WordPress News and Updates: What’s Happening in 2026

WordPress just closed out one of its busiest stretches of 2026, and none of it was quiet. A high-severity security release landed on August 6. A second major version of the year, WordPress 7.1, is set to ship on August 19 at WordCamp US in Phoenix. And underneath both of those headlines sits a bigger shift: core WordPress now ships with the wiring for AI, not the finished AI features themselves. Connectors, credentials, and a shared client used to live inside individual plugins. Now they live in core, and every plugin gets to build on top of them.

Here’s why that combination matters. WordPress is used on 59.0 percent of all websites whose content management system is known, and roughly 40.8 percent of every website on the internet, according to W3Techs’ August 2026 tracking. That scale means a security patch, a new block, or a new AI framework in core doesn’t stay a niche developer story for long. It reaches agencies, freelancers, in-house marketing teams, and millions of small business owners who never think about WordPress until something breaks.

This roundup covers what actually shipped this month, what’s arriving next, and what site owners, developers, and agencies should do about each one. No filler, no recycled press releases. Just the news that changes how you should be running your WordPress sites right now.

WordPress By The Numbers in 2026

Before the news, the baseline. A quick look at where WordPress stands heading into the back half of 2026, straight from primary tracking data rather than a recycled stat sheet.

Source: W3Techs, WordPress usage statistics, August 13, 2026.

Worth pausing on that version split. More than half of all WordPress sites have already moved to version 7, which shipped barely three months ago. That’s a faster jump than most major version transitions in the platform’s history, and it says something about how automatic updates and hosting-level testing have matured. It also means the AI infrastructure introduced in 7.0 isn’t sitting on a handful of early adopter sites. It’s already live on a meaningful chunk of the web.

Biggest WordPress News This Month

WordPress 7.0.3 Security Release: What Shipped

Here’s what happened. On August 6, the WordPress security team pushed out 7.0.3, a release with a single job: close 12 vulnerabilities in core before they got exploited at scale. Sites that support automatic background updates started receiving it right away. If you manage a site that somehow missed both this release and its predecessor, that’s worth checking today rather than after finishing this article.

The most serious issue, tracked as CVE-2026-64638, is a pre-authentication reflected cross-site scripting flaw on the WordPress login screen, rated High with a CVSS score of 8.9. According to reporting from The Hacker News, the flaw needs no attacker privileges and no logged-in victim to trigger the initial script execution on the login page itself. The dangerous part comes next: if a logged-in administrator clicks an attacker-crafted link, the injected script can chain into PHP code execution through the Plugin Editor or Theme Editor, handing an attacker meaningful control over the site.

That’s a mouthful, so here’s the plain version. Nobody needs an account on your site to start this attack. They just need one admin to click one bad link. That’s a low bar, and it’s exactly the kind of scenario phishing campaigns are built around.

The other 11 fixes are less dramatic but still worth knowing. They cover stored XSS issues in the Post Date and Post Content blocks, an information disclosure bug in the Latest Comments block that could expose comments on password-protected posts, a privilege escalation issue on multisite networks, a CSS injection flaw, an email verification bypass, and a server-side request forgery vulnerability. WordPress backported the fixes as far back as the 4.7 branch, which tells you the security team still takes legacy installs seriously even years after most agencies have moved on.

For site owners:

update now if you haven’t already, and don’t assume auto-updates caught it if the site is on managed or self-hosted infrastructure with updates disabled.

For agencies: this is a good moment to confirm every client site actually has core auto-updates enabled, not just plugin updates. A surprising number of “maintained” sites quietly have this turned off.

WordPress 7.1 Is Almost Here

WordPress 7.1 is the second major release of the year, following 7.0 in May, and it’s arriving on purpose during WordCamp US 2026, running August 16 through 19 at the Phoenix Convention Center. Release candidates have already shipped, with RC1 alone carrying more than 145 updates and fixes since Beta 4. That’s a lot of polish going into a release most people will experience through one change: styling hover and focus states without touching CSS.

That’s the headline feature, and it’s a genuinely useful one. Responsive styling and interactive state styling become native editor controls, meaning you can set how a block looks on mobile versus desktop, and how a button changes color on hover, focus, or active states, without writing a single line of custom CSS. At the beta stage this support is limited mainly to the Button and Navigation Link blocks, so don’t expect it everywhere on day one. Still, for agencies that bill hours for exactly this kind of styling work, it’s a real shift in how much custom CSS a typical build needs.

