The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#288 – Mullenweg Ousted as Automattic CEO & Returns Two Days Later, Plugin Sold for $2.7 Million, Automated Plugin Security Reviews

Issue #288   |   September 15, 2026   |   Reading time: 27 mins

Hello!

This week on The WP Week Newsletter, we cover the Automattic board removing Matt Mullenweg as CEO and Mullenweg returning as CEO two days later, new automated security reviews for plugin updates, the WordPress 7.2 release squad, results of the Melapress Security Survey, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HostPapa and HireZoot

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

Matt Mullenweg ousted as Automattic CEO, back in the role two days later

Just days after the company’s board voted to place Matt Mullenweg on paid leave and appoint Mark Davies as interim CEO, Automattic confirmed to TechCrunch that Mullenweg had returned to his position as chairman and CEO, with the company saying he had the “full support of the board.” TechCrunch reported that Mullenweg had been away for just 33 hours and 20 minutes.

WordPress Executive Director Mary Hubbard also welcomed Mullenweg’s return, saying she was “relieved and pleased” to see him back as Automattic CEO. 

TechCrunch also reported that Automattic’s board has been dismantled following its failed attempt to remove Matt Mullenweg as CEO. Toni Schneider resigned from the board, Sue Decker also resigned, and Mullenweg removed Gen. Ann Dunwoody. Automattic Chief Legal Officer Andy Missan and CFO Mark Davies, who had been appointed interim CEO, also left the company. 

Duane Storey raised questions about what appeared to be an attempted mass withdrawal by Automattic’s legal team, saying he was unclear about the court annotation and whether the filing had been rejected. He also questioned how such a mass withdrawal could happen accidentally and whether it was related to the board turmoil that followed.

Automattic also announced that it had engaged attorneys Stephen Shackelford and Shawn J. Rabin of Susman Godfrey, saying it looked forward to working with them to fight for “Freedom, Liberty, and Open Source.”

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Now, during the existing cooldown period introduced by the Protect The Shire initiative, multiple AI models and Jetpack Scan analyze each release and assign a security risk score. High-risk releases are automatically blocked, with plugin authors notified so they can fix the issues and submit a new version. The system is intended to add a consistent security check between an update being submitted and reaching users.

