaluations.
- A PostgreSQL ORDER BY injection bypassed Baffin Bay WAF protections and exposed database information: During a client engagement, Sanjay Das found that a column parameter in a Member API’s /api/v1/posts endpoint was being inserted directly into a PostgreSQL ORDER BY clause. After the Baffin Bay WAF blocked common SQL injection payloads, they identified PostgreSQL functions and techniques that bypassed the WAF, including error-based extraction, dollar-quoting, and a blind division-by-zero check. The testing exposed database and server information, PostgreSQL function source code showing the unsanitized query construction, and database objects.
🔧 TIP OF THE WEEK
Use CSS Variables for Theme Colors
Instead of hardcoding:
color:#0055cc;
Use:
color:var(–primary-color);
Changing branding becomes much easier.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
The decision came after CEO Sé Reed discovered the pending WordPress Foundation trademark application for the “WPCC” acronym. The organization said it opted to rebrand to avoid a potential dispute while continuing its work unchanged.
- Linux Foundation joins Open Secure AI Alliance to support open AI security: The Foundation has joined NVIDIA and other technology companies as a founding member of the Open Secure AI Alliance, a collaborative initiative focused on developing open tools and techniques to improve AI security. The Foundation said open models and open weights are essential for building transparent, secure, and trustworthy AI systems.
- WordCamp US is opening a sponsored Creator Studio for attendees to record content on-site: The studio will be available from August 16–19, with bookable 60-minute sessions for podcasts, interviews, reflections, and other creative content. Registered attendees can sign up for a limited number of slots and use the provided video, audio, lighting, and backdrop equipment. They have also published an interview with WCUS Wapuu designer Deb Ciriaco.
- Essential Addons for Elementor is celebrating its ninth anniversary: To mark the milestone, the team has launched a special birthday campaign offering discounts of up to 40%.
- SureRank turns one: As part of the celebration, all Pro plans are up to 45% off until August 3.
- Marcin Dudek finds WordPress.org’s active-install numbers cannot be independently audited: He investigated claims that a theme author had inflated their active-install count and instead concluded that WordPress.org’s active-install metric is rounded, lacks a public history, and relies on an unauthenticated reporting mechanism that cannot be independently verified. His analysis argues that someone other than a plugin owner could report inflated active-install data, while unusual download-to-install ratios alone cannot identify who caused an anomaly. Legitimate distribution methods and attacks targeting a competitor can produce similar patterns, prompting Dudek to begin recording active-install numbers over time to create the historical record WordPress.org does not currently publish.
- Nikolai Graf-Rüssel forecasts a gradual decline for WordPress as AI builders take over simpler websites: He forecasts a gradual decline in WordPress market share through 2029, driven mainly by AI-first and hosted website builders taking more simple SMB and low-complexity website projects. He expects WordPress to remain strong for content-heavy sites, agencies, publishers, WooCommerce, memberships, multilingual sites, and custom workflows, while arguing that WordPress hosting should move toward AI-assisted managed WordPress, performance and security improvements, and migration support.
- Andrew Palmer and Stephanie Hudson launch Pressing Forward as a podcast for product owners: Pressing Forward offers product owners a guaranteed podcast appearance focused on their founder story and software, including a deep-dive tutorial and a professionally edited video asset. The podcast uses an appearance-fee model based on 5% of a guest’s current or projected monthly recurring revenue, capped at £2,500 per episode. Palmer said they will also ask tough questions and provide honest feedback about the products featured on the show, with episodes promoted across the podcast’s publishing channels and their own networks.
- Roi Tal and Miriam Schwab to showcase AI-powered full-page generation with Angie: During a webinar scheduled for today, Roi and Miriam will demonstrate how users can generate complete Elementor pages from text prompts using Angie. The session will also showcase AI-generated design systems, complex layouts such as forms and loops, and manual page editing with full control.
- Brad Williams is building a social/blog dashboard that fetches interesting posts and topics on a schedule: The dashboard knows the “WDS (WeDevStudios) voice,” and will help to curate content, and suggests re-promotions of existing content. Williams also asked what cool tools others are building with AI to help their companies.
- Pavel Ciorici on noticing a strange pattern in WordPress theme refunds: He highlighted that some customers buy one of his WordPress themes, customize it to match the demo, and then request a refund less than an hour later while the theme is still installed, configured, and powering their live website. Although his team generally has no problem refunding customers who decide a product is not the right fit, the pattern has made him question where the line lies between trying a product before buying and using a refund policy as a free trial.
- Syed Balkhi says WordPress security warnings need more context: Balkhi said a customer received a recommendation from Pagely to turn off a plugin after a low CVE report was disclosed involving an admin-level user being able to delete a file. He argued that users with admin access already have the ability to make significant changes to a WordPress site and said fear mongering hurts the overall ecosystem.
