The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#292 – Automattic Applies for 16 TLDs, Interim CFO Resigns, WP 7.1.3 Released, AI Agents Avoid WP for New Websites

Issue #292   |   October 14, 2026   |   Reading time: 25 mins

Hello!

This week on The WP Week Newsletter, we cover the board of directors drama at Automattic, the release of WP 7.1.3, Automattic’s submission for 16 top-level domains, the WP Control plugin changing ownership, along with new projects and more.

Submissions are now open for Black Friday 2026! Share your deals on plugins, themes, hosting, WooCommerce tools, SaaS, and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

🗣️TALK OF THE TOWN

TechCrunch reports that a source at Automattic linked Klaperman’s resignation to disagreements over the board’s consideration of external CFO candidates and a work project related to employee performance reviews. CEO Matt Mullenweg had demoted Klaperman to his former role at Automattic’s VIP Enterprise business shortly before he resigned.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

The applications include .wordpress, .woo and .tumblr, alongside names such as .craft, .human, .robot and .story. The list also includes .matt, matching the first name of Matt Mullenweg.

Kellie Peterson’s separate analysis of the .wordpress application raises questions about Automattic’s request to operate the domain as a closed namespace, given that the WordPress trademark is held by the WordPress Foundation. The application also seeks an exemption from ICANN’s Registry Operator Code of Conduct.

  • WordPress 7.1.3 released with seven security fixes, including XSS and SQL injection fixes, and four bug fixes: The vulnerabilities include unauthorized disclosure of comments on private and unpublished posts, stored XSS in the Comments administration page, XSS involving Imgur embeds, a denial-of-service issue, a second-order SQL injection in WXR export, an issue allowing Authors to make posts sticky, and a hook name collision.
  • Mary Hubbard calls on hosting and plugin companies to fund WordPress Security Program: Rae Morey reported that WordPress Executive Director Mary Hubbard has asked more than 30 companies to help fund WordPress’s security program, citing a surge in vulnerability reports and Automattic’s role as its sole funder. While several companies expressed support, some called for clearer funding arrangements, and Patchstack CEO Oliver Sild urged changes to how contributors participate in security decisions.
  • Isotta Peira proposes a framework to bring more students into WordPress events: Building on student participation at WCUS 2025, WCAsia 2026 and WCEU 2026, Peira proposes a repeatable framework for flagship and major WordPress events starting in 2027. The proposal includes dedicated contacts for Education, reserved programme slots, student travel support and flexible scheduling, with feedback requested from event organizers by October 30.
  • WordPress is overhauling wp_kses() with a new HTML API-based implementation: The refactor replaces the existing sanitization logic with a parser designed to handle HTML more reliably, improving how WordPress processes untrusted input. The changes affect how HTML is normalized, how script and style elements are removed, and how incomplete or ambiguous markup is handled. Developers are invited to test the new implementation and report compatibility issues ahead of its expected release in WordPress 7.2 or 7.3.
  • The WordPress AI plugin 1.4.0 adds Markdown feeds and expands its AI infrastructure: The release introduces a Comment Moderation value score and expands embedding storage and vector tools for developers. It also improves Content Translation, Alt Text Generation, Type Ahead, and AI Request Logging, updates developer abilities, and includes accessibility and security fixes. The minimum supported WordPress version is now 7.0.3.
  • Minor CSS Coding Standards updates are proposed to introduce Stylelint: The proposed changes include simplifying blank-line requirements and discouraging the use of the CSS order property and reverse values when they affect accessibility. The updates would prepare Core and its continuous integration pipeline for Stylelint, with feedback invited over a one-week period before the changes proceed in the absence of significant objections.
  • Feature Notifications targets a 0.3.0 release alongside WordPress 7.2: The project aims to establish a unified notifications system for WordPress, allowing notifications to be created, stored, displayed, and dismissed. The planned 0.3.0 release involves completing the persistence layer and REST API, addressing security and correctness issues, restoring internationalization, and updating release tooling. The target date is December 1, 2026, with contributors invited to help through the #feature-notifications Slack channel and GitHub repository.
  • WordPress Campus Connect tests a hackathon-based approach to student learning: The first hackathon at Stamford University Bangladesh attracted around 100 hackathon registrants and resulted in 40 websites being created. The experiment explored three tracks for students with different skill levels and highlighted both the potential of challenge-based learning and issues with participation, beginner support, and judging. The team is now considering how workshops, short challenges, and hackathons could work together and is seeking feedback from the WordPress community before taking the format to more universities in Bangladesh.
  • Core team seeks feedback on making the Toolbar’s W and site name links consistent: The proposal would make the W link to the Dashboard and the site name link to the site across the admin, front end, and editors, with consistent menus and support for small screens, multisite, and classic themes. Users can test the changes through WordPress Playground or via a test plugin and are asked to share feedback in Trac by October 16, ahead of WordPress 7.2 Beta 1 on October 20.
  • WordPress 7.2 will disable the NO_BACKSLASH_ESCAPES SQL mode by default: The change removes this mode from the SQL modes used by WordPress database connections because it can cause queries with escaped values to fail or return incorrect data. It affects only the WordPress database session, not the server’s global settings. Sites that need the mode can retain it using the incompatible_sql_modes filter in a db.php drop-in, though WordPress Core may not work correctly with it enabled.
  • WooCommerce 11.2.1 released: The release fixes issues with classic checkout on stores that remove address fields and postcode validation in the checkout block.
  • Attackers are exploiting a critical file upload vulnerability in Bricksforge: Rated CVSS 10.0, it allows unauthenticated attackers to upload and execute PHP files, leading to remote code execution. Exploitation was first observed on October 7, 2026, affecting versions up to 3.1.8.9. Bricksforge 3.1.8.10 fixes the vulnerability, and users should update to that version or later.
  • Patchstack reports a WordPress XSS campaign that creates four ways back in: Attackers are exploiting stored cross-site scripting vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms to run JavaScript in authenticated administrators’ browsers. The payload installs a malicious plugin, creates visible and hidden administrator accounts, adds a backdoor login URL, and deploys an unauthenticated file manager, allowing access to persist beyond the initial vulnerability.
  • Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026): There were 501 vulnerabilities disclosed in 367 plugins and 9 themes.
  • CopilotKit introduces an open-source alternative to ChatGPT’s Intelligent UI: Open Intelligent UI lets developers bring interfaces generated on demand into their own apps using any agent through AG-UI and any model. It supports charts, maps, 3D scenes, calculators, games, and simulations, while allowing developers to use existing components and design systems.

