Issue #285 | August 18, 2026 | Reading time: 24 mins
Hello!
This week on The WP Week Newsletter, we cover the latest WordPress 7.0.4 security release, the launch of the official WordPress browser extension, the call for volunteers for WordPress 7.2, along with new projects and more.
Next week, we’ll be taking a short break from publishing the newsletter as we celebrate Onam 💮. We’ll be back the following week with fresh WordPress news, updates, and stories. Wishing everyone celebrating a very happy Onam! 🏵️
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
🗣️TALK OF THE TOWN
WordPress 7.0.4 is now available, fixing a remote code execution vulnerability that could allow a user with an Author-level account or higher to execute code through a malicious file upload on sites using Imagick and Ghostscript. The vulnerability was responsibly reported by the team at pwn.ai, and the fix is being backported through the 4.7 branch and to WordPress 7.1 RC3.
The release follows WordPress 7.0.2 on July 17 and WordPress 7.0.3 on August 6, marking three security releases in less than a month. WordPress 7.0.3 addressed 12 security vulnerabilities, including a pre-auth reflected cross-site scripting vulnerability on the login screen with the potential to lead to PHP code execution, which was also reported by pwn.ai, while 7.0.2 fixed a critical pre-authentication RCE and a high-severity SQL injection vulnerability. WordPress 7.1 RC4 is also now available.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
The extension lets users signed in to WordPress remove the admin bar from view while retaining access to key shortcuts through the browser toolbar. It also provides quick access to their WordPress sites and includes additional tools for building and managing WordPress content.
- WordPress Contributor Toolkit 1.0 streamlines the path to a first Core contribution: JuanMa Garrido introduces version 1.0 of the WordPress Contributor Toolkit, an experimental desktop app that handles development environment setup and guides newcomers through linking Trac tickets, applying patches, testing changes, updating trunk, and submitting contributions.
- WordPress 7.1 will expand accessibility improvements across Core and Gutenberg: The release adds 44 accessibility enhancements and bug fixes to Core and 43 to the editor, including improved screen reader support, focus states, labeling, tooltips, keyboard navigation, and high-contrast support.
- WordPress 7.2 call for volunteers: The planning is underway, with the final release proposed for December 9, 2026. Volunteers are being sought for Release Lead, Release Coordination, Tech Leads, Triage Lead, and Test Lead roles, with nominations open until August 28.
- Hands-on activity kits now live on Learn WordPress: A WordPress activity kit is a complete, ready-to-run session package for teaching WordPress topics, with a facilitator guide and slide deck included. Learn WordPress now has 11 kits covering topics such as contributor onboarding, accessibility, debugging, WooCommerce, AI, SEO, Playground, and security, designed for 60–90-minute hands-on sessions.
- The WordPress Credits dashboard is live: It provides weekly updated data on the program’s growth and impact, including student enrollment, participating institutions, contributions, sites built, and skills gained. The program is also inviting schools, companies, and mentors to get involved. The Community Team has also put forth a Graduate Retention Program to extend WordPress Credits beyond graduation. The proposal includes clear next steps for graduates, scoped contribution projects with Make teams, continued contribution and peer mentoring, credential pathways, and connections to ecosystem opportunities. It would be developed in three phases, starting with infrastructure and a re-engagement message.
- Introducing the WordPress.com Education Program: Launched at WordCamp US 2026, the program includes a free Student Plan that gives students access to a professional WordPress.com environment with plugin and theme support, advanced tools, 6 GB of storage, backups, staging sites, SFTP/SSH, phpMyAdmin, and a free .blog or .art domain. The first year is completely free, with discounted renewal afterward, while students who choose not to renew keep their content intact on a free WordPress.com plan. The program has already reached more than 5,000 students across 27 countries during its year-long pilot.
- Security update for Stripe for WooCommerce: It addresses an availability issue and related security findings. Versions 9.7.0 through 10.8.4 are affected, with 10.8.5 recommended as the latest patched release.
- 40,000 WordPress sites affected by authentication bypass vulnerability in User Profile Builder WordPress plugin: This vulnerability makes it possible for unauthenticated attackers to log in as the user with ID 1, which is typically the site administrator, resulting in full administrative takeover of the site. The vulnerability is only exploitable on sites where the plugin’s Automatically Log In setting is enabled. Users are to update to the latest version immediately.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026): There were 270 vulnerabilities disclosed in 213 plugins and 2 themes.
- Automattic pushes back on WP Engine’s sanctions over allegedly missing messages: Automattic has asked the court to reject WP Engine’s motion for sanctions, arguing that WP Engine has not shown that any case-relevant messages were lost or that Automattic failed to preserve them. In its August 11, 31-page opposition, Automattic points to its preservation efforts, collection of Mullenweg’s messaging data, and his testimony that he had not enabled disappearing messages for communications related to WP Engine or the litigation.