  • WordPress 7.2 release squad announced: The squad includes Matt Mullenweg as Release Lead, David Baumwald for Release Coordination, George Mamadashvili and Peter Wilson as Tech Leads, Henrique Iamarino as Default Theme Design Lead, Maggie Cabrera and Carolina Nymark as Default Theme Dev Leads, Jb Audras and Eshaan Dabasiya as Triage Leads, and Md Noruzzaman, Jina Parekh, and Erick Wambua as Test Leads. The bug scrub schedule for WordPress 7.2 has also been published.
  • The Accessibility Lab plugin is ready for its first feature planning discussion: The Accessibility Team will meet on September 17, 2026, at 8:30 PM GMT+5:30 to plan the Accessibility Lab plugin’s first release. The discussion will focus on brainstorming features, prioritizing what to develop first, and defining what each feature should teach the team and how success can be measured.
  • Maintainer changes for WordPress/WordPress GitHub repo: The WordPress.org systems team has taken over maintenance of the WordPress GitHub mirror, which was previously maintained by Mark Jaquith. The change will give the mirror a larger maintenance team and directs future syncing issues to the systems team.
  • WordPress development now requires Node.js 24 and npm 11: As of September 8, contributors to current WordPress development need Node.js 24.18.0+ and npm 11.16.0+. The upgrade unlocks isolated dependencies, stronger supply-chain security, native TypeScript support, and other tooling improvements, with plans to move to Node.js 26 in October and raise the minimum npm version to 12.x.
  • WordPress 7.1.1 RC1 is now available: It is now available for testing and the final release is currently expected on September 17, 2026, subject to any issues found during testing.
  • WordPress Playground and WebMCP bring AI agents into the browser workflow: WordPress Playground now supports WebMCP, allowing compatible AI agents to discover and use Playground tools directly in the browser. A new WebMCP proxy also makes tools registered by WordPress plugins available to agents outside the WordPress iframe, opening up workflows such as building landing pages, creating compatibility dashboards, and turning plugin features into interactive demos.
  • The Community Team outlines a three-stage plan to grow community events in the US and Canada through 2027: The plan starts with strengthening local meetups, followed by expanding the number and variety of events, including WordCamps, hackathons, contributor days and developer events. The final stage will focus on identifying which formats work best and continuing to support them.
  • New proposal for a combined fund to sponsor WPCC and WP Credits students at flagship WordCamps: The proposal would pilot a $30,000 Education Sponsorship Fund at WordCamp Asia 2027, supporting 3 WPCC students and 5 WP Credits students with travel, accommodation, and tickets. It would combine the two programs into one repeatable sponsorship process, with defined recommendations, selection criteria, sponsor recognition, and a review process before potentially expanding to WordCamp Europe and WordCamp US. The Community Team also posted its August 2026 Education Buzz Report, which highlighted three countries hosting WordPress Campus Connect events, 145 WordPress Credits students graduating in a single month, and the launch of a new dashboard for mentors and students.
  • Four 2027 WordCamp budgets are being brought into one view: WordCamp Europe, Asia, US, and India will each keep their own budget, currency, and working style, while a shared rollup reads their summary tabs and brings budgets, actual spending, and upcoming payments into one view. The setup also creates a cash calendar showing when payments across the four events are expected to land.
  • WooCommerce is considering raising its minimum PHP requirement to 8.1: The proposed change would take effect with WooCommerce 11.5, targeted for January 2027, ending support for PHP 7.4 and 8.0. The team is seeking feedback on the impact of the change before confirming the new requirement and release timeline.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026): There were 277 vulnerabilities disclosed in 187 plugins and 7 themes.
  • Attackers actively exploiting critical vulnerability in WooCommerce Wholesale Lead Capture plugin: A critical vulnerability in the WooCommerce Wholesale Lead Capture plugin (versions up to 2.0.3.1) allows unauthenticated attackers to upload malicious PHP files and potentially take complete control of sites. The vulnerability, patched in version 2.0.3.2, is being actively exploited, with the Wordfence Firewall blocking more than 100,000 attempts. Users are urged to update the plugin immediately and check their sites for suspicious PHP files or administrator accounts.
  • Austin Ginder’s Grok Bot caught malware in the instawp-connect plugin’s trunk: Ginder described how a bot he runs inside Grok Bot routinely reviews WP Beacon’s daily plugin diffs and flagged a malicious payload in instawp-connect. The stable 0.1.3.8 release was never affected, and the WordPress Plugins Team closed the listing before it was cleaned and restored the next day.
  • EU is set to propose ban on social media and AI chatbots for under-15s: The proposal would introduce age-based access, with stricter parental controls for younger children and no access for those under three. Platforms would also face new requirements for age verification, safer designs, harmful-content reporting tools and stronger parental controls.

🔧 TIP OF THE WEEK

Don’t Store Image URLs in ACF When You Need Image Metadata

For an ACF Image field, prefer returning the Image ID when possible.

Then:

$image_id = get_field(‘banner_image’);

echo wp_get_attachment_image(
    $image_id,
    ‘hero’
);

Instead of storing only:

https://example.com/image.jpg

The attachment ID gives WordPress access to:

  • Responsive sizes
  • Alt text
  • Dimensions
  • Metadata
  • srcset

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

The 2026 survey gathered 319 valid responses, with 76.9% rating their security concern at 7 or higher. While 67.7% reported experiencing at least one known security incident, only 27.9% had a breach recovery plan and 26% had security training. The survey also found downtime was the most common impact of incidents, while security concerns and practices varied across different types of WordPress websites.