🔧 TIP OF THE WEEK

Use wp_get_environment_type() for Environment-Specific Logic

Instead of hardcoding:

if ( $staging ) {
   …
}

Use:

if ( wp_get_environment_type() === ‘staging’ ) {
    // Staging-only functionality
}

WordPress supports:

  • local
  • development
  • staging
  • production

Very useful for custom WordPress deployments.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

The latest report found that 45.7% of AI-tagged plugins released an update in September, compared with 21.1% of the top 12,500 plugins overall. It also found that 3,928 plugins that had not been updated in a year gained downloads per day. Additionally, 3,174 new plugins were listed in September, while 48 plugins among the top 12,500 had their listings closed.

  • WordPress Agent Benchmarks finds that AI agents do not choose WordPress for new websites: Andy Peatling’s WordPress Agent Benchmarks reports that none of the four most-used AI agents tested in October 2026 chose WordPress across 76 requests for websites suited to the platform. Of the 193 sites built using alternatives, 93% relied on custom code. The benchmark found that agents most frequently cited hosting and upkeep (82%), the site needing less than WordPress offers (70%), and security and updates (66%) as reasons for not choosing WordPress.
  • WP Accessibility Day 2026 draws 2,210 registered attendees from 77 countries: The 24-hour virtual conference took place on October 7 and 8, featuring 24 sessions on AI, inclusive design, accessibility testing, and WordPress development.
  • Syntax FM is giving away $100,000 to open source maintainers: The team is inviting suggestions and nominations for open source maintainers to receive a share of the funding.
  • Jean Galea says WordPress’s long tail is starting to break: Galea argues that the positive view of WordPress among those working in the enterprise space does not reflect the challenges facing smaller businesses and independent developers. Citing seven years of plugin install data from WP Mayor, he says established plugins have gone from double-digit yearly growth to flat growth, while more than a fifth have lost installs over the past three years. He also points to small agencies losing brochure sites to website builders and AI agents, while first-time writers today start on Substack.
  • Torsten Landsiedel highlights concerns with the Categories to Tags Converter plugin: He points to the WordPress.org plugin’s 50,000 active installations and compatibility listing, which says it has been tested up to WordPress 6.7. He says a known bug has been patched since 2024, but the related pull request has not been merged, and that WordPress coding standards are being ignored.
  • Brad Vincent launches five products alongside FooPlugins and asks users which to focus on: After leaving his corporate job last year to work on his own business full time, Vincent launched five new products alongside FooPlugins. They include PAYGSEO, pay-per-use SEO tools; AgentFirst.Directory, a directory of tools for AI agents; FooPixel, an image-hosting service for AI agents; and PageSpike.ai, a landing page review tool. He is asking users which of the four new products they would use first to help him decide where to focus his time.
  • Aaron Marquez weighs the trade-offs between WordPress and AI web development: Having built over 1,500 WordPress sites, he says he once considered WordPress the holy grail because of its efficiency and ease of handoff. However, he points to the time it takes to go from concept to build for many brochure and marketing sites, WordPress bloat from comments, users, and databases, and the hosting and plugins involved in the ecosystem. He also notes that AI development requires considerable time spent prompting and coaching to get right, describing it as bloated in a different way.
  • Steve Jones questions whether investing $20,000 in website design is overthinking it: He contrasts the investment in design for the new Equalize Digital website with the trend of building websites through vibe coding, asking whether the team is overthinking the process or building to a different standard. He also shared an Accessibility Craft episode discussing the choice of design partner, why the original design budget nearly doubled, how accessibility requirements were incorporated before the first Figma designs, and more.
  • Marcus Burnette asks the WordPress community what AI struggles to replicate: Austin Ginder pointed to WordPress’s codebase, Blake Whittle mentioned page builders, and Alex Vasquez highlighted routing and permalinks, calling for easier native options to define custom permalinks and choose between the existing hierarchy and a custom structure.