Two new blocks are shipping too. A Tabs block finally brings native tabbed content panels into core, useful for FAQs, product specs, or comparison content that would otherwise turn a page into an endless scroll. A Playlist block adds audio collections with waveform visualization, aimed at podcasters and musicians who currently rely on third-party plugins for something this basic. Both were stabilized in Gutenberg 23.6 before making the cut for 7.1.

Collaboration gets an upgrade as well, though not the one everyone was hoping for. The Notes feature picks up @mentions, rich text formatting, threaded discussions, and the ability to attach a note to a specific piece of text, which makes async editorial review genuinely workable inside WordPress for the first time. Real-time collaboration, the feature pulled from 7.0 shortly before its release, is still not in this version. The roadmap description calls the scope and storage questions unresolved. In practice, that means the underlying architecture for live co-editing still isn’t settled.

AI Infrastructure Is Becoming the New Standard

If one architectural shift defines WordPress right now, it’s this: the plumbing for AI, not AI features themselves, is moving into core. Think of it the way custom fields or the block editor moved from plugin territory into standard WordPress. Core doesn’t write your content. It gives every plugin a shared, consistent way to connect to an AI provider instead of each one building that wiring from scratch.

What Actually Shipped in WordPress 7.0

Back in May, WordPress 7.0 introduced three pieces that work together. The AI Client gives plugins a single, provider-agnostic way to talk to AI models, so a developer no longer has to build a custom integration for every provider they want to support. The Connectors API centralizes that setup into one screen, Settings > Connectors, where site owners enter API keys once instead of scattering them across a dozen plugin settings pages. WordPress 7.0 ships with three default connectors, for OpenAI, Anthropic, and Google. And the Abilities API lets plugins, themes, and core expose what they can do in a machine-readable format, which is what makes it possible for an AI agent to actually take an action on a site rather than just suggest one.

Why WordPress Is Betting On This Architecture

Before this shift, every AI plugin reinvented the same wiring: credential storage, provider abstraction, request handling. Multiply that across the plugin ecosystem and you get a lot of duplicated, inconsistent code. By moving the plumbing into core, WordPress lets every plugin that wants an AI feature build on the same foundation instead of starting from scratch. That’s also what positions WordPress for what’s being called agentic commerce and agentic browsing, where AI assistants act on a site’s data directly through a defined, permissioned interface rather than scraping a page and guessing.

The MCP Adapter Angle Nobody’s Talking About Enough

Here’s a detail that’s easy to miss in the coverage. WordPress also ships an MCP Adapter, which exposes registered Abilities as tools that any Model Context Protocol compatible AI assistant, including tools like Claude, can discover and call. In practice, that means an external AI assistant can retrieve a site’s posts, analyze them, and trigger an update to metadata or content, using the same permissioned Abilities layer a first-party plugin would use. This is the part of the story that turns WordPress from “a CMS with AI features” into infrastructure that outside AI systems can actually plug into safely.

Where the Friction Still Is

Honestly, this is still early. The AI Client and Abilities API give developers plumbing, not finished features. Core doesn’t write your posts or generate your images by itself. You still need a plugin built on top of this infrastructure to get a usable feature, and the ecosystem of plugins doing that well is young. A few things are marked experimental in nightly builds, and best practice right now is to stick with well-supported providers rather than obscure connectors while the framework matures.

How AI Is Changing What WordPress Sites Can Do

Beyond the plumbing, three practical use cases are already showing up across the plugin ecosystem.

Pair AI-assisted content production with a real SEO process rather than letting it run unsupervised. Our WordPress SEO services team treats AI drafts as a starting point, not a finished asset, which is the difference between content that ranks and content that gets filtered out.

Editor and Developer Trends Worth Watching

Theme.json Keeps Absorbing What Used to Be Custom CSS

Viewport breakpoint customization now lives in theme.json, meaning theme authors can define exactly where responsive styles kick in rather than accepting whatever WordPress decides by default. Combined with pseudo-state styling for hover, focus, and active states, this closes two of the most common reasons developers reached for a page builder or custom stylesheet in the first place.

The Classic Block Reprieve

Here’s a small story with a bigger lesson. In June, WordPress floated removing the Classic block from the default inserter. Community pushback was loud enough that the decision reversed on July 7. The Classic block stays, without restriction. It’s a reminder that WordPress’s governance still listens, even mid-cycle, which matters if you’re planning a migration timeline around a feature you assumed was locked in.