- Sybre Waaijer says current WordPress Core developers are “vibing” their way toward 40% of the web without senior inspection: Waaijer says the approach looks benign but is dangerous, claiming he counted one bug for every two lines of new code added after WordPress 7.0 and warning that WordPress 7.1 will be worse. He advises users to stay on WordPress 6.9 or move to ClassicPress, which he says has standards.
- Rodolfo Melogli announced the WooCommerce Founders directory is ready for submissions: The community-sourced directory brings together the people and companies building the WooCommerce ecosystem, including plugin makers, hosts, agencies, payment providers, and others.
- Uttkrista Chhetri receives the Yoast Care fund for his contribution to the WordPress community: Uttkrista Chhetri, a valued member of the WordPress community, is the latest recipient of the Yoast Care fund.
- Jonathan Jernigan bids goodbye to his WordPress career: He is launching a new company called Surfside JDM that focuses on importing cars from Japan.
- Jamie Marsland experiments with making WordPress as easy to design with as Canva: Marsland introduced Gogh, an experimental visual editing tool that lets users create WordPress layouts through a freeform canvas experience while keeping the output native to WordPress. The project explores drag-and-drop design, AI-assisted page creation, CSS Grid-based layouts, and a simpler approach to building websites without traditional page builder complexity.
- Novamira 1.10.0 update has introduced Novamira Design: It is designed to reduce the generic, look-alike output often produced by AI-built WordPress pages. It creates a design system covering elements such as fonts, colors, spacing, voice, and design rules, which AI agents can use when building pages across different WordPress builders and themes.
- FluentCommunity 2.7.5 adds audio sharing and gives members more control over the community experience: The release introduces audio uploads and an audio media gallery, adds Details and LaTeX (math) blocks to lessons, lets members change passwords from their profiles, and gives admins control over the portal’s default light, dark, or system theme. It also includes document renaming, faster feeds and permission checks, stronger access controls, and a range of bug fixes and stability improvements.
- Custom HTML Block Extension 4.1.0 adds new editing options and WordPress 7.1 support: The release introduces per-block control over the initial editing mode, expands support for innerContent-based Custom HTML blocks, improves the editor and settings experience with accessibility and UI refinements, and resolves several issues affecting the editor and settings page.
- FlowMattic 7.1 lets you choose which modules run on your site: The update switches unused core modules off by default, adds front-end table embeds, a developer API and CSV import wizard for FlowMattic Tables, and improves Forms with smart-tag prefilled fields and native rendering. It also brings a unified updates notice, security hardening, and several bug fixes.
- WP Plugin Info Card is looking for a new developer: Ronald Huereca shared on X that the plugin’s owner, Brice Capobianco, is looking for someone to take over its development.
- Popular Authors plugin is being retired: After six years, Ajay D’Souza is retiring Popular Authors, a companion plugin to Top 10 that ranks a blog’s authors by page views. With around 10 active installs, the plugin never found an audience, so version 1.5.0 will be its final release. It will remain available on WordPress.org and continue to work for existing users, but there will be no further updates or support, including security updates. The feature is now moving into Top 10 Pro.
- ACF’s Annual Survey 2026 is now open: The survey is running in its fourth year to learn how users work with ACF and WordPress and what could be improved or added to ACF. The survey takes about 15 minutes, and anonymized results will be published later.
🚀 NEW PROJECTS
| “Turn WordPress backups into local Docker sites in minutes, switch PHP versions, and skip manual setup.” Rene Hermenau about creating WP Staging Desktop. |
- WP Staging Desktop: A desktop app by the creators of WP Staging that lets users clone a live WordPress site to their computer and turn it into a local environment for development, testing, and debugging. Using a portable WP Staging backup, you can create a working local copy with the site’s files, database, plugins, themes, and uploads, then safely test changes without touching production.
- ThinkRank: An AI-native SEO plugin created by WPDeveloper, it combines traditional SEO tools with AI features such as a content brief generator, metadata generation, real-time SEO score, MCP server, and competitor analysis.
- FooGallery Client Proofing: FooPlugins’ newest plugin allows users to turn an existing FooGallery into a private client review session, where clients can approve, reject, and comment on images through a secure link.
- Amelia Business App: The app gives admins and employees mobile access to their schedules, appointment and event details, status updates, and QR-code event check-ins, helping teams manage their booking operations without relying on the WordPress backend.
- DocsPress: Created by Fatih Kadir Akın, it syncs Markdown documentation from a GitHub repository to WordPress, converting it into editable Gutenberg Pages while preserving the documentation structure. It also supports two-way synchronization, allowing changes made in WordPress to be proposed back to GitHub as pull requests.
- Plugin Auditor: Created by Mayank Majeji and Mahesh Pawar, the tool scans WordPress plugins from WordPress.org or uploaded ZIP files for issues across security, compatibility, performance, coding standards, privacy, and accessibility. It runs 72 checks, scores each of the six categories out of 100, and identifies what is wrong and where.