  • WordCamp Asia 2027 tickets go on sale September 15: The first batch of limited event tickets will be available from 12:15 UTC on 15 September 2026.
  • WordPress 7 – Das umfassende Handbuch” returns with a significantly updated second edition: Florian Brinkmann and Simon Kraft spent eight months revising the German-language guide, adding new chapters on AI in WordPress, the FAIR project, and accessibility, while Matthias Pfefferle updated the IndieWeb chapter and Matze Kittsteiner contributed the accessibility chapter.
  • Spencer Haws sold his WordPress plugin Link Whisper for $2.7 million: Haws built Link Whisper to help bloggers create internal links more efficiently, growing it from more than $30,000 in first-month revenue to around $90,000 in average monthly revenue over its final 12 months. After five and a half years of running the business, he sold the plugin in January 2025.
  • Pablo Postigo reflects on five years at Automattic after the Frontity exit: He reflected on founding Frontity, growing it, and eventually selling it to Automattic, describing the experience as one that defined him. He also writes about his five years at Automattic and how he now gives less weight to labels such as “entrepreneur,” focusing instead on his enjoyment of solving complex problems and learning new things.
  • Katie Keith finds direct traffic now accounts for the largest share of WordPress plugin sales: She compared the sources of plugin sales over three years, finding organic search fell from 39% to 30%, while direct traffic grew to 41%. YouTube’s share nearly halved over the past year, from 5.8% to 3.2%, while tracked AI sales rose in 2025 and have remained at 3.4%.
  • Bowe Frankema asks which WordPress companies are building for AI agents: Frankema says he wants to see the level of AI-agent innovation being built by WordPress companies across products, hosting, and new services. He is asking for examples of companies doing this and plans to highlight at least 10.
  • Imran Siddiq says WordPress needs to invest more in educators: Siddiq says WordPress needs fresh people, including teachers, trainers, and creators who can bring new audiences into the ecosystem. He points to the time and production costs of creating educational content, limited promotional budgets, and a lack of recognition or compensation, and asks whether WordPress should fund educators and content creators to attend events and camps.
  • James Kemp asked the community which WooCommerce features are no longer useful and should be removed: Responses include suggestions to remove legacy reports and jQuery, reduce WordPress admin clutter, and simplify how featured images are handled.
  • John Blackbourn’s graph tracks PHP version usage in WordPress core: The graph uses WordPress.org stats and data from a core Trac ticket to show PHP version usage over time, with future months roughly projected from recent changes. It is intended to help inform decisions about when to raise WordPress core’s minimum PHP version requirement.
  • GoDaddy Hosting takes top spot in the Visual Studio Magazine Reader’s Choice Awards: The hosting provider won the Web Hosting category in the 32nd annual awards, with IONOS Web Hosting finishing second and Bluehost taking third place.
  • Patchstack launches managed CRA Article 14 reporting for open source maintainers: The EU Cyber Resilience Act now requires manufacturers and open source stewards to report actively exploited vulnerabilities and severe security incidents through the EU Single Reporting Platform, starting with a 24-hour early warning. Patchstack’s new service helps maintainers meet these requirements by tracking active exploitation, notifying them when reporting is required, and acting as an Assigned Representative to submit reports within the required deadlines.