  • Ronald Huereca is open to new work opportunities and collaborations: Huereca invites people to reach out if they want to collaborate on ideas or hire a human agent to control their AI agents.
  • Ben Gabler announces his departure from Rocket.net and plans to focus on AI: After six years building Rocket.net and marking the first anniversary of hosting.com, Ben Gabler has announced his departure while remaining a substantial shareholder. He said his next focus will be on AI.
  • WP Control is now maintained by Awesome Motive: Previously maintained by John Blackbourn, the repository page now shows Syed Balkhi (CEO of Awesome Motive) as the new owner.
  • TranslatePress expands beyond WordPress with a new Shopify app: Adi Spiac (CEO of Cozmoslabs and TranslatePress) announced that TranslatePress is now available on Shopify. The app offers native, SEO-friendly translations, automated multilingual SEO features, AI-powered store translation, and automatic syncing of new or updated products. Merchants can also edit translations manually without having their changes overwritten by AI translation.
  • Scanfully 2.0 rebuilds the dashboard and introduces new monitoring tools: The update redesigns monitoring views, adds insights into incidents, and introduces client and label-based site organization, centralized notifications, a public API, and MCP connections for AI apps. It also brings billing changes and improvements to monitoring and activity data.
  • Ollie Pro introduces color variants and several upgrades to its AI features: The color variations in Ollie Pro let users recolor entire page designs with a single click while maintaining their brand palette. The updated Edit with AI features include hands-free voice commands, while improvements to Ollie MCP allow external AI agents to build carousels, mega menus, and layout animations without accessing the WordPress admin.
  • MailerPress 2.1 adds A/B testing, conditional block display and a Migration Center: The release also introduces contact engagement tracking, automation goals, a faster email editor, one-click unsubscribe, multiple sender addresses and new integrations.
  • FlyWP adds static site publishing, server monitoring and bulk actions: The update lets users publish static HTML versions of WordPress sites to multiple destinations, monitor server resources such as CPU and memory usage, and perform actions across multiple sites at once. It also adds SSL installation checks and warnings, improves uptime page loading, and fixes issues affecting backups, logs, caching, redirects and SSL warnings.
  • Etch 1.7.0 adds Yoast SEO and Rank Math compatibility: The new version enables both plugins to analyze rendered Etch content, including dynamic content, as users edit in the WordPress block editor. Word counts, focus keyphrase checks, image detection and alt text analysis now account for content rendered by Etch blocks.
  • Jetpack 16.3 adds conditional logic to Forms and new VideoPress playlist blocks: The update lets users show or hide form fields based on responses and display the latest videos or all playlists on their sites. It also introduces a new Features tab in My Jetpack, ChatGPT and Codex connections through MCP, a Zoom Scheduler block, and improvements to notifications, performance, accessibility, and security. Devin Walker also provided an update on the rebuilding of Jetpack.com, covering its WordPress block theme, Git-based content management, AI-assisted development workflow, automated translations, support redesign, and fixes made since launch. Also users can now also connect Jetpack to ChatGPT, making it possible to edit their site directly from the chat.
  • Let’s Encrypt will make 64-day certificates the default in February 2027: The change will apply to certificates issued or renewed from February 10, 2027, with the last 90-day certificate expected to expire on May 11. Let’s Encrypt will begin testing the change in its staging environment on October 14, 2026, and recommends checking renewal automation, including support for ACME Renewal Info. They will also reduce the authorization reuse period from 30 days to 10 days, while leaving rate limits, ACME endpoints, and issuance chains unchanged.
  • Novamira joins Open Invention Network 2.0: The membership commits Novamira to royalty-free patent cross-licensing for patents covering the Linux System and not asserting them against the open source community.
  • Universally expands its AI translation platform to Webflow: Syed Balkhi announced that Universally can translate Webflow websites into more than 110 languages.
  • New milestone for WP Umbrella: The plugin now has over 90,000 active installations, and they have also released their MCP server.
🚀 NEW PROJECTS
“Describe any business in a sentence, and an AI team builds it on WordPress and runs it with you every week.“