- Anthropic explains how Claude’s new text watermark works: They said that future Claude models will use a version of Google DeepMind’s SynthID-Text watermarking approach to comply with the EU AI Act. The method changes the source of randomness Claude uses when choosing between suitable words, creating a pattern that is invisible to readers but can be detected with a key. Anthropic says it has no practical impact on output quality, adds no hidden characters or extra tokens, and does not increase cost or latency.
🔧 TIP OF THE WEEK
Make Every Block Accessible
Always check:
- Keyboard navigation
- Focus states
- Labels
- ARIA attributes
Accessibility should be part of development—not an afterthought.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
A discussion over WPVibe and Novamira began after a user on X, Flint, asked whether WPVibe was better than Novamira, with Syed Balkhi (founder and CEO of Awesome Motive) saying he preferred WPVibe and sharing a comparison of the two. Giovanni Cintolo then challenged the comparison, arguing that it did not mention WPVibe storing WordPress Application Passwords for connected sites on its servers. Balkhi responded that the credentials are encrypted, while Cintolo disputed his characterization of the connection as OAuth, clarifying that it uses WordPress’s application authorization flow, and questioned the fact that the credentials remain after the plugin is uninstalled, arguing that the Application Password is not a scoped token and does not expire. “Finally, none of this is mentioned in the comparison where you criticized Novamira’s security,” Cintolo added.
WPVibe developer John Turner joined the discussion, explaining that WPVibe uses OAuth 2.1 between the AI client and its server, while its server-to-WordPress connection uses WordPress’s built-in application authorization flow. He said access is limited to the capabilities of the account that authorized the connection, credentials are encrypted at rest, and users can revoke them. Cintolo maintained that retaining the credentials on WPVibe’s infrastructure after plugin removal creates a security risk and argued that uninstalling should revoke the connection by default.
- Porkbun pushes back on GoDaddy’s comparison with corrections to its claims: Porkbun has responded to GoDaddy’s recent comparison article, disputing claims about its support, hosting, website builders, AI tools, security, pricing, and other services. It points to its own product pages and pricing information to correct what it says are inaccuracies, while acknowledging areas where GoDaddy has an advantage, including 24/7 phone support.
- WordCamp US 2026 is in full swing: Contributor Day brought 425 attendees and 26 teams together to work toward specific goals and ship contributions across WordPress. The teams opened 22 PRs and shipped 21 contributions, covering AI, accessibility, testing, documentation, search, email delivery, Gutenberg, WP CLI, and more. Showcase Day featured a keynote from Bo English-Wiczling on AI adoption, developer trust, and the role of taste when working with AI, along with sessions covering constraints when working with AI, building for editors and agents, ownership of content and data, and more. WP 101 also gave first-time users the chance to build and launch their own WordPress sites in a single session, with no prior experience or coding required. Robert Jacobi and Matt Mullenweg will close WordCamp US 2026 with an open conversation about AI, the changing web, and what comes next for open source and WordPress.
- cPanel is adding AI capabilities: cPanel AI introduces a redesigned interface, an AI support assistant, AI app hosting, a secure MCP Server for AI-to-infrastructure access, and AI-powered website-building tools including Nova, Nova for WordPress, and Sitejet AI. The new capabilities are designed to speed up provisioning, deployment, support, and infrastructure management while keeping hosting providers in control of their environments.
- PressConf is expanding: PressConf Europe will take place in Barcelona, Spain, from October 27 to 30, 2026, marking the event’s first European edition.
- Koko Analytics was hit by a DDoS attack: Danny van Kooten said the Koko Analytics site handled 5 million requests in an hour during a DDoS attack. He said the attack caused no real harm. Danny van Kooten said he was pretty sure it was the latter, noting that many unique IPs were hitting the live demo dashboard with very few follow-up requests per IP, and an unusually large share of them came from Seychelles.
- Courtney Robertson is open to new roles: After five years at GoDaddy, where she directed the company’s WordPress open-source program, she is now open to full-time and contract opportunities. During her time at GoDaddy, she worked on open-source contributions and funding, WordPress release readiness, customer advocacy, and developer enablement content.
- Shameem Reza is asking what people want clarified about plugin reviews: As a member of the Plugins Team, he is asking what people would want clarified about the WordPress.org or WooCommerce.com review processes, or what suggestions they would bring to either team.
- Torsten Landsiedel is considering a Human Interface Guideline for WordPress plugins: He is asking whether plugin developers would be interested in such a guideline, apply it to their plugins, or help build it.
