Hello!
This week on The WP Week Newsletter, we cover Wordfence’s PRISM detecting a backdoored update to a plugin in hours after being deployed, the security incident at WPManageNinja, the launch of WP Engine Commerce Connect for BigCommerce, along with new projects and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
🗣️TALK OF THE TOWN
PRISM, which is Wordfence’s autonomous AI vulnerability intelligence agent, discovered a critical supply-chain backdoor in version 10.8.7 of the Advanced Responsive Video Embedder WordPress plugin, which had around 20,000 active installations. The malicious code allowed unauthenticated attackers to gain full administrator access with a single HTTP request using a hardcoded token, and also sent site and administrator information to an external server. None of the users were affected thanks to the Protect the Shire initiative’s cooldown period.
The plugin author also confirmed this, and the author also raised the possibility that AI was responsible for introducing the malicious code, saying, “I started using AI, and it seems it went rogue on my code… I expect this was an AI model I used.” He said he is also changing the release process to prevent similar incidents from happening again.
In a separate post on the WordPress.org support forum, the plugin author later said that he had also been hacked. He said he installed a new Linux distribution on a different SSD because he could no longer trust his old system. He explained that he was recovering his data “tiny piece by piece” rather than copying everything back at once, and said, “I watched it try again after this happened and I was aware,” although he was unsure whether it came from his system or remotely.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
WPManageNinja disclosed a security incident in which an attacker compromised an old server that remained connected to its plugin update infrastructure after the company migrated its store and licensing system away from Easy Digital Downloads (EDD). For about five hours on July 31, the server distributed tampered versions of Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11, including to sites with automatic updates enabled. WPManageNinja says around 295 customer accounts may have received the altered files, although 1,368 customers who downloaded either plugin on July 30 or 31 were notified because its logs could not determine exactly which copy each site received. Clean versions were released, the old server and routing were shut down, and affected users are being asked to reinstall the plugins and check their sites for signs of compromise.
- WordPress 7.1 Source of Truth: This allows the community to get the latest information about the upcoming changes and new features in WordPress 7.1 quickly. Also, WordPress 7.1 Beta 4 is now available.
- WordPress project trims PHPUnit CI jobs to make upcoming releases leaner and steadier: Ahead of WordPress 7.1, the project has reduced redundant database combinations in the PHPUnit matrix, cutting jobs by about 52% and job-minutes by 54% per run. Gutenberg builds are now fetched once per run instead of once per job, while bounded Docker pull retries have also reduced the share of runs needing a rerun from about 68% to 36%.
- WordPress Coding Standards 3.4.1 fixes a security flaw that could enable arbitrary command execution: The security release addresses a vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff that could allow untrusted PHP code to execute commands on the scanning host when using the WordPress or WordPress-Extra rulesets. It also updates minimum dependency versions for PHPCSUtils and PHPCSExtra and includes documentation and housekeeping improvements.
- Matt Mullenweg shares ideas for defensive data design as agents take on more tasks: He suggests making actions such as trashing and drafting easy while making deletion and publishing harder. He also calls for reversible and visible changes, clearer presentation of underlying data, plain-language error messages that explain why something failed, graceful failure, and treating networking, formatting, and structure as potentially unreliable or hostile.
- WooCommerce 11.0 release is delayed: The release has been tentatively postponed from July 28 to August 4, 2026, after testing RC1 uncovered a fatal error linked to a new performance feature. The team is preparing RC2 with a fix and will conduct further testing before the stable release. Rémi Corson traced the fatal error to WooCommerce’s new persistent product status counters, where an integer value supplied through an external filter triggered a PHP type error. He also examined why the team chose to temporarily disable the feature rather than apply a quick fix, arguing that the incident shows the release process working as intended.
- WP Engine seeks sanctions against Automattic and Matt Mullenweg over alleged evidence preservation failures: They claim that relevant WhatsApp, Signal, and Telegram communications were not properly preserved and that some messages are no longer available. WP Engine is asking the court to allow adverse inferences about the missing evidence, dismiss Automattic’s trademark-related counterclaims, and award legal fees and costs.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026): There were 223 vulnerabilities disclosed in 175 plugins and 6 themes.
- Claude reached real systems during cybersecurity tests due to a misconfigured evaluation environment: Anthropic found three incidents where Claude models, during supposedly isolated cybersecurity evaluations, gained unintended internet access and reached real-world systems. The models mistook those systems for part of their simulated challenges, resulting in unauthorized access, including production data and a malicious PyPI package that ran on 15 real systems. Anthropic has halted the affected evaluations and is strengthening monitoring and security controls.
