#289 – Mullenweg Back As Automattic CEO, WP 7.1.1 Released, WP 7.2 Roadmap, WooCommerce’s First Block Theme Opens For Testing

Issue #289 | September 23, 2026 | Reading time: 27 mins

Hello!

This week on The WP Week Newsletter, we cover Mullenweg returning as Automattic CEO, the release of WordPress 7.1.1, the roadmap of WordPress 7.2, the new default theme coming with WordPress 7.2, new proposals, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HostPapa and HireZoot

Modern WordPress Membership Plugin

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out →

Web hosting for growing businesses

24/7 human support Check it out →

Easy-peasy Recruitment Plugin

Create a career page and start recruiting talents in a few minutes Check it out →

🗣️TALK OF THE TOWN

Matt Mullenweg returns as Automattic CEO amid board shake-up

The changes have included the departures of board members Toni Schneider and Sue Decker, the removal of Gen. Ann Dunwoody from the board, and the exits of CFO Mark Davies and Chief Legal Officer Andy Missan. Automattic has also brought in new legal counsel as its legal dispute with WP Engine continues, with the next hearing scheduled for September 30.

TechCrunch also reported that Automattic CFO Mark Davies and Chief Legal Officer Andy Missan signed reciprocal severance agreements during the 33 hours Matt Mullenweg was on paid leave. The agreements provide 12 months of salary, accelerated equity vesting, stock-option rights, and additional health coverage, with the combined package valued at $8.15 million.

📰 WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

WordPress 7.1.1 Maintenance and Security Release

The latest version fixes 11 security issues, including stored cross-site scripting, breaking out of comments through abrupt-closing sequences, specially crafted URLs that can install and preview inactive themes, network activation of Network-only plugins, authenticated path traversal, XML-RPC checks, arbitrary post overwrites, private parent-post title disclosure, draft and pending post slug disclosure, and comment reparenting. The release also includes 17 Core and 19 Block Editor bug fixes.

Roadmap to WordPress 7.2: WordPress 7.2 is planned for early December 2026, with work spanning collaboration tools, security, styling, accessibility, the block editor, media, performance, and an extensible Site Editor. The roadmap also includes new Description List and Table of Contents blocks, the Ipsum default theme, and ongoing AI work, although the listed items are still subject to change before the final release.
WordPress usage grew by more than 3.6 million websites in 2026: The increase was recorded between January and the end of August 2026.
Mary Hubbard is now serving as president of the Open Website Alliance: Hubbard will represent the WordPress Foundation as president of the alliance, which brings together the communities behind Drupal, Joomla!, TYPO3, and WordPress. WordPress joined the alliance in 2024 as the groups worked together on the European Union’s Cyber Resilience Act, and the organizations continue to collaborate on issues affecting open source software.
WordPress Playground adds a Terminal and Dev Tools Dock for easier site testing: The new tools let users run PHP snippets and WP-CLI commands directly against the active Playground site, making it easier to inspect content, modify data, and set up test scenarios without leaving the browser or creating a local environment.
Call for testing now open for the DataForm editor inspector: The new experiment replaces the Post and Page inspector panels with a DataForm, bringing the editor inspector closer to the Quick Edit interface in the Site Editor. Plugin developers and site owners are invited to test whether existing plugin additions still work as expected and report any issues.
New Test Team Reps for 2026 – 2027 announced: Erick Wambua and Huzaifa Al Mesbah have been confirmed as Test Team Reps for the 2026–2027 term. They were selected after one of three nominees withdrew, leaving two confirmed candidates for the two available positions, so no voting was required.
A server-aware approach to real-time collaboration is being proposed: The proposal would route collaboration through WordPress so the server can record who made each change, check whether users are authorized, merge updates, and raise conflicts for review. Three candidate sync engines are being developed in the gutenberg-sync-engines repository, with the team inviting testing, feedback, and contributions.
Jonathan Desrosiers proposes identifying WPCC participants through WordPress.org profiles: The proposal would add a designation to participants’ profiles and list their individual mentors or program facilitators. The changes are intended to make participants easier to recognize and support, while also recognizing mentors and giving other contributors a way to share feedback with a participant’s mentor. Also, the Community Team is seeking feedback on a draft guide for running 30 or 60-minute mini contributor sessions at WordPress Meetups, with organizers invited to test the guide and share what could be improved. In addition, there’s a new proposal on rethinking how Student Clubs actually run.
The AI-Powered WordPress course is now live on Learn WordPress: Learn WordPress has launched an AI-Powered WordPress course covering AI provider connections, editorial tools, automated alt text, comment moderation, AI activity monitoring, MCP, and WordPress AI APIs.
WordPress Accessibility Team proposes a new approval tag for accessibility-ready themes: Under the proposal, adding the accessibility-ready tag would request a review rather than automatically listing a theme as accessible. After review, an accessibility team member could add a separate accessibility-approved tag, which could also be removed if a later update compromises accessibility.
What’s new in Gutenberg 24.0: The update adds visual revisions for post titles, a customizable Grid variation for the Gallery block, and fit-text support for Site Title. The release also brings improvements to icons, list indentation, background images, non-breaking space visibility, and more.
Ipsum is proposed as the new default theme for WordPress 7.2: The minimal blog theme is designed as a flexible blank canvas, while also introducing a shift away from year-based names for WordPress default themes. Testing is now open ahead of the 7.2 release, with feedback expected to help shape the theme before launch.
WooCommerce is calling for testing of its Purple block theme: Purple is WooCommerce’s first official block theme, with templates for WooCommerce pages, ten color palettes and font pairings, custom block styles, and ecommerce-focused patterns. The beta also reflects recent improvements to WooCommerce’s block editing experience, and testers are invited to try the theme on staging or local sites and report issues and suggestions before its wider release. Also, WooCommerce 11.1.1 is now available.
Wordfence Argus discovers critical vulnerability in libheif, the library that opens iPhone photos on your server: The vulnerability affects libheif versions 1.18.0 through 1.23.2 when built with the uncompressed codec enabled, and can allow crafted HEIC files to trigger arbitrary file reads or code execution. The issue was fixed in libheif 1.23.3, while the current upstream release is 1.23.4.
100,000 WordPress sites exposed to remote code execution via PHP object injection vulnerability found by Wordfence Argus in Tutor LMS: A critical vulnerability in the Tutor LMS WordPress plugin affects versions 4.0.7 and earlier, allowing authenticated attackers with subscriber-level access to achieve remote code execution. Themeum fixed the issue in version 4.0.8, and users are urged to update to the latest version.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026): There were 260 vulnerabilities disclosed in 207 plugins.

