mailwal

Issue #325 - WordPress gets an agent-ready roadmap, 7.1.4 patches 22 flaws, and security goes automated

The Repository
G'day WordPresser. Last week's poll was a mixed bag. A third of you already use MCP tools in your regular workflow, a quarter have dipped a toe in and aren't sold, and 42% of you would rather keep AI well away from your sites. One reader called it "fkng hype."

Fair enough. But the WordPress AI Team isn't waiting for a consensus. It has laid out a plan to make WordPress agent-ready by 7.3, so whether you're keen to hand an agent the keys or would rather keep them firmly in your pocket, it's coming either way.

Let's dig in.
Rae Morey, Editor and Publisher

First time reader? Sign up. Got a tip? Get in touch. Support us? Become a member.

THIS WEEK'S HEADLINES

1. WordPress AI Team Lays Out Ambitious Plan to Make WordPress Agent-Ready by 7.3

The AI Team is moving fast. Two weeks after the MCP Adapter landed in the WordPress.org plugin directory, and a week after Matt Mullenweg approved building MCP into core, Automattic-sponsored team rep Jason Adams has laid out a four-part plan to make WordPress agent-ready by 7.3. It covers native MCP, a baseline of Abilities, OAuth sign-ins, and the experience that ties it all together. His vision is simple: tell your agent "help me Yep, I'm fine with it. with my site," sign in, done.

Adams admits it's an ambitious plan. The adapter has passed 60,000 active installs, clearing Mullenweg's real-world adoption bar for new AI features in core. But in its current form, the adapter "is not a scalable approach for the broad WordPress user base," according to Adams. He's put a call out for contributors to help lead the initiative, and while the target is WordPress 7.3, it's not guaranteed.

The excitement is real, though. Woo developer advocate Brian Coords posted on X that it was "the most important work we need in WordPress core right now," while admitting, "I might be in a bubble." Adam Pickering, Senior Product Designer at Automattic, replied that it wasn't a bubble, but that "core is only half of it," arguing that WordPress also needs better marketing and integrations inside the AI tools people already use. Miles founder Andy Peatling, whose benchmarks found agents couldn't complete a single task through the adapter, posted simply: "Let's make it happen, and fast."

For those nervous about giving an agent access to their sites, Elementor's Miriam Schwab argues in a post on the Elementor blog that "WordPress was born ready for the agentic web," with roles and capabilities that can be set up to keep agents in their lane.

2. Another Week, Another WordPress Security Release

WordPress 7.1.4 shipped this week with fixes for 22 vulnerabilities. It's the seventh core security release since July, which works out to roughly one every two to three weeks. And with 2,306 reports submitted to WordPress's HackerOne program in the past 90 days, there's no sign that things are slowing down.

WordPress historian Jeff Chandler wondered on X whether the cadence was convincing people to turn on auto-updates for point releases. For a lot of folks in the replies, it already had. "I've always had security updates on auto update and major core updates on manual," posted developer John Xionidis, while another reply pointed out that with 22 patches in one release, "'I'll update on the weekend' starts looking a bit brave."

PublishPress founder Steve Burge dug up a 2013 post about Matt Mullenweg suggesting WordPress should update silently like Chrome. "Maybe it's time to bring that idea back in the AI era," Burge posted on LinkedIn.

Behind the scenes, the Security Team is automating much of the grunt work to make each release less of an ordeal. In an update on the Core Security Initiative, Automattic's Head of Security Rudy Faile said 73% of the 109 steps in a security release have been automated, and that the team has received more than 3,000 reports this year, "which is more than the previous twelve years combined." He called on WordPress companies to sponsor people for triage and release work and to contribute to the bug bounty program. Independent core committer Aaron Jorbin, who has led two of the past four releases, put his hand up in the comments: "I would be very happy to take on additional sponsors."

MORE STORIES

Repeated WP 7.2 text on a bright green background.

WordPress 7.2 Beta 2 Ships With Abilities API Updates, Server-Side DataViews Fields and Actions

WordPress 7.2 Beta 2 is available for testing, with DataViews and DataForm updates, admin asset and icon changes, client-side media improvements, and a December 8 release date.
Stylized scales of justice against a bright blue background.

Automattic and WP Engine Preview Rival Bids to Knock Out Claims Before Trial

In letters ahead of summary judgment, Automattic says its ACF fork "improved" WP Engine customers' security, while WP Engine wants Automattic found liable for interference.
Novamira ad with headline and app dashboard mockup on a black background.

Sponsored: Novamira HQ Connects All Your WordPress Sites and Hosting Accounts to AI in One App

I connected my sites and hosting accounts to Claude via Novamira HQ, ran health and security scans, and wrote up what I found, unwelcome surprise and all, in this sponsored post.
Man in a blazer seated at a table in a bright modern living room.

Enqueue Locks In Futurist Mark Pesce to Keynote Its AI-Focused Conference in Sydney

VRML co-inventor Mark Pesce will open Enqueue on December 9 with a keynote on what AI agents mean for the open web, and for the WordPress developers who build on it.
A booth with the name "AUTOMATTIC" featuring two women talking and plants around.

Automattic's Latest Layoffs Hit a Workforce Already a Third Smaller Than Its 2022 Peak

Automattic's About page shows the company has shrunk from 2,065 staff in 2022 to 1,385 today, and its headcount has fallen more each month since July.

OUR SPONSORS

Altis Enterprise Cloud: Next-gen hosting from Human Made. Autoscaling hack-proof servers, integrated CDN+WAF, best-in-class DX with X-Ray APM, plus Afterburner, a PHP extension for performance. Let's go!