- Pavel Ciorici on whether developers would list their WordPress products for sale on wp.md: The poll asked whether people would consider listing a WordPress plugin or theme for sale on wp.md, with 47.3% voting yes, 32.7% no, and 20% identifying as buyers.
- Rodolfo Melogli asks whether WordPress plugins should drop “Lite” from their repository name: In the poll he asked whether plugins with a Pro version should use “Plugin Name Lite” on WordPress.org and “Plugin Name PRO” on their own site, or keep “Plugin Name” on WordPress.org. 81.3% preferred dropping “Lite,” while 6.3% favored using it and 12.5% chose another approach.
- Brad Vincent reports that FooPlugins.com has seen a roughly 70% year-over-year drop in Google Search clicks: He highlighted a drop from 12,879 clicks in June–July 2025 to 3,943 in the same period of 2026, with most of the decline coming from informational searches. He says SEO recovery is now the business’s top priority and is using agents to manage data capture, analysis, development, task assignment, and coordination.
- Paolo M. Tajani’s analysis of 60,000 WordPress plugins finds distribution behind the ones still growing: He analyzed 60,000 WordPress plugins and identified 11 still-growing plugins across 10 traditional categories: FluentCart, ThinkRank, SureForms, SureContact, FluentCommunity, Masteriyo, SimplyBook.me, JetBackup, Patchstack, GutenKit, and Accessibility Checker. Seven, FluentCart, ThinkRank, SureForms, SureContact, FluentCommunity, Masteriyo, and GutenKit, inherited an audience from established WordPress companies. SimplyBook.me and JetBackup borrowed existing distribution channels through a partner and hosting relationships, while Patchstack and Accessibility Checker built authority from scratch.
- James Kemp finds most respondents say losing AI would significantly affect their work: He said losing AI would dramatically slow down his work, particularly for research, data gathering, data analysis, historical context, code production, design production, and ideation. In his poll of 132 respondents, 75.8% said AI would have a massive impact on their work, 17.4% said not much, 5.3% said not at all, and 1.5% selected “What’s AI?”.
- Ross Morsali is building a screenshot tool: The tool allows users to take screenshots, add branded annotations, copy them, and move on in about 30 seconds. Morsali built it for his team to create consistent screenshots and save time, and is offering early access to interested users.
- Divi 5 adds four new modules: The new Charts module lets users create interactive charts and manage their data, while the Gravity Forms and Imagely modules make it easier to add and style forms and galleries. The Payment Button module lets users configure PayPal and Stripe payment buttons.
- FluentCart 1.6.1 brings native Divi 5 modules and saved payment methods: The update adds 18 FluentCart modules to the Divi 5 Visual Builder, eight ready-made store layouts, and real-time previews, while FluentCart Pro adds saved card and PayPal payment methods. It also includes coupon improvements, failed renewal notifications, security updates, and fixes across subscriptions, payments, orders, and storefront features.
- Bricks Builder 2.3.11 improves accessibility and fixes several regressions: The update improves accessibility across query filters, forms, and default page content, reduces unnecessary taxonomy indexing on large WooCommerce catalogs, adds JetEngine WooCommerce product and variation data support, and fixes issues affecting components, forms, query loops, templates, and other Bricks features.
- Tutor LMS 4.0.5 strengthens security and fixes several course and enrollment issues: The update adds mobile dashboard navigation, strengthens instructor capability checks, and keeps course authorship consistent across content. It also fixes issues affecting WooCommerce Subscriptions, enrollments, emails, course access, quizzes, and cart and checkout displays, including several fixes specific to the Pro version.
🚀 NEW PROJECTS
| “The plugin is free and will remain free forever.” Kawshar Ahmed about creating Kirki eCommerce. |
- Kirki eCommerce: The first alpha of Kirki eCommerce is now available on GitHub, introducing a WordPress eCommerce plugin with a functional core covering products, inventory, orders, tax, shipping, payments, coupons, and a working storefront. PayPal and Stripe are available out of the box, while features including refunds, multi-currency, and additional payment gateways remain on the roadmap. A stable release is targeted within two months.
- FooGallery Agency Bundle: The bundle includes FooGallery PRO Commerce and four add-ons: Social, User Uploads, Whitelabel, and Client Proofing. A single license covers 50 WordPress sites. Customers also get support and updates, as well as access to any new FooGallery features and add-ons released during the license period.
- Miles: Andy Peatling has announced that Miles is now open to everyone. The AI agent is built specifically for WordPress and can design new sites, turn approved designs into editable WordPress block themes, and help improve existing sites.