🔧 TIP OF THE WEEK

Use wp_is_development_mode() for Theme Development

if ( wp_is_development_mode(‘theme’) ) {
    // Development-only functionality
}

Useful for:

Debug messages
Unminified assets
Development helpers
Debug logging

This keeps development functionality out of production.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

WordCamp Asia 2027 opens applications for media partners

The event is seeking media outlets, publishers, content creators, and community voices to cover WordCamp Asia in Penang from April 9–11, 2027. Selected partners will receive media passes, access to the Media Area, interview opportunities, event materials, and support from the communications team, with applications open until November 24, 2026.

Cloudways’ Prepathon 2026 will bring two days of online sessions and activities: The free virtual event on September 22–23 will feature more than 20 speakers and eight live sessions on AI-assisted development, infrastructure, AI agents, production workflows, and WordPress development, with speakers including Miriam Schwab, Debbie O’Brien, Tracy Lee, and Narek Torosyan. In-person activities are also planned in Bengaluru, Mexico City, and Karachi.
OmFest will bring together friends, ideas, music, and photography to celebrate Om Malik: The 12-hour event will take place in San Francisco on September 29, what would have been Malik’s 60th birthday, with exhibitions, stories, food, a tea ceremony, photography, and an evening DesiParty planned throughout the day.
Patchstack now protects your AI-built apps: Patchstack is opening early access for security protection of AI-built and JavaScript applications on platforms such as Lovable, Replit, Base44, and Claude Code. Its RapidMitigate runtime can automatically mitigate vulnerabilities without code changes, while the new Live Hardening module blocks sensitive data leaks, with apps managed alongside WordPress sites through the same Patchstack account.
GravityKit analysis of 832 WordPress agencies looks at what separates profitable businesses: Drawing on 2026 surveys from The Admin Bar and CloudLinux and WebPros, GravityKit found that 57% of agencies charging $5,000 or more per project were consistently profitable, compared with 33.2% charging less. The analysis also found that 47% of agencies with at least 25% recurring revenue were consistently profitable, rising to 60.3% among agencies meeting both the $5,000 pricing and 25% recurring-revenue thresholds.
RelyWP launches a new website: The rebuilt site adds improved plugin pages, expanded documentation, changelogs, an AI support widget, a new blog structure, and an affiliate programme. RelyWP also outlines plans for two new WooCommerce plugins while continuing development and support for its existing products.
20i’s vibe coding survey examines how businesses are using AI coding tools: 20i’s survey of 600 US-based non-developers found that 47.7% use vibe coding primarily to improve productivity, while 51.1% had little or no coding experience beforehand. It also found that fewer than a third have their AI-generated code reviewed by a professional developer, while 20.5% said AI-generated code had contributed to a security breach.
Daniele Besana calls attention to Automattic’s Jurassic.ninja for WordPress testing: The service lets users launch single-site or multisite WordPress test environments that are live for 24 hours. It also offers options for debugging, pregenerated content, PHP versions, Jetpack and WooCommerce products, plugins, and themes.
Ross Morsali is preparing an open-source Composer solution for EDD shops: Morsali said third-party plugins without Composer support make testing harder because developers still need to download ZIP files manually. He has built a solution for EDD shops that adds Composer installation, handles versioning and license verification, and keeps releases in sync, and is seeking testing before making the repository public.
Rob Sobers asks why anyone would use a CMS anymore: Sobers describes opening Webflow, WordPress, or HubSpot to edit text and upload images as archaic, and says he manages content the same way he writes front-end code. He also calls CMS companies “cooked” and CMS platforms “extra baggage nobody needs anymore.”
Anita questions why WPChat was installed alongside the Smash Balloon plugin: Anita says WPChat appeared without her installing it and was not listed under the Plugins tab, prompting her to ask where it was installed. She also questions why WhatsApp is being promoted at the top without an option to remove it and says she plans to find another Instagram feed plugin for her client.
Yash Kapoor (founder of DevDiggers) shares what happened after moving the plugin catalog from CodeCanyon to his own store: He reports an immediate drop in discovery, followed four months later by a higher average order value from bundling complementary plugins. Support tickets also decreased, while direct customer email relationships made it easier to announce updates, discounts, and new releases. He recommends building a direct presence alongside marketplace listings before making the switch.
Ben Meredith says Liquid Web’s Tone Guide is no longer online: Meredith said the Tone Guide and the rest of the Support Manual he worked on with Matt Cromwell and others appear to have been functionally removed from the internet following changes at Liquid Web. Since the content was intentionally released under the GPL, he moved the Tone Guide to a new location and kept it named “GiveWP” so people who remember the original can still find it.
