Howdy,
Before anything else: if you maintain WordPress sites, go update them. WordPress 7.1.2 shipped on September 22 to patch a single critical vulnerability in page template resolution, one that lets an unauthenticated attacker load a chosen PHP file from outside your active theme’s directories.
Now let’s move on to better things. Anne McCarthy is auctioning off her framed WordPress release albums, the ones given to release squad members. All the proceeds go to Stimpunks, a nonprofit started by Ryan Boren, who joined the project in 2003 and wrote the plugin system that nearly every site runs on. She calls the albums “a form of a gold medal to me,” and she built the auction site herself in a week. The starting bid is $500.
We also learned this fortnight that the next default theme will be called Ipsum, which means 16 years of naming themes after the calendar is over. Admittedly, I’ll miss the old Twenty* names a little. But it’s time for something new for a new era.
Two more quick things: WordPress has taken its turn leading the Open Website Alliance, alongside Drupal, Joomla!, and TYPO3, with Mary Hubbard holding the rotating presidency for the WordPress Foundation. And starting with 7.2 in December, release parties move from in-person events to livestreamed webinars, so the whole squad can actually be there.
Enjoy your weekend!
Your friendly neighborhood dev advocate,
Justin Tadlock
Table of Contents
Two security releases in six days. WordPress 7.1.2 is the urgent one, and it’s security-only: an unauthenticated attacker can, under the right conditions, make page template resolution include a readable local PHP file from outside the active theme directories. John Blackbourn led the release, Robert Ressl disclosed it, and the fix was backported to every eligible branch going back to 4.7.
Five days earlier, WordPress 7.1.1 arrived as the regular maintenance release with 11 security fixes, 17 bug fixes on Core, and 19 for the Block Editor. Aaron Jorbin led it, and Anthropic is credited twice in the security list.
Aki Hamano announced what’s new in Gutenberg 24.0. The big feature: post title changes now show up in revisions with a proper diff, so you can stop guessing when a rename happened. The Gallery block gains a Grid variation with column count and “crop images to fit” configurable per breakpoint, and Site Title picks up fit-text, scaling to the width available instead of a fixed point size. And nearly 100 icons were redrawn on a stroke-based grid.
Stalled out somewhere between “clone the repo” and “why won’t this build”? Contributor Toolkit 1.2 from JuanMa Garrido now covers Gutenberg as well as Core, and it runs a stock WordPress in Playground with your checkout mounted as the plugin, already activated. No local server, no Docker.
Anne McCarthy published the roadmap to 7.2, and it looks to be a security-heavy cycle by WordPress standards. Sudo mode gates sensitive admin actions behind re-authentication, a new Secrets API gives credentials “a first-class way to store credentials safely,” and Application Passwords get hardened. Notes should gain a suggestion mode and emoji reactions. Designers get form element customization in Global Styles and custom block states. The final release lands in early December.
Real-time collaboration came out of WordPress 7.0, and Chris Zarate has now explained why in a post on moving to a server-aware approach for collaboration, written with Alec Geatches, Dennis Snell, ingeniumed, and Paul Kevan. The old design had browsers hold the post in a CRDT document and sync peer-to-peer, which broke three ways: the server couldn’t tell who made which edit, opening the door to content laundering; REST API and WP-CLI updates couldn’t participate, so saves became all-or-nothing overwrites; and a dropped connection could take your work with it. Three candidate sync engines are on the table, with a gutenberg-sync-engines repo to test against. If you build editorial tooling, have an opinion about this now.
The next default theme has a name, and for the first time in well over a decade, it isn’t a year. Henrique Iamarino introduced Ipsum, built with Carolina Nymark, Maggie Cabrera, and Juanfra Aldasoro. The reasoning behind the naming change: “default themes will have their own names and change when the design calls for it, not when the calendar does.” The theme is intentionally spare. It’s blog-first, has minimal typesets, and structural elements that stay invisible until you need them. The request is simple: “try it and tell us what breaks and what’s missing.”
Nik Tsekouras opened a call for testing the DataForm editor inspector, which rebuilds the Post and Page tab of the Settings sidebar so it stops drifting from Quick Edit in the Site Editor. Install Gutenberg 24.0 or later and enable Editor Inspector: Use DataForm under Settings → Gutenberg. Test it as an editor, author, and contributor, not just as an admin.
