Issue #295 | November 3, 2026 | Reading time: 23 mins
Hello!
This week on The WP Week Newsletter, we cover WP 7.1.4 security release, the AI Team’s four-part plan for native AI agent support in 7.3, a proposal for a unified notification system for plugins and site activity, a warning for plugin owners entering the hosting business, along with new projects and more.
Submissions are now open for Black Friday 2026! Share your deals on plugins, themes, hosting, WooCommerce tools, SaaS, and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate
🗣️TALK OF THE TOWN
Several flaws require authenticated access, including some exploitable by Contributor-level users. The release also addresses a denial-of-service issue and an information disclosure vulnerability involving unpublished Customizer changesets.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
The proposal covers improvements to the MCP Adapter, core Abilities, OAuth authentication, and the overall user experience, with foundational work planned for the WordPress 7.2 release cycle.
- WordPress reports more than 3,000 security submissions this year as Core Security Initiative marks two months: The initiative has delivered seven core security releases since mid-July, fixing more than 50 critical or high vulnerabilities. WordPress has also automated 73% of security release steps, reduced its untriaged report backlog to double digits, and begun using AI tools to identify vulnerabilities before they are reported.
- Core Team explores a unified notification system for plugins and site activity: The proposed Feature Notifications design introduces a shared notification tray with standardized layouts, severity levels, and controls to reduce clutter. The team is seeking feedback on several design decisions ahead of the feature plugin’s 0.3.0 release.
- Community team fixes attendee privacy bug that exposed opt-out names on public event pages: The issue affected an estimated 1,280 tickets across 168 events between May 2025 and October 2026. They hid about 8,580 tickets that might have been affected and will email organizers and attendees of upcoming events about the incident and how to opt back into public listings.
- Training team calls for community feedback on Learn WordPress Learning Pathways: The review covers the User, Developer, and Designer pathways, with a focus on identifying outdated lessons, missing information, and areas for improvement. Feedback will be grouped into proposed changes for review by subject matter experts before implementation.
- Milana Cap proposes follow-up meetings for open-source CMS documentation contributors: Following the Open Source CMS 2026 conference in Utrecht on October 20–21, Cap reports that representatives from WordPress, Joomla, TYPO3, and phpDocumentor agreed to continue discussions through online meetings. The first is planned for the week of November 16–20, with Drupal documentation contributors also being invited to join.
- WordPress education initiatives report their busiest month yet in September: Pooja Derashri’s report details 13 Campus Connect events held across seven countries, with the program reaching 77 completed events, 140 institutions, and more than 7,800 students.
- Declaring parent-child cart item relationships in WooCommerce 11.3: It will introduce a new filter and Store API field that let extensions identify cart items added as children of another item. This corrects Product Button cart counts for products added through bundles, composite products, and similar extensions, while allowing developers to declare parent-child relationships between cart items.
- WordPress sites remain exposed to a critical Brotli vulnerability through outbound requests: Patchstack reports that CVE-2026-111497, a critical vulnerability in the Brotli decoder, can affect WordPress sites through outbound HTTP requests. An unauthenticated XML-RPC pingback can trigger the flaw, causing PHP workers to crash or become unresponsive.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026): There were 268 vulnerabilities disclosed in 182 plugins and 15 themes.
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacks: It allows unauthenticated attackers to execute arbitrary code through specially crafted regular expressions in CI/CD configurations. GitLab released patches on October 12 for it.
- WP Engine cites nominative fair use and laches in summary judgment bid against Automattic’s counterclaims: In a pre-filing letter submitted to the US District Court for the Northern District of California, the company outlined its arguments for dismissing the counterclaims, citing nominative fair use, laches, and a lack of evidence supporting the trademark dilution and WooCommerce claims. Automattic had separately filed its request for a summary judgment on the same day, too.
- Anthropic warns that it’s very close to RSI capability, aka self-building AI: The revised S-1 filing says the company may be approaching its internal threshold for recursive self-improvement, where AI accelerates the development of more capable models.
- Squarespace lays off 19% of its employees: It is affecting around 300 employees, as it restructures to simplify operations and refocus priorities. The layoffs come as the website-building industry faces growing competition from AI-powered tools, with Squarespace also expanding its own AI offerings.