Brian Coords asks if WordPress should retire the Site Editor: Coords said he is hoping to give feedback on the Site Editor v2 mentioned in the WordPress 7.2 planning post and suggested letting the Site Editor hang out with the rest of the WordPress admin instead of treating it as a separate interface.
Devin Walker shares an early look at a redesigned My Jetpack: The concept puts quick actions at the top, followed by information about how a site is performing, replacing the existing grid of products. Walker said the aim is to answer questions users might otherwise have to search for and asked for feedback on what should be added.
20i celebrates its 10th anniversary with more than one million websites on its platform: The decade has brought the launch of StackCP, HostShop, a free CDN, Managed Cloud Servers, Website Turbo, and Managed WordPress Hosting, alongside expansion to more than 60 data centre locations and customers in 179 countries. Support has also earned three consecutive Best Web Host wins at the PC Pro Awards and a 99% customer service score in 2025.
Ronald Huereca’s Pattern Wrangler plugin has been adopted by Matt Cromwell: Huereca said he previously worked with Cromwell on his Synced Pattern Popups plugin, which Pattern Wrangler already integrates with, and thanked him for taking over the plugin. The adoption is part of the closure of DLX Plugins.
New milestone for Yoast SEO plugin: The plugin has crossed 1 billion downloads in the WordPress plugin directory.
Kirki 6.3.1 is now available: The new additions include dynamic content support for ComponentInstanceFields, SVG selection color previews, and Pusher broadcasting. Improvements cover variable search, multi-element pasting, snapping, resizing, blend modes, and the component editing canvas, while the release also fixes CSS inheritance, form data export, and image pasting issues.
WPForms introduces a new Dashboard to bring form activity into one view: The new Dashboard shows site-wide totals for forms, entries, views, payments, and spam, along with entry and payment activity, visitor locations, and suggested next steps. It also includes date-range controls, table customization, license information, and security checks, and is available with all WPForms plans, including WPForms Lite.
Infinite Uploads 3.3.4 keeps plugin working files on the server during offloading: The update identifies plugin files that need local storage and leaves them on the server while photos, videos, and PDFs continue to be offloaded to the cloud and served through the CDN.
Thrive Leads gets a complete rebuild with a new dashboard and guided form creation: The update adds a four-step form creation wizard covering design, display rules, Lead Groups, and review, along with new Templates and My Forms sections. Existing Lead Groups, forms, display rules, and A/B tests migrate automatically, while Group Conditions and Lead Group Priorities get dedicated screens.
MailerPress introduces a new identity to reflect how the product has evolved: The redesign brings a new logo, visual language, and website, following MailerPress’s expansion from a newsletter plugin into an email platform built around WordPress.
Elementor opens its MCP integration for beta testing with AI tools: The beta lets tools such as Claude, Codex, and Cursor connect to Elementor sites to build and edit pages, work with design systems, manage theme parts and components, and handle dynamic content. Changes are saved as editable Elementor structures in draft form, while the new Elementor MCP page provides site admins with a setup process for connecting compatible AI tools.
Novamira Pro 1.10.0 adds specializations for eleven Elementor add-ons: The release adds dedicated guidance for Dynamic Content for Elementor, JetElements, Ultimate Addons, Happy Addons, and seven other Elementor add-ons. It also adds controls for turning memory on or off and strengthens Elementor page-building checks, bringing Novamira Pro to 53 specializations.
Contact Form 7 6.2 release candidate raises requirements and introduces SWV 2: The release candidate is available for testing ahead of the planned early October release, with Contact Form 7 6.2 requiring WordPress 7.1 and PHP 8.3 or newer. The update also brings Composer packages for Schema-Woven Validation, updated JavaScript packages, changes to the admin interface and REST API, new action hooks, and several code and security-related changes.
Wordfence 9 brings free passkeys: The new feature lets users sign in without passwords using a passkey, with support for fingerprint, facial recognition, PINs, and password managers. Passkeys are available in both the free and paid versions of Wordfence, with site owners able to make them optional or required for different user roles.
Courtney Robertson joins Pantheon: She has joined as a Technical Writer on its developer relations team.
Jhimross Onlinares receives the Yoast Care fund for his contributing to the WordPress community: A contributor since 2015, he has worked across several WordPress teams, maintained plugins, supported translations and training, and helped organize WordPress meetups and events, including WordCamp Asia and WordCamp Philippines.