  • TranslatePress celebrates nine years and nears 500,000 websites: Adi Spiac said the WordPress translation plugin started with the goal of making website translation as easy as possible and has grown to nearly 500,000 websites. He credited the feedback and feature requests from users with helping shape the product over the years.
  • FluentCart 1.6.4 adds product videos and strengthens subscription safeguards: The release adds FluentPlayer videos to product galleries, itemised Stripe hosted Checkout, a Cart block, and new Bricks collection controls. It also adds test-mode protection for live subscriptions on staging sites, one-time purchase upgrades from the customer dashboard, and a range of improvements and fixes for payments, currencies, subscriptions, performance, permissions, and accessibility.
  • Auto-Close 3.2 adds per-post-type closing ages and new maintenance tools: The update introduces per-post-type closing rules, approved-comment thresholds, previews for destructive actions, and a retention policy for scheduled revision cleanup. The release also adds a status panel, WP-CLI commands, and a configuration report, while marking the plugin’s last planned feature release before it moves to maintenance-only support for security, compatibility, and regression fixes.
  • SureRank Premium 1.9.1 improves Link Manager filtering and video sitemaps: The release adds filters for post type, category, and tag in the Link Manager and improves Fix It For Me homepage routing based on reading settings. It also fixes Elementor text formatting when unlinking and changes video sitemap processing to resumable batches to avoid memory exhaustion and cron loops on large sites.
  • GenerateBlocks Pro 2.8 introduces a new design system with Design Tokens: The alpha release expands Global Styles with support for any supported selector, shared styles across multiple selectors, and tools to search, sort, and categorise styles. It also adds a dedicated Design Workspace with a Style Book and introduces Design Tokens with responsive controls, import/export support, and OKLCH and color-mix support.
  • Perfmatters 2.6.8 is now available: The release adds Inline Excluded Stylesheets, a Safe Mode for disabling performance optimizations, and an option to load frontend CSS snippets in the block editor. It also introduces filters for inlining local JavaScript and stylesheets, improves Remove Unused CSS, and fixes several compatibility, PHP, asset path, and code snippet issues.
  • NordVPN’s Consumer Cybersecurity Report 2026: The report highlights the growing scale and sophistication of online threats, including AI-powered scams, phishing, malware, and dark web data exposure. The report found 8.4 million compromised accounts identified on the dark web over 90 days, while 1.2% of more than 2 billion URLs analyzed in the first half of 2026 were identified as malicious. Also, AV-Comparatives released its 2026 Q3 Anti-Phishing Test results, and NordVPN’s next-gen antivirus achieved a 94% phishing detection rate, ranking third among security products with zero false positives across 250 tested active malicious URLs.
🚀 NEW PROJECTS
“AI can build WordPress stuff really fast now. But I’ve noticed it still misses a lot of small WordPress security details that actually matter.”