🔧 TIP OF THE WEEK
Prefer SVG Icons Over Icon Fonts
Advantages:
- Smaller downloads
- Sharper icons
- Better accessibility
- Better LCP
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
WP Engine has announced a strategic partnership with Commerce, the AI-driven commerce company formerly known as BigCommerce Holdings. The partnership introduces WP Engine Commerce Connect for BigCommerce, a solution designed to help growing mid-market businesses modernize their commerce stack without rebuilding their existing WordPress websites. Commerce, which rebranded in August 2025, is the parent company of BigCommerce, Feedonomics, and Makeswift.
- The Complete WordPress Security Guide by WP Umbrella and Patchstack: A comprehensive WordPress security guide created for people managing WordPress sites, particularly client sites, who may not be security experts.
- The State of WordPress Plugin Opportunities 2026: The report analyzes 60,257 WordPress.org plugins and finds that 43.8% have not been updated in 24+ months, including 207 plugins with 10K+ installs. By install size, 24.5% of plugins with 1K–10K installs are stale, compared with 10.9% of those with 10K–100K installs and 2.2% with 100K–1M installs, while none of the 1M+ plugins are abandoned.
- The Core AI Prompt Bar is coming to WordCamp US 2026: The WordPress Core AI Team will host the Prompt Bar on August 18 and 19, where attendees can connect with contributors, ask questions, share feedback, and discuss their AI projects. The booth will be staffed by Core AI team members, contributors, and volunteers.
- FooGallery Bundle Survey: FooPlugins is building a FooGallery bundle for people who run multiple WordPress sites, such as agencies, and is asking how they actually work to help shape it. The survey asks about the number of sites respondents manage, plugin spending, licensing preferences, pricing, and more. Those who leave their email with a genuine response will receive a $50 discount voucher for the upcoming bundle.
- FlyingPress celebrates six years with a new chapter on the horizon: Gijo Varghese marked FlyingPress’s sixth anniversary by reflecting on its growth from a simple idea to a product now installed on a new website roughly every nine minutes. He also teased something special in development for the next chapter, with more to come next month.
- Simple Turnstile plugin reaches more than 200,000 active installs: Elliot Sowersby highlighted that the plugin reached the milestone four months earlier than his December estimate. It took just under a year to add another 100,000 active installs, with the plugin now averaging more than 1,920 installs per week and 37% year-over-year growth.
- New milestone for Slim SEO plugin: The plugin now has over 70k active users.
- Static Studio launches a new on-demand WordPress runtime: The new runtime automatically starts WordPress when users need to edit their sites and shuts it down after changes are deployed, while static websites remain online. The update also adds daily backup options, downloadable full backups, and SFTP that shuts down alongside WordPress. The new infrastructure is now available for all Static Studio sites.
- WPBakery 9.0 is now available: The latest release, developed over more than eight months, introduces a rebuilt drag-and-drop engine, more than 70 updated content elements, 40+ redesigned attribute types, and modular CSS loading for more selective asset delivery. It also expands compatibility across the WordPress ecosystem, adds a new Knowledge Base, and brings extensive codebase optimizations aimed at making editing smoother and performance more predictable. WPBakery 9.0 is available now, with a 10% discount on licenses and Support Plus plans using code WPB9LAUNCH10OFF through August 31, 2026.
- FluentCart 1.6.0 puts subscription billing in your hands: Store owners can now choose between gateway-managed and store-managed renewals, use one-time payments for recurring orders, and optionally automate charges through Stripe and PayPal. The release also adds renewal notifications, failed-payment retries, expanded subscription controls, and several storefront and admin improvements.
- Gravity Forms 3.0 brings international phone formats and accessible defaults: The release adds international phone support with country selection and validation, enables accessible settings by default for new forms, and introduces an accessible datepicker. It also adds Block API v3 support, developer hooks and updates, along with various fixes and security enhancements.
- Elementor’s Angie can now build full WordPress pages from a single prompt: Angie can now build full pages, design systems, forms, and loops in WordPress, creating real, structured, and editable Elementor content. Angie Code can also build custom Elementor widgets, WordPress admin snippets, custom post types and fields, and front-end enhancements. Generated content can be opened and edited in the Elementor Editor.
- Novamira CLI has been released: With the latest update, users can now connect Claude Code, Codex CLI, Gemini CLI, or any terminal coding agent to WordPress from the command line.