🚀 NEW PROJECTS

“Why now? Because AI is changing what businesses need from us.”

Jamie Opalchuk about creating Managed.com.

Managed.com: It has launched as the platform for HostPapa, ColoCrossing, Hostopia, CloudBlue, and LogoMaker. HostPapa helps businesses get online and build their brand, ColoCrossing provides infrastructure, Hostopia offers white-label services, CloudBlue provides channel commerce, and LogoMaker is an AI-first identity builder. Managed.com has more than 750 people across 40 countries.
WP Shipyard: Developed by Austin Ginder, it lets an administrator browse the site in a different installed theme while visitors, and everyone else who is logged in, keep seeing the live one.
WPAcquire: A marketplace created by Çağdaş Dağ for buying and selling WordPress plugins, themes, WooCommerce stores, and content sites. Every listing is reviewed, with revenue, profit, traffic, and asking price shown publicly, while sellers can list anonymously for a $49.99 fee with no commission on sales.
Krom Automation: Created by wpRigel, this is a new visual automation plugin and with it users can build workflows that respond to events such as signups, orders, forms, and new posts. It includes triggers, actions, conditions, delays, and more.
Ink Player: A new video plugin developed by Sumon Sarker for hosting, embedding, and monetizing videos, with features including lead capture, custom CTAs, chapters, ad support, and LMS integrations. It supports video sources such as YouTube, Vimeo, and self-hosted content, along with integrations including WooCommerce, Mailchimp, LearnDash, and Google Analytics.
Agentsy Report: An AI visibility platform by Joey Kudish and Marius Ciuchete Paun that helps businesses understand how AI engines such as ChatGPT, Gemini, and Perplexity see and represent them.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