What Developers Should Prioritize Right Now

Get familiar with the AI Client SDK if you’re building plugins, since it’s available on GitHub and can be required as a Composer dependency ahead of WordPress 7.0 becoming your minimum supported version. Audit older custom blocks against the enforced iframed editor before 7.1 ships. And if you’re managing AI credentials across client sites, standardize on one or two providers through the Connectors screen instead of letting each site accumulate a different setup. Teams that need this built properly rather than bolted on tend to move faster with a dedicated WordPress developer who already knows where the Abilities API and Block API intersect.

WordPress Security News and Stability Updates

Most WordPress breaches still trace back to outdated plugins and themes rather than core itself, and that hasn’t changed this month. What has changed is the speed and source of the research finding these issues in the first place. AI-assisted vulnerability discovery is now a documented part of how WordPress security releases get built, which likely means shorter gaps between a flaw existing and someone finding it, on both the defensive and offensive sides.

So what should a site owner actually do before updating core? Back up the full site and database first, and actually test that the backup restores. Confirm every plugin and theme that touches login flows, block content, or multisite settings has been tested against the new version. Review the release notes for anything that affects custom code. Then update during low-traffic hours with a rollback plan ready, rather than hoping auto-updates handle everything silently in the background. Our WordPress security guide walks through a fuller checklist if you want a repeatable process instead of a one-time fire drill.

Emerging WordPress Trends to Watch Through Late 2026

Beyond this month’s releases, five trends are shaping where WordPress investment is heading for the rest of the year.

What This Means for Site Owners, Developers, and Agencies

The same news lands differently depending on your role.

For site owners. Update to 7.0.3 today if you haven’t, verify your backup actually restores, and start budgeting time to test 7.1 on staging before August 19. If AI features feel worth exploring, start with the built-in Connectors screen rather than a random plugin with its own credential system.

For developers. The Abilities API and AI Client are where the real opportunity sits over the next year. Get comfortable with them now, audit older custom blocks against the enforced iframed editor, and treat Block API version compatibility as a standard part of every update review, not an afterthought.

For agencies. Bake patch testing into every retainer, not just plugin updates but core security releases too. Position AI workflow builds and design-system consulting as premium services, since that’s where the platform is visibly investing. If you’re scoping new work, a clear view of WordPress development cost keeps early conversations with clients grounded in reality instead of guesswork.

Expert Outlook: Where WordPress Goes From Here

A note on confidence before predictions. Release roadmaps shift, features get deferred, and real-time collaboration has already proven that twice this year alone. That said, the pattern across 7.0 and 7.1 is consistent enough to plan around.

Based on what’s actually shipped, WordPress looks committed to building AI infrastructure into core rather than leaving it entirely to third-party plugins, with the Abilities API and MCP Adapter positioning the platform for a future where AI agents interact with sites directly. Editor design controls will likely keep absorbing tasks that used to require custom CSS or a page builder, narrowing that gap release by release. Security releases will probably keep arriving faster than the old cadence, partly because AI-assisted research is changing how quickly vulnerabilities surface on both sides of that fight. WordPress 7.2 is already scheduled for December 9, 2026, with beta starting October 20, so the next full cycle is closer than it feels.

None of this is locked in stone. All of it lines up with what the project has actually built over the past few months, which is a steadier basis for planning than any single roadmap slide.

Key Takeaways

• WordPress 7.0.3 shipped August 6, 2026, fixing 12 security vulnerabilities including a High-severity pre-auth XSS on the login screen, CVE-2026-64638.
• WordPress 7.1 arrives August 19, 2026, at WordCamp US in Phoenix, headlined by no-code responsive and hover styling, plus new Tabs and Playlist blocks.
• WordPress powers 40.8 percent of all websites and 59.0 percent of sites with a known CMS, according to W3Techs’ August 2026 data.
• AI is now core infrastructure, not a plugin category, through the AI Client, Connectors API, Abilities API, and MCP Adapter introduced in WordPress 7.0.
• Real-time collaboration is deferred again, while async Notes collaboration gets a substantial upgrade in 7.1.
• AI-assisted security research is now part of the pipeline, changing how fast vulnerabilities get discovered on both the defensive and offensive sides.
• Update discipline matters more, not less. Two security-only releases landed in three weeks, and 7.1 introduces editor changes worth testing on staging first.

Frequently Asked Questions