A minor release can touch more than twenty branches, and much of that work was done by hand. Lance Willett opened a public repo of Core release tools, which includes tagging, release docs, SVN merge verification, and contributor lists.
Huzaifa Al Mesbah counted 84 people who tested WordPress 7.1 across 337 Trac tickets. Fifty were first-timers, which is 60% of everyone who showed up. The most important line: “you don’t need to be a developer.” 7.2 testing is open now.
WooCommerce 11.2 lands the week of October 6, so read Shani Banerjee’s pre-release notes before it arrives rather than after. Order withdrawal emails become configurable, the CSV importer can match products by Global Unique ID when neither ID nor SKU is available, and checkout fields gain date support with min/max validation. Two of the seventeen developer advisories will bite if you ignore them: date filters in wc_get_orders() and wc_get_products() now read a bare date as a day in your store’s timezone rather than UTC, and the Cart and Checkout order summary becomes a fixed 360px column with the two-column breakpoint moving from 700px to 920px.
Two dot releases arrived in between, both flagged as security updates. WooCommerce 11.1.2 fixes the infinite recursion that was breaking product variation galleries, and 11.1.1 hardened API permissions and session handling.
The latest WordPress.com changelog moves the AI website builder from picking a theme to generating one: on Premium and Business plans, it “now generates a fully custom theme built around your goals and brand.” A new Annotate feature lets you queue several targeted edits and send them at once.
GatherPress started on a fourteen-hour drive to WordCamp US in 2018, when two Montclair meetup organizers came up with a name and then didn’t write any code for nine months. Rae Morey tells the story of how it grew into WordPress’ Meetup.com replacement, through July of this year, when Automattic’s Karen Arnold confirmed WordPress is going ahead with it. The gatherpress.org domain is transferring to the Foundation, and the plugin has been testable at events.wordpress.org since August 28. No launch date yet, and co-maintainer Mervin Hernandez Sitnikovski would rather you help than wait.
WooCommerce has a new block theme. Brian Coords announced that Purple is back and ready for beta testing. The project was paused during a strategy update last year, and it’s Woo’s first official block theme.
Ten color palettes, ten font pairings, custom styles for both WooCommerce and core blocks, and templates covering everything from Shop to Checkout to My Account. The inserter category is being renamed from “WooCommerce” to “Shop.” If you’re wondering where Storefront’s featured extensions went, block editing absorbed most of them. Peter Schimke also notes that Purple is now the default for new WordPress.com Commerce stores.
Mark your calendar for Wednesday, September 30 at 10 a.m. PDT / 1 p.m. EDT / 7 p.m. CEST: Woo is hosting a live session on building with WooCommerce block themes. Mike McAlister of Ollie joins Woo engineers Karol Manijak and Lucio Giannotta. There’s a Q&A at the end and a recording afterward, but questions only work if you show up.
“We need more workflow in Core,” said K. Adam White, principal engineer at Human Made, talking with Nathan Wrigley on WP Tavern about migrating to blocks with artisanal care and enterprise efficiency. At the center of it is Human Made’s open-source Rehydrator, which uses pattern HTML as a template and injects migrated content into it, so structure and styling survive a move off something like Sitecore. He describes building SQLite databases from client exports just to find the edge cases. He’s candid about the gaps, too: granular permissions, editorial approval workflows, and internationalization.
|
||||
Your Query Loop returns nothing, and the heading and pagination you wrapped around it render anyway. Ryan Welcher spent a live stream adding a “hide if empty” control to Advanced Query Loop, his free plugin that extends the core Query Loop with taxonomy relationships, meta queries, and relative date filters.
Gutenberg’s JavaScript tests have moved off Jest. Marco Ciampini explains that unit and integration tests now use Vitest, driven by ESM: as more dependencies shipped ECMAScript modules, the CommonJS-based Jest setup needed more and more compatibility glue. The part that affects you: @wordpress/scripts 36.0.0 makes Vitest the default for test-unit-js, with @wordpress/eslint-plugin 27.0.0 following. Not ready to migrate? Switch to wp-scripts test-unit-jest and install the Jest dependencies yourself.
Your agent builds you a landing page, and then what? It sits in a chat log, or a folder, or a local dev server nobody else can reach. That’s the gap Spacefast is built for, and Automattic soft-launched it this week: Matt Mullenweg announced it on X. The pitch is the last mile for agent output: publish from a conversation with Claude or ChatGPT, from npx spacefast publish, or from a GitHub push, and get a permanent URL with immutable versions, one-click rollback, and access controls. It hosts full-stack projects, not just static files.