- Google, Microsoft & OpenAI plan to honor shared AI training opt-out: A shared robots.txt line could let sites opt out of AI training with several providers at once, but companies involved are handling it differently.
🔧 TIP OF THE WEEK
Make ACF Blocks Work in the Editor and Frontend
Don’t assume your block only runs on the frontend.
Your JavaScript may need to work when:
- The page loads normally
- ACF preview loads
- The block is dynamically rendered
- Multiple instances exist
Instead of:
$(‘.slider’).slick();
use initialization that targets individual block instances:
function initSlider(block) {
const slider = block.querySelector(‘.slider’);
if (!slider || slider.classList.contains(‘slick-initialized’)) {
return;
}
$(slider).slick();
}
This becomes especially important as the number of ACF blocks grows.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
Kathy Zant and Carol Stambaugh will host the workshop on November 5, which will cover Spacefast’s capabilities for secure agentic building, with demonstrations of what users can build with the platform. The two-hour live session costs $39.
- GoDaddy joins the Tokenomics Foundation as a founding member to help shape the economics of AI: The initiative will develop shared terminology, cost measurement methods, business value frameworks, and improved AI cost reporting to help organizations evaluate AI investments across engineering, finance, and business teams. Also, GoDaddy reported 6% year-over-year revenue growth to $1.34 billion in the third quarter of 2026, as its AI-powered Airo platform surpassed a $100 million annualized bookings run rate and began contributing to bookings growth.
- ChangelogWP project officially shuts down: Ryan Logan (creator of the project) marked the closure, saying, “It was a fun ride, but time to move on.”
- Patrick Gallagher warns WordPress plugin owners against entering the hosting business: He says running a hosting business requires DevOps expertise and attention to security, warning that many WordPress developers lack the experience or resources to manage these responsibilities. He recommends finding a partner that offers a white-label hosting service while developers focus on securing their own codebases and operations.
- Katie Keith shares key takeaways from PressConf Europe: She highlights declining sales across the industry, the need to adapt to changing conditions, and lessons from networking, while outlining plans to explore new research topics, automate company updates with AutoMem, improve performance review data, and integrate feature requests with Help Scout.
- Adam Pickering outlines features he wants to see in the WordPress plugin for ChatGPT: He suggests adding features for migrating sites from Wix or Squarespace, fixing broken links, turning YouTube videos into WordPress posts with featured images uploaded to VideoPress, and buying domains directly in ChatGPT, and invites others to share their ideas.
- Aki Hamano asks WordPress and Gutenberg contributors about their development workflows: Hamano says he now does most of his development through a Claude Code project and rarely opens VS Code locally. He asks other contributors to share the tools and approaches they use.
- Brad Vincent asks whether people would still use a page builder for a new WordPress site: FooPlugins moved its website away from Elementor in June, replacing it with a custom Full Site Editing theme and blocks built using Codex. Vincent says the site has been much faster since the change and that the company is not going back.
- Michal Barus on moving 40 WordPress sites to Astro: The migration took two to three months, moving the sites to static pages hosted on Cloudflare Workers and allowing the team to cancel its Hetzner and Plesk services. He says the move saves around $90 a month, makes the sites faster, and allows them to be controlled with AI agents. He also asked whether people are still running WordPress for clients in 2026.
- Courtney Robertson introduces Merge Conflicts, a series examining how open source projects make and review decisions: Drawing on her own experience in the WordPress community, Robertson examines the difference between written governance procedures and how decisions are made in practice. The series compares governance across 12 open source projects, including WordPress, using documented evidence and clearly labeled accounts, analysis, and unknowns.
- Jonathan Bossenger reflects on four years at Automattic: He details his work with the Learn WordPress Training team, his move to Developer Relations in 2025, and his contributions to the WordPress Abilities API and MCP Adapter. He also reports opening 474 GitHub pull requests, publishing 204 videos on WordPress.tv, and participating in more than 14 conferences, workshops, and meetups.
- Infinite Uploads 3.5 introduces a free plan and new media management features: The update adds Media Cleanup to identify unused and duplicate files, protected downloads for WooCommerce and Easy Digital Downloads purchases, and a redesigned plugin interface. The Free plan includes 10 GB of cloud storage and 20 GB of monthly CDN bandwidth.