- Spacefast: Automattic is developing an agent-first hosting service for static sites and web apps, letting users publish and update projects through AI agents such as Claude, ChatGPT, Cursor, and VS Code. Konrad Keck brought it to everyone’s attention, with Batuhan İçöz ( Head of Beeper Labs) commenting, “ I’m wondering where you found it! We haven’t launched yet!!!”.
- CartRules: Developed by Rodolfo Melogli, the plugin ensures customers can only buy products from one category at a time.
- AR for WooCommerce: The plugin by DevDiggers adds a 3D product viewer and augmented reality to your WooCommerce product pages.
- Agentric: Developed by Vikas Singhal, it is a self-hosted control plane for AI agents that lets humans and agents work together through a governed gateway. It uses policies, human approvals, budgets, and audit logs to control agent actions, while supporting tasks, automations, memory, integrations, and multiple agent runtimes.
- Suede: A new block-based theme by Brian Gardner.
- Fork Around & Find Out: A short browser game developed by David Rukahu about keeping a fictional open source Commons alive while dealing with bugs, invoices, commercial pressure, and other hazards. The game takes about three to five minutes to play, requires no login, and is built with HTML, CSS, Canvas, vanilla JavaScript, and the Web Audio API.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- In the latest episode of Seriously, BUD?, Jimmy Tavares discusses his journey from competitive figure skating and performing to choreography, along with his work in YouTube and WordPress.
- The WP Tavern Jukebox features Amy Kamala discussing her journey from art into technology and WordPress, her varied career across hosting and web development, and her experience contributing to the WordPress community. She also talks about the overlap between creative and technical thinking, volunteering in open source, and the importance of welcoming new contributors.
- The latest Do the Woo episode, hosted by James Kemp of Woo and Katie Keith of Barn2, features Roslyn Lavery of WooCommerce and Ian Misner of KestrelWP discussing how the WooCommerce Marketplace works, including listings, discovery, merchant reach, author support, marketplace limitations, direct sales, and the future of AI-assisted product discovery.
- Remkus de Vries explains why child themes still have a place in modern WordPress, covering performance, separation of concerns, version control, deployment, rollback, parent theme updates, and maintaining a reliable source of truth for site builds.
- David McCan takes a first look at the official WordPress browser extension, covering its site detection, “My Sites” panel, block highlighting, mobile preview, cache bypass, and site-data tools.
- Hostinger says developers are increasingly using AI coding agents not just to write code but to deploy and manage live projects. Its Hostinger Connector has been used by more than 19,000 customers, with around 1,500 using it daily to manage websites, domains, servers, DNS, and other services directly from AI-assisted coding environments.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- What a WooCommerce notice-placement test matrix should actually cover: From Notice27 by Kastovia
- How to hide WordPress blocks based on device: From Speckyboy
- Rethinking do_action(): Events as objects, hooks as class names: From WordPress Developer Blog
- How to connect MCP in FluentBoards: From FluentBoards
- My HTML boilerplate in 2026: From Manuel Matuzović
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp Philippines 2026 on August 28-29: The call for sponsors is now open. The tickets are also now available.
- WordCamp Jinja 2026 on September 19th-20th: The call for sponsors is open. The tickets are now available.
- LoopConf 2026 on Sept 23-24: The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The call for sponsors and Wapuu Design is now open.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors and volunteers is open. Also, interested folks can apply to be a part of the Translation Team.
- WordPress Day for AI Faro 2026 on October 24: The call for speakers and sponsors is open.
- WP Suomi 2026 on October 16: The call for sponsors is now open.
- Cloudflare Connect 2026 on Oct 19 – 21: Registration is now open.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and volunteers is now open. The Contributor Day tickets are now available.
- CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
- CMS Conf 2026 on 12-14 November: The tickets are now available.
- WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors and speakers is now open, and this year’s theme is WordPress and AI. The call for media partners is now open.
- WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
- WordCamp Delhi 2026 on 12-13 Dec: The call for organizers is now open.
- WordCamp Europe 2027 on 27 – 29 May: The event is in the early planning stages.
- WordCamp Asia 2027 on April 9 – 11: The event is in the early planning stages.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer – Get up to 75% off + 3 extra months on the 2-year plan
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
The official WordPress browser extension is now available on the Chrome Web Store and Mac App Store. The…
Sybre Waaijer has alleged that Awesome Motive introduced a backdoor in WPForms Lite version 2.0.0, which runs on…
WordPress 7.0.4 is now available, fixing a remote code execution vulnerability that could allow a user with an…
Automattic has asked the court to reject WP Engine’s motion for sanctions, arguing that WP Engine has not…
Team WP-CONTENT.CO
Issue #285 | August 18, 2026 | Reading time: 24 mins
This weekly newsletter is kindly sponsored by ProfilePress and WP Job Openings
Built with Newsletter Glue.