Yotako about creating WPMaven.
  • WPMaven: Created by Yotako, it offers an AI-powered service that builds a business website, store, and initial marketing from a one-sentence description. Users approve all outgoing content, while the AI team handles weekly tasks, including posts, videos, requested edits, and progress reports. The service starts free, with the first week costing $1 as a one-time offer.
  • Two new projects by Marcus Burnette: Crickets is a new social media scheduler platform and Alternator, a free alt text generator for Mac.
  • liberate.sh: The new tool by Automattic allows users to convert any website into a WordPress site you can download and host anywhere.
  • Save & Clear Cart for WooCommerce: The plugin allows users to easily clear, save, restore, merge, and manage multiple WooCommerce carts as customers or guests.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • On Seriously, Bud?, host Bud Kraus conversed with Jos Velasco about his journey into WordPress, mentoring new contributors through WP Credits, life in Mexico, his love of travel and dogs, and his work at DreamHost supporting WordPress users.
  • Nathan Wrigley spoke with Brian Coords on WP Tavern Jukebox about why WordPress remains valuable for agencies, how block themes can centralize design and content guidelines, and how websites can serve as a source of truth for AI-assisted workflows.
  • On The WP Minute’s Agency Action podcast, Kurt von Ahnen and Toby Cryns discuss how agencies are using AI to manage email, streamline workflows, rebuild WordPress sites, handle complex WooCommerce projects and more.
  • Katie Keith examines five reasons behind Barn2’s declining new plugin sales, including falling search traffic, a shrinking market, AI-generated alternatives, market leaders and features added to WordPress and WooCommerce core, and explores what plugin businesses can do in response.
  • Lesley Sim explains why EventKoi developed custom taxonomies instead of a hard-coded Venues feature, giving users the flexibility to create reusable locations and custom fields, display data in different ways, and filter events.
  • Eric Karkovack explores whether WordPress agencies should charge less for AI-assisted work, arguing that increased efficiency should improve profitability rather than reduce prices.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WP Accessibility Day 2026 Draws 2,210 Registered Attendees From 77 Countries

WP Accessibility Day 2026 took place on October 7 and 8 as a 24-hour virtual conference dedicated to…

Read more

Gutenberg Switches JavaScript Unit and Integration Tests From Jest to Vitest

Gutenberg has finished moving its JavaScript unit and integration tests from Jest to Vitest, and the change introduces…

Read more

WordPress 7.1.3 Released With Seven Security Fixes, Including XSS and SQL Injection Fixes, and Four Bug Fixes

WordPress 7.1.3 has been released with seven security fixes and four bug fixes, addressing vulnerabilities such as stored…

Read more

Automattic Names Four New Board Members and Three New Advisers After Leadership Shake-Up

Automattic has added four new members to its board of directors, including a science-fiction author and a relationship…

Read more

Team WP-CONTENT.CO

Issue #292   |   October 14, 2026   |   Reading time: 25 mins

This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

Built with Newsletter Glue.