- ThriveDesk unveils a refreshed brand with a new logo, mascot and website: The rebrand introduces Neo as the mascot and face of its AI agent, along with new colors, typography and a redesigned app. ThriveDesk also moved its website from WordPress to AstroJS, while existing customer accounts, data, plans, pricing and integrations remain unchanged.
- Elementor Editor v4.4 beta release now available: The release adds an Agent Readiness Scanner, llms.txt and Markdown generation, bot access controls, and read-only WebMCP tools. It also expands MCP support for legacy widgets, form submissions, and site troubleshooting, while introducing new Atomic elements, extended form capabilities, and style import and export support.
- WS Form 1.12.17 adds random text detection to tackle gibberish spam: The update also introduces an Auto Delete Spam setting that removes spam submissions after a specified number of days, reducing the need to clear the Spam folder manually.
- Contact Form 7 releases version 6.2.4 with security fixes for file upload vulnerability: The update addresses an unauthenticated arbitrary file upload vulnerability affecting versions 6.2 to 6.2.3 and introduces a file extension safelist to prevent potentially executable files from being uploaded.
- UltimaTour Operator 2.0.0 streamlines bookings and participant management: The update introduces guest-count-based capacity reservations, immediate ticket and QR code issuance, improved pre-check-in workflows, safer OTA booking intake, and fixes for calendar synchronization, occupancy tracking, reviews, and WordPress.org compliance.
- MailerPress 2.2 has been released: The release adopts native WordPress components and admin color schemes across the plugin, reorganizes navigation, and brings a block editor-style experience to email campaigns. It also adds mobile-friendly layouts, performance and security improvements, WooCommerce contact data in MailerPress Pro, and more than 20 bug fixes.
- Oxygen 6.2 lets AI agents build and edit WordPress sites: The update adds support for MCP-compatible AI agents, allowing them to create and edit pages, templates, components, design systems, dynamic content, interactions, and animations through Oxygen’s own tools.
- Breakdance 3.0 brings AI-powered site building experience: The release adds MCP support for AI agents to create pages, templates, forms, and dynamic content using Breakdance elements. It also introduces a new Selectors system, global CSS variables, built-in interactions for click, hover, and scroll events, and performance improvements to the builder.
- AgentReady releases version 2.0 with updated requirements for AI agents: It adds a requirement for an MCP server or CLI when a product is intended to let agents complete tasks, and upgrades WebMCP from MAY to SHOULD. Miriam Schwab says WordPress already meets most of the specification’s requirements for the find and read stages, while the act stage is where most sites still have work to do
- New milestone for WPVibe: The plugin now has over 100,000+ active installations 100,000.
🚀 NEW PROJECTS
| “Each connection is approved in WordPress and uses a revocable, read-only token. No WordPress password to hand over.” Marcus Burnette about creating Independence Hub. |
- Independence Hub: A new project by Marcus Burnette that brings traffic data from multiple Independent Analytics WordPress sites into one private dashboard, with read-only connections, traffic alerts, growth targets, and an impact journal for tracking campaigns and launches.
- Siren Cloud: It lets users manage affiliate, referral, and other reward programs across multiple stores, websites, and platforms in one place. Alex Standiford says the existing WordPress plugin will continue to be maintained, and users can migrate their programs to the cloud edition.
- Gridrise: Developed by Scott Bolinger (Principal Software Engineer at GoDaddy), it features AI agents that handle phone calls, website chats, and customer support around the clock.
- GeneratePress AI: An optional plugin that connects AI tools such as Claude, ChatGPT, and Cursor to WordPress sites through MCP. With more than 60 abilities, it lets AI build and edit design systems, layouts, pages, fonts, and media, while keeping publishing under the user’s control. GeneratePress says its own website was built entirely using the plugin.
- Resolver: An AI chatbot plugin by Ben Sibley that trains on a site’s content to answer visitor questions around the clock. It automatically updates its knowledge when selected pages change or new pages are published, and lets users connect their own API key from Anthropic, Google, or OpenAI instead of paying a monthly subscription.
- Agent Black Box: A new project by Robert DeVore that gives users insight into AI agent activity through execution replays that show tool calls, failures, fixes, and tests.
- Accessible Colour Palette Contrast Checker: Created by Sergi Duran Nyssen it allows users to add their colours and see which pairs have enough contrast for text and interface elements under WCAG 2.2.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- Anchen le Roux joins Bud Kraus on Seriously, Bud? to discuss her journey from South Africa to New Zealand, her career building WordPress and Shopify websites, her involvement in the WordPress community and much more.