On Seriously, Bud?, Bud Kraus conversed with Jill Binder about her journey from coding and slam poetry to web development and WordPress community work. They also discuss her digital nomad experiences, being single by choice, and Tech Differently, her speaker accelerator and conference.
Chris Reynolds joined WP Tavern Jukebox to discuss AI-assisted development, the changing role of developers, and how project contracts can help set clear rules for AI-generated code, including testing, accessibility, security, and design.
Eric Karkovack in this episode of The WP Minute, talked with Iain Poulson, Senior Product Manager for ACF, about the plugin’s direction as WordPress moves into the AI era, including ACF 6.8, the Abilities API, MCP, AI agents, and structured data.
Andy Peatling outlined ideas for how WordPress could adapt to a world where AI agents increasingly influence platform choices. His suggestions cover defining complete agent workflows, creating public benchmarks to measure how well WordPress works with agents, and improving WordPress.org documentation and APIs so agents can better understand when and how to use the platform.
WP Engine’s summary of the Reuters Institute Digital News Report 2026 looks at how changing audience habits, declining trust, video, AI, and fragmented discovery are affecting digital publishers. It also outlines practical steps enterprise publishers can take across content, editorial workflows, audience insights, and publishing technology.
Neil Patel discussed changes in Google Search, including falling organic click-through rates, lower clicks for top-ranking pages, and the rise of zero-click searches. He explains how Google generates AI answers from search results and discusses four assets that he says brands can build that AI cannot absorb.
Katie Morton reports on new Search Engine Journal research examining how marketers are adapting as organic traffic declines, AI search grows, and traditional SEO metrics become less reliable.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

How to transfer a Claude design to WordPress (Beaver Builder AI): From Beaver Builder
8 Simple AI prompts to help you sell more with WooCommerce: From Jamie Marsland
Find WordPress problems with ChatGPT + WPVibe: From Imran Siddiq

📆 SAVE THE DATES

Do not miss a WordPress event ever again

WordCamp Rajasthan 2026 on 3–4 October: The call for sponsors is now open. The tickets are now available.
WordPress Accessibility Day 2026 on October 7th-8th: Interested folks can apply to be part of the Translation Team, and the schedule is now out. Sponsor applications are now open.
WordPress Day for AI Faro 2026 on October 24: The call for sponsors is open, and tickets are available.
WP Suomi 2026 on October 16: The call for sponsors is now open, and the tickets are now available. The schedule has been published.
Cloudflare Connect 2026 on Oct 19 – 21: Registration is now open.
WordCamp Canada 2026 on November 5-6: The call for sponsors is now open. The Contributor Day tickets are now available and the schedule has been published.
CloudFest Americas on Nov 11-12, 2026: The tickets are now available.
CMS Conf 2026 on 12-14 November: The tickets are now available.
WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors, volunteers and Table Leads is now open, and this year’s theme is WordPress and AI. The tickets are now available.
Enqueue 2026 on Dec 09: The early bird tickets are now available, and the call for speakers is now open.
WordCamp Athens 2026 on 11-12 December: The call for sponsors, speakers, and media partners is now open.
WordCamp Delhi 2026 on 12-13 Dec: The call for sponsors, speakers, and volunteers is now open, and the Conference Day Tentative Schedule is now available.
WordCamp Mumbai 2027 on 13 February: The event is in the early planning stages.
WordCamp Switzerland 2027 on 5-6 March: The call for speakers and sponsors is now open.
WordCamp Europe 2027 on 27 – 29 May: The event is in the early planning stages.
WordCamp Asia 2027 on April 9 – 11: The call for sponsors, volunteers and speakers is now open. The tickets are now available.

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS

4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
15% off yearly plans at Videvo (Coupon Code – WPV15)

MORE DEALS

NordVPN Special Offer – Get up to 75% off + 3 extra months on the 2-year plan
Cloudways limited-time summer offer: 40% off on all hosting plans for 4 months plus unlimited free migrations.
Up to 50% off on BookingPress plugin
Up to 50% off on Paid Membership Pro plans.
Up to $100 OFF Essential Blocks PRO plugin.
50% off 3 months on Liquid Web’s Bare Metal server hosting
20% off for Constellation plugin
28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
33% off for the Uncanny Automator plugin.