- Sponsorship spots on WPFolks are now open: After reaching more than 1,000 members, the community has opened three annual sponsorship plans priced at $500, $1,000, and $1,500. Thirty percent of each sponsorship will go to the Community Fund, supporting WordPress events, WordCamp tickets, travel, and accommodation for developers. The remaining 70% will fund the platform’s operations and development, while membership remains free and ad-free. WPFolks has also launched a Repos (Git) directory for WordPress projects looking for contributors, co-maintainers, testers, documentation, translations, design, marketing, or support. Projects can list their needs through the WPFolks dashboard, while repositories already linked from plugin or theme listings are added automatically.
- Ronald Huereca begins open-sourcing his premium WordPress plugins: He has released GB Extras, an add-on for GenerateBlocks, publicly on GitHub as the first premium plugin in his gradual shutdown and open-source effort.
- Andrei warns about a fake Contact Form 7 plugin: He says a malicious plugin named contact-form-7-pro can appear alongside the legitimate Contact Form 7 plugin, making it easy to overlook. He advises users to check their plugins folder for both and delete the fake version. The warning was also shared by Contact Form 7 creator Takayuki Miyoshi, who confirmed that the plugin has never had and will never have a “Pro” edition.
- Joey Kudish asks WordPress users how they are approaching AI visibility: He asks whether WordPress site owners are thinking about being recommended, discovered, or indexed by AI tools such as ChatGPT, Claude, and Perplexity, and what they are currently doing to improve their sites’ visibility in those systems.
- Derek Ashauer shares his “current conspiracy theory” about WordPress usage: He argues that WordPress is not declining among “real” sites but is being used less by “shady people.” He describes how WordPress was used to create large networks of sites for SEO and money-making purposes, and says those tactics no longer work as well while AI makes it easier to spin up fake sites.
- Jake Goldman shared how a personal WordPress itch grew into an official browser extension: What started in April as a way to keep WordPress admin tools accessible without the admin bar getting in the way has grown into a broader toolkit for WordPress users, testers, and developers. After Goldman shared an early build with Matt Mullenweg, the project moved into the official WordPress GitHub organization and now includes site detection, a site launcher, block outlines, cache-busting reloads, storage clearing, and a mobile-sized preview, with release candidates being prepared for the Chrome Web Store and Mac App Store.
- Jan Stevens says new WordPress.org plugins get little search visibility at launch: He says newly published plugins can be “basically invisible in search for ~2 weeks,” leaving developers to find their first users through networks, communities, and content. He is documenting the process of building in public from day one.
- Kamran Abdul Aziz shared what finally got him contributing to WordPress after 16 years: He says he never understood that WordPress was largely built by volunteers and assumed WordCamp and contribution were mainly for developers. A disappointing first WordCamp reinforced that perception, while a lack of clear guidance left him unsure how someone like him could get involved. His experience at WordCamp Asia 2026 finally changed that, leading to his first pull request, translation work, and a deeper involvement with the WordPress community.
- Md Noruzzaman receives the Yoast Care fund for his contributing to the WordPress community: Md Noruzzaman, a valued member of the WordPress community and Senior WordPress Developer and Team Lead at Boomdevs, is the latest recipient of the Yoast Care fund.
🚀 NEW PROJECTS
| “Feels a little weird launching a new plugin when so much of X seems negative about software dev, but I set a goal and I’m seeing it through.“ Maarten Belmans about creating Product Search for WooCommerce. |
- Product Search for WooCommerce: A new live-search plugin by Studio Wombat designed to help customers find products quickly. It offers typo-tolerant and synonym-aware search, relevance ranking, support for product attributes and variations, and customizable search results, with integrations for Gutenberg, Polylang, and WPML.
- WP Analyze: Built by Sumon Sarker, the platform tracks every WordPress.org plugin daily, recording rankings, install counts, ratings, and keyword trends. It also provides estimated install numbers with confidence ratings and side-by-side comparisons of competing plugins, building a history that WordPress.org does not provide.
- Vova’s Post Grids: The plugin by Vova Anokhin allows users to build responsive post grids with flexible queries, complete card controls, and AJAX pagination.
- Ahentic: An AI workspace for WordPress built as a week-long experiment using the WordPress Connector API, AI Client, Abilities API, and AI connector plugins. Benjamin Intal shared a preview showing how it can understand a website, help launch it, and install plugins without external servers, services, or MCPs.
- The Missing Admin Bundle for Gravity Forms: Built by Johnathon Williams, it combines four Odd Jar plugins—Form Analytics Pro, Global Search, List Form Pages, and Manage Drafts—into one plugin with a single license and a single update process.
- AAArdvark Circle: A new initiative by Natalie MacLees, this is a fully online membership community that offers practical accessibility lessons, monthly live Q&A sessions, and deep-dive webinars, along with templates, pricing guides, worksheets, and other resources for freelancers and agencies.