The WordPress hook is a Spacefast plugin with two modes. Static mode hooks into Simply Static, exports your site, and publishes the snapshot. Headless mode treats WordPress as the content source for a repository project, triggering a production rebuild when you publish or update public content.
WordPress Trac now speaks MCP. Lance Willett announced a Trac MCP server that’s “public and free to use: no account or API key needed.” Ask what’s left on a ticket and which pull requests are still open, or what someone committed in January 2005—yes, it goes back that far. It covers every WordPress.org Trac, from Core and Meta to bbPress and GlotPress. James LePage wrote the first version, with props to Jon Surrell, David Newman, and Konstantin Obenland.
Jamie Marsland makes the case for why WebMCP is going to be big for WordPress and, more usefully, shows you how to try it this afternoon: open the ChatGPT desktop app in Work mode, load WordPress Playground in its built-in browser, and ask it to build you a homepage. His framing is the clearest I’ve read. WebMCP gives an assistant “an instruction manual with working buttons” instead of making it squint at screenshots.
For the enterprise view of the same shift, Shane Schick compares WebMCP and traditional MCP and lands on a line I’d pull out of the whole piece: “MCP is not going away, and WebMCP shouldn’t be seen as a rival protocol.” His table sets them side by side on deployment, access scope, scalability, and auditability. That auditability row is the one that matters if you answer to a compliance team.
Schick also introduces Parse.ly MCP, which connects Parse.ly data to whichever assistant your team already uses. You authorize once with your existing login, and the assistant sees exactly the sites your account already sees. “Analysis that used to take a request and a day now takes a conversation.”
One more, for the security-conscious: WPShout walks through connecting Cursor to WordPress with MCP using ThemeIsle’s Easy MCP AI plugin. Every tool call still passes a WordPress capability check, with a 60-requests-per-minute default. Their advice is the part to take seriously: “read-only first, watch the audit log for a week, then grant write scopes deliberately.”
Anthropic open-sourced its commerce agents on September 2, and WooCommerce has already adapted them. Shani Banerjee walks through running the Claude Commerce Agent on WooCommerce, which spins up a demo store with eight products and nine orders in about fifteen minutes. The neat piece is a bridge plugin: the assistant’s cart lives under a Store API token your browser session can’t see, so at checkout the plugin re-adds each item to your real cart with normal stock checks. Merchant-side changes stage behind an approval gate, and “ask it to approve itself and it declines.”
There’s a second kind of visitor to design for now. Carlo Daniele argues for building WordPress for AI agents instead of just human visitors, and the distinction he draws is the useful one: “Crawlers primarily retrieve or index information. Agents can go a step further and take action on a user’s behalf.” That turns architecture questions into permission questions: who is asking, on whose behalf, what can they change, which actions need approval. The Abilities API and MCP Adapter are where WordPress answers them.
A week later, Daniele turned to operations. What happens when AI agents become your new website operators? works through a five-stage autonomy ladder and argues most teams should sit partway up it for a while. I feel like he’s right about that. As he puts it: “An agent that makes a bad production change creates another.”
Want a structured introduction rather than a pile of blog posts? Destiny Kanno announced that the AI-Powered WordPress course is now live on Learn WordPress: four modules, 23 lessons, roughly nine hours. The first three are for anyone who publishes; the fourth introduces the developer APIs and assumes no prior PHP experience.
The AI team’s contributor summary for September 16 is a good snapshot of what’s actually moving. neillmcshea reports work on markdown feeds for the AI plugin, so AI clients can request a markdown version of a post. PHP AI Client 1.5.0 is close. There are still open gaps in web search support. For example, message parts can’t represent source annotations, and citation URLs are hard to retrieve.
Finally, a piece for the conversations you have with clients rather than with a terminal. Will Davis writes about how WordPress agencies use AI, and what clients should ask about it, arguing that the honest uses are the boring ones—code generation, QA, content migration, documentation—while architecture and governance stay human. His five questions for clients would work just as well on a sales call, starting with “What does a person review before it reaches me?” As he puts it, AI “genuinely reduces repetitive work, but it doesn’t replace judgment.”
|
|||||
Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.
For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com
Login