- CSS Guardrail: Developed by Nick Laux, the plugin scans CSS changes made through the Theme File Editor and Additional CSS before they are saved, blocking dangerous edits and explaining the risks. It also creates pre-save backups and logs CSS events, making problematic changes easier to trace and undo.
- Gigatoken: A high-performance tokenizer developed by Marcel Rød that serves as a drop-in replacement for Hugging Face Tokenizers and Tiktoken, delivering up to 1,000× faster tokenization on modern CPUs.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- Bud Kraus talked with Gerasimos (Makis) Mourelatos on this episode of Seriously, Bud? about his life and career, from growing up in Athens to working in technology, cybersecurity, and WordPress. They discuss travel, Greece, entrepreneurship, AI, WordPress, open source, and the personal experiences that shaped his journey.
- Nathan Wrigley explored accessibility in WordPress themes with Jessica Lyschik on WP Tavern Jukebox, covering practical steps toward accessibility-ready themes, the differences between block and classic themes, documentation challenges, and how accessibility is becoming increasingly important across the WordPress ecosystem.
- In this episode of The Melapress Show, Robert Abela conversed with Kyle Van Deusen, owner of OGAL Web Design and founder of The Admin Bar community, shared how he qualifies leads, prices projects, and hands websites over to clients. The discussion covers lead forms, pre-quote calls, paid discovery workshops, safe admin access, and structuring website management retainers.
- Job Thomas compares Automattic’s working style to jazz, describing a culture built around freedom, collaboration, and improvisation rather than strict structures and predefined roles.
- Ryan Welcher puts WordPress Studio Code to the test by building a real-world hockey team website almost entirely through prompts. The livestream offers an honest look at the AI-powered workflow, showcasing features such as custom post types, block bindings, and more.
- Thilina Pituwala explained how WooCommerce.com speeds up specific requests by loading only the plugins those requests actually need. The approach reduced memory use by more than 50% on some requests and improved latency, but requires careful route-specific rules, testing, and monitoring to avoid breaking dependencies.
- Blaise uses recent Censys research showing that more than 70% of publicly visible WordPress sites with exposed version information are running outdated PHP to argue that PHP lifecycle management is a hosting infrastructure responsibility, not something site owners can realistically handle themselves.
- Elliot Richmond explained how he used WordPress Playground and Blueprints to create a safe, browser-based training environment for a client migrating from a classic theme to a full block theme, using the client’s actual theme, plugin, and selected content.
- Joost de Valk argues that websites are evolving from pages designed mainly for human visitors into verified, machine-readable home bases for businesses. He explored how websites will need to serve both people and AI agents, support direct actions, and act as a trusted source of truth as more decisions move beyond the website itself.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- How WordPress decides a theme is a “block theme”: From Gutenberg Times
- WordPress AI integration: A deep dive into architecture and a real-world use case: From Kinsta
- How WP-CLI aliases supercharge your agents: From Brian Coords
- PHP Unit testing in WordPress using wp-env: From Aleksandr Samokhin
- How to monitor API requests in WordPress plugins: From WP Winners
- Registering and rendering SVG icons in WordPress 7.1: A deep dive into the new public API: From WP ScaleUp
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp US, Phoenix on August 16 -19 2026: The call for sponsors is now open. The tickets are now available, and the schedule has also been published.
- WordCamp Philippines 2026 on August 28-29: The call for sponsors is now open. The tickets are also now available.
- WordCamp Jinja 2026 on September 19th-20th: The call for speakers, sponsors, and volunteers is open. The tickets are now available.
- LoopConf 2026 on Sept 23-24: The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The call for speakers and sponsors is now open, and the team has unveiled the story behind their logo.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors is open. Also, interested folks can apply to be a part of the Translation Team.
- WP Suomi 2026 on October 16: The call for sponsors and speakers is now open.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and volunteers is now open.
- CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
- CMS Conf 2026 on 12-14 November: The tickets are now available.
- WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors and speakers is now open, and this year’s theme is WordPress and AI.
- WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
- WordCamp Europe 2027 on 27 – 29 May: The call for organizers is now open.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer (27 May–29 July) – Get up to 77% off + 3 extra months on the 2-year plan (prices start from €2.99 / £2.29 / $3.09).
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
The WP Community Collective is now known as The WP Open Community Collective (WPOCC), after CEO Sé Reed…
WordPress.org has reduced the Protect The Shire cooldown period for plugin and theme updates from 24 hours to…
The WordPress Security Team has been hardening GitHub Actions workflows across the WordPress GitHub organization for the past…
WordPress 7.0.2 has been released to address two security vulnerabilities, a high-severity SQL injection vulnerability and a critical…
Team WP-CONTENT.CO
Issue #282 | July 28, 2026 | Reading time: 26 mins
This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
Built with Newsletter Glue.