- Reimagine AI Tool by Vecteezy: The new AI tool lets users customize vectors and photos in seconds without requiring prior design experience. Reimagine is available to Vecteezy Pro users and users on a free trial.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- The latest episode of Seriously, Bud? features Gerasimos (Makis) Mourelatos, exploring his journey from growing up in Athens to building a career around technology, cybersecurity, WordPress, and entrepreneurship.
- This episode of The WP Minute’s Agency Action explored the challenges of taking a sabbatical and whether an agency’s team and processes can keep things running in the owner’s absence. Kurt and Toby also discuss project pricing in the age of AI, building trust with clients, the future of content creation, and getting more comfortable asking for money.
- Anne McCarthy, the release lead for WordPress 7.1, joined Eric Karkovack on The WP Minute+ to demo new features, uncover a few hidden gems, and discuss what didn’t make the cut, including collaborative editing. She also shares her experience and responsibilities as a first-time release lead.
- Maciek Palmowski on WP Tavern Jukebox discussed Patchstack’s testing of WordPress hosting providers and whether their “secure hosting” claims hold up in real-world conditions. The conversation covers penetration testing, gaps between security tools and their implementation, layered defenses, hosting standards, and how AI is changing the threat landscape.
- Shahjahan Jewel joined Jeffrey Dalrymple on Lytbox to discuss how AI is changing WordPress and how WP Manage Ninja and the Fluent tools team are navigating the shift, including how they are using AI across their team and products.
- Ferdy Korpershoek explores whether AI and the rise of new website builders could threaten WordPress, what the web might look like without it, and why AI could ultimately make WordPress stronger.
- Patchstack examined WordPress.org’s Protect The Shire update delay and its impact on plugin and theme security updates. Based on data from more than 100 releases, the analysis compares the original 24-hour delay with the newer six-hour window and argues that the policy addresses supply-chain attacks while delaying access to fixes for disclosed vulnerabilities.
- Anne McCarthy provided a behind-the-scenes look at why WordPress 7.1’s inherited styles feature was punted, walking through the design iterations, user feedback challenges, accessibility concerns, and experiments with AI.
- Austin Ginder shared about his fourth attempt at rethinking the WordPress admin after three earlier projects took different approaches to replacing, decorating, or rebuilding wp-admin.
- Varun Dubey outlined a five-step approach to handling bug reports, treating them as leads into the codebase rather than specifications for what to build.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- Build your first AI-Powered WordPress plugin: From WordPress Developer Blog
- Rethinking do_action(): Events as objects, hooks as class names: From WordPress Developer Blog
- Liberating sites with Studio Code: From Jonathan Bossenger
- Getting started with the WordPress Abilities API: A practical guide: From Kinsta
- The easiest way for non-techies to move from Wix to WordPress using ChatGPT: From Jamie Marsland
- Locking down the WordPress REST API: From David McCan
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp US, Phoenix on August 16 -19 2026: The call for sponsors is now open. The tickets are now available, and the schedule has also been published.
- WordCamp Philippines 2026 on August 28-29: The call for sponsors is now open. The tickets are also now available, and Contributor Day registrations are also now open.
- WordCamp Jinja 2026 on September 19th-20th: The call for speakers, sponsors, and volunteers is open. The tickets are now available.
- LoopConf 2026 on Sept 23-24: The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The call for sponsors is now open, and the team has unveiled the story behind their logo.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors is open. Also, interested folks can apply to be a part of the Translation Team.
- WordPress Day for AI Faro 2026 on October 24: The call for speakers and sponsors is open.
- WP Suomi 2026 on October 16: The call for sponsors and speakers is now open.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and volunteers is now open. The Contributor Day tickets are now available.
- CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
- CMS Conf 2026 on 12-14 November: The tickets are now available.
- WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors and speakers is now open, and this year’s theme is WordPress and AI.
- WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
- WordCamp Europe 2027 on 27 – 29 May: The event is in the early planning stages.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer (27 May–29 July) – Get up to 77% off + 3 extra months on the 2-year plan (prices start from €2.99 / £2.29 / $3.09).
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
WP Engine has taken its evidence preservation dispute with Automattic and Matt Mullenweg back to court, filing a…
WP Engine has announced a strategic partnership with Commerce, the AI-driven commerce company formerly known as BigCommerce Holdings. The…
The WP Community Collective is now known as The WP Open Community Collective (WPOCC), after CEO Sé Reed…
WordPress.org has reduced the Protect The Shire cooldown period for plugin and theme updates from 24 hours to…

Team WP-CONTENT.CO
This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
Built with Newsletter Glue.