Rizvi about creating WordPress Security Skills.
  • WordPress Security Skills: Modular Agent Skills by Rizvi that teach AI coding agents, Claude Code, Cursor, Codex, OpenCode, Gemini CLI , to write secure-by-default WordPress code and to audit and harden existing plugins and themes.
  • SecureHold: Developed by Hugo Godebert, the plugin adds Stripe security deposit holds to WooCommerce, allowing stores to reserve funds at checkout without charging the customer. Store owners can later capture or release the hold, with features including automatic release, deposit management, notifications, HPOS support, and optional Pro features for advanced deposit rules and timing strategies.
  • PublishPress Shortlinks: A new link manager that lets users create short, branded URLs on their own domain and manage how those links work. It supports analytics, password protection, expiry dates, redirects, QR codes, sharing unpublished content, broken-link detection, and importing links from other shortlink plugins.
  • Yamidoo: The plugin allows users to connect their website to Yamidoo and add an AI support chat widget that answers visitors from their own content and hands off to a human when needed.
  • Osmium: A content-first WordPress block theme developed by Gaurav Tiwari for writers, publishers, and review sites.
  • Vibe Coding Products For Scrappy Founders: Alex Standiford has opened the founding enrollment for his new course, Vibe Coding Products for Scrappy Founders, where he teaches the process he uses to build with AI and provides the guides his own agents use. The course also includes a ready-to-use AI harness he has spent the past year refining, while the first 20 people will receive a discounted rate and a 1:1 call with him before the course opens.
  • Share With My Agent: A plugin designed to make websites and online stores easier for AI assistants to understand and use. It creates AI-readable versions of website content through llms.txt, structured JSON, and an AI sitemap, while a sharing widget lets visitors share pages with their preferred AI assistant. Its WooCommerce edition extends these features to product details, prices, availability, categories, and checkout information.
  • WP Spots: An open community directory and discovery board for WordPress products and services. It gives WordPress plugins, themes, hosting providers, agencies, developer tools, and other ecosystem-related products a public spot on an interactive board where people can discover and explore them.
  • Introducing Open Source Champions: Bob Dunn introduces Open Source Champions, a new way for individuals and businesses to publicly support the Open Source Channels network outside of sponsorships. For €1,000 a year for brands or €500 for individuals, Champions receive a profile, links, and opportunities to contribute through blog posts, podcast episodes, and a monthly Champions episode.
  • NordVPN has launched PriceMice: A browser extension that checks whether the same property is cheaper when browsed from a different country.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • Casey Burridge joined Bud Kraus on Seriously, BUD? to talk about his unconventional career journey, his path into WordPress and marketing, and his work at Gravity Kit alongside Zach Katz.
  • In this episode of WP Tavern Jukebox, Nathan Wrigley spoke with Chris Reynolds about AI-assisted development and the challenges of maintaining trust and reliability as AI took on more coding work.
  • On The WP Minute’s Agency Action podcast, Kurt and Toby looked at how AI is reshaping agency website workflows, drawing on their experience using AI tools to build and redesign websites.
  • Sybre Waaijer compared Troy with five other approaches to WordPress plugin distribution, covering options such as Freemius, EDD + Software Licensing, Plugin Update Checker, FAIR, and Git Updater. The comparison looks at differences in distribution, hosting, privacy, security, updates, and WordPress.org compatibility.
  • Emre Ekener looks at why WordPress plugin quality matters for security, performance, compatibility, and long-term maintenance. He outlines what to check when choosing plugins, including update history, active installs, support activity, code quality, and the sustainability of the plugin’s business model.
  • Job Thomas outlined Automattic’s definition of a good customer experience, focusing on helping customers achieve their goals rather than simply resolving support requests. He describes principles around effortless help, resolving underlying problems, making customers more capable, and taking ownership when things go wrong.
  • Remkus de Vries examined how AI agents can access WordPress through different connection models, from WordPress Abilities and self-hosted plugins to hosted relays and development runtimes. He also looks at authentication, authorization, permission levels, and the questions to consider before connecting an AI agent to a production site.
  • Laurie Voss argues that companies already spend heavily on open-source software, but the money rarely reaches the maintainers who create it. He proposes that package registries charge larger companies for usage and automatically distribute part of that revenue to the open-source projects in their dependency trees.
  • Yoshua Bengio examines why AI agents can lie, cheat and coordinate toward goals they were not explicitly given. He argues that current training methods can create unintended goal-seeking behavior and warns that these risks could become more severe as AI capabilities grow, calling for stronger safety measures and a rethink of how advanced AI systems are trained.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress.org Launches Automated Security Reviews for Plugin Releases

WordPress.org has launched an automated security review for plugin releases, adding a new check designed to identify potential…

Read more

Matt Mullenweg Forced Into paid Leave as Automattic Board Names Mark Davies Interim CEO

In a stunning leadership shake-up at Automattic, the company’s board of directors has voted to place founder and…

Read more

All-in-One WP Migration Patches High-Severity SQL Injection Vulnerability

The All-in-One WP Migration and Backup plugin, which has more than 5 million active installations, has been found…

Read more

WordPress Launches Core Security Initiative Centered Around Three Key Pillars

Following an increase in security reports linked in part to the growing capabilities of AI models in security…

Read more

Team WP-CONTENT.CO

Issue #288   |   September 15, 2026   |   Reading time: 27 mins

This weekly newsletter is kindly sponsored by ProfilePress, HostPapa, and HireZoot

Built with Newsletter Glue.