- Lesley Sim joins Nathan Wrigley on the WP Builds podcast to discuss her experience building WordPress products, including the transition from Newsletter Glue to EventKoi. They explore the challenges of marketing in a competitive market, building brand recognition, and more.
- Nik McLaughlin argues that the WordPress Abilities API is becoming increasingly important as AI agents change how users interact with websites. He explains how the API makes functionality from WordPress core, plugins, and customizations available to agents.
- Nazmul Hasan Robin details the development of NHR Core Contributions, a plugin that brings WordPress and Gutenberg contribution records, release credits, and contributor statistics into WordPress sites through seven blocks.
- Brad Vincent details how he uses Hermes AI agents across FooPlugins and his side projects, with 12 specialized profiles handling development, research, SEO, marketing, sales, and support.
- Miriam Schwab examines the approaches emerging to make websites agent-ready, including llms.txt, markdown pages, structured data, MCP servers, and Content Signals, and explains which methods AI agents are already using and how site owners can prepare their websites.
- Katie Keith examines the decline of self-hosted ecommerce platforms, finding that 27 of the 29 platforms she measured lost market share over three years. Katie also finds that WooCommerce leads Shopify in 14 of the 25 largest markets worldwide, all of which are non-English-speaking countries, although Shopify is steadily closing the gap in most of them.
- Ted Jones explains why he moved away from dedicated AI writing tools and built a workflow using general AI assistants such as Claude, ChatGPT, and Grok.
- Open Channels FM breaks down the five core principles of the open web: open standards, permissionless publishing, the power of links, interoperability and portability, and decentralization.
- Hostinger breaks down the costs of building and maintaining a WordPress website, covering hosting, domain names, SSL certificates, themes, plugins, and developer fees. They also estimate expenses for different types of websites, including blogs, online stores, small businesses, and custom-built sites.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- WordCamp Canada 2026 on November 5-6: The call for sponsors is now open. The Contributor Day tickets are now available and the schedule has been published.
- WordCamp Manchester 2026 on November 6: The tickets are now available.
- CloudFest Americas on Nov 11-12, 2026: The tickets are now available and the full agenda has been published.
- CMS Conf 2026 on 12-14 November: The tickets are now available. The agenda has been published.
- WordCamp Bengaluru 2026 on Nov 21-22: The call for sponsors is now open, and this year’s theme is WordPress and AI. The tickets are now available.
- Enqueue 2026 on Dec 09: The early bird tickets are now available.
- WordCamp Athens 2026 on 11-12 December: The call for sponsors, and speakers is now open.
- WordCamp Delhi 2026 on 12-13 Dec: The call for sponsors is now open, and the Conference Day Tentative Schedule is now available.
- WordCamp Nepal 2027 on Jan 29-30: The call for media partners is now open, and the call for guides for the WP Kurakani Corner is also now open.
- WordCamp Mumbai 2027 on 13 February: The call for sponsors and speakers is now open.
- WordCamp Switzerland 2027 on 5-6 March: The call for sponsors is now open. Tickets are now available.
- WordCamp Asia 2027 on April 9 – 11: The call for sponsors, volunteers and speakers is now open. The tickets are now available and volunteer application is also now open.
- Checkout Summit 2027 on 28 April – 1 May: The early bird tickets are now available.
- WordCamp Europe 2027 on 27 – 29 May: The call for media partners and community creators is now open.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
Running a Black Friday deal? Share it here.
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer – Get up to 75% off + 3 extra months on the 2-year plan
- Cloudways limited-time summer offer: 40% off on all hosting plans for 4 months plus unlimited free migrations.
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
WP Engine is also seeking summary judgment on all counterclaims brought against it by Automattic in the ongoing…
The WordPress AI Team has outlined plans to make WordPress natively compatible with AI agents, allowing users to…
WordPress 7.1.4 has been released with fixes for 22 vulnerabilities, including a remote code execution flaw and multiple…
Automattic has outlined several grounds on which it may seek summary judgment in its dispute with WP Engine….
Team WP-CONTENT.CO
Issue #295 | November 3, 2026 | Reading time: 23 mins
This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate
Built with Newsletter Glue.