WPConsent: WordPress privacy compliance made easy. Create compliant cookie banners, automatic script blocking, consent log, and more privacy features. Trusted by 100k+ websites. Get started today.

Weglot: Your WordPress translation workflow just got an upgrade. Weglot 2.0 brings context-aware AI, brand control, and multilingual SEO and GEO, all built in. Get started today.

Pressable: We sponsor The Repository because we like good newsletters and even better websites. If you're reading this, we hope your coffee is hot and your site is fast. (If not, we know a host.)

WPForms: Track form views, interactions, and conversions right inside your WordPress dashboard, with field-level insights, conversion goals, and built-in AI chat. Trusted by 5 million sites. Get started today.

WP Engine: Fragmented tools strain resources and slow media teams using WordPress. Learn how WP Engine Newsroom simplifies publishing with one foundation and connected workflows to accelerate editorial time-to-market.

WANotifier for WooCommerce: Help your clients drive more revenue by sending order notifications, abandoned cart recovery alerts and promotional marketing campaigns on WhatsApp, powered by the official WhatsApp Business API. Free 7-day trial.

Metorik: Metorik gives stores the analytics and reports they're missing – advertising spend, operational costs, profit, attribution, segmenting, exports, and essential email marketing tools. Rated 4.9/5 stars. Free 30-day trial.

20i: Leave single-server hosting in 2015. Choose autoscaling Managed WordPress Hosting built for traffic surges, complex sites & demanding PHP workloads, all without missing a beat.

Patchstack: The #1 WordPress vulnerability processor, protecting websites against vulnerable plugins. Patchstack partners with hundreds of plugins and hosting providers to make the ecosystem safer. Get started today.

Novamira: An open source plugin that gives your AI full access to your WordPress site, so it can run PHP, query the database, and perform file operations. Connect via MCP or CLI. Available free at novamira.ai.
Our sponsors keep The Repository free and independent. The best way to support us? Support them.

IN OTHER NEWS

🏗️ WordPress Project
  • Automattic's Anne McCarthy is seeking feedback on WordPress release roadmaps, which have kept roughly the same format for three years, with a survey open until November 16 (Make WordPress Core) / The Training Team is also looking for experienced contributors to review the User, Developer, and Designer Learning Pathways on Learn WordPress, saying feedback on even one lesson is valuable (Make WordPress Training
  • A bug in WordPress event ticketing listed about 1,280 ticket holders who had opted out of public Attendees pages across 168 WordCamp.org and events.wordpress.org events over 17 months. Saving a ticket for any reason flipped the answer to "Yes," and because earlier answers weren't recorded, the Community Team has hidden about 8,580 tickets from Attendees pages as a precaution (Make WordPress Community)
  • WordPress Contributor Toolkit 2.0 has shipped with a redesigned interface built on the WordPress Design System and translations in 10 languages. The app is also about 350MB smaller once installed (Make WordPress Core)
  • WordPress Campus Connect had its busiest month yet in September, with 13 events across seven countries, and now accounts for 64 of the 138 community events on the 2026 calendar. WordPress Credits has reached 924 students across 17 countries with an 88% graduation rate, and Rowan University in the US is planning its first cohort for spring 2027 (Make WordPress Community)
  • Documentation Team co-rep Milana Cap is organizing follow-up online meetings for docs contributors from WordPress, Joomla!, TYPO3, and phpDocumentor following the Open Source CMS 2026 conference in Utrecht, with the first call planned for the week of November 16. Cap said the conference ended with a draft statement of collaboration promises, and that docs representatives realized they needed more time to work through shared problems (Make WordPress Docs)
📣 Community & Events
  • Ahmedabad has been selected to host WordCamp India 2027, the project's fourth flagship event, which is expected to take place in November 2027. "For those of us who have been part of the WordPress community in Ahmedabad for years, this is a really proud moment," WordPress Ahmedabad organizer Chetan Prajapati wrote (Chetan Prajapati on X / Make WordPress Community) (Backstory: The Repository)
  • Voting for The WP Awards 2026 is open across 29 categories until November 30, with winners to be announced December 8–15 (The WP Weekly)
  • WordPress.com has launched Wide Margins, a series of live-streamed long-form conversations, and the first episode featured science fiction author Neal Stephenson comparing the AI race to the Manhattan Project. Stephenson said he was less worried about carbon emissions, which have technical fixes, than about people no longer being able to agree on what's real (WordPress.com)
💼 Business & Product
  • Wordfence says it isn't aware of any WordPress site compromised through PHP2Shell a week after the PHP project patched the two critical vulnerabilities, but warns that attackers are still adapting their tools. "So yeah, it matters that there were no confirmed compromises but vendors were saying there were," Wordfence CEO Mark Maunder wrote on X, warning that overhyped alerts would wear down trust ahead of the next serious vulnerability (Wordfence / Mark Maunder on X)
  • CSS-Tricks is independent again after Geoff Graham, who has worked on the site for 12 years, bought it from DigitalOcean, which acquired it from founder Chris Coyier in 2022. "My goal is to make CSS-Tricks a platform that gives folks a voice to share great ideas," Graham wrote, adding that he planned to fund the site through ads, sponsorships, and paid memberships (CSS-Tricks)
  • GoDaddy has reported third-quarter revenue of $1.34 billion, up 6% year over year, with Airo's annualized bookings run rate passing $100 million, more than double the $50 million of a quarter earlier. GoDaddy says Airo is becoming its flagship website product (GoDaddy)
  • Former Fueled Chief Revenue Officer Gabe Karp has joined WP Engine as Vice President of New Ventures, where he'll help bring the company's AI capabilities to market with customers and agency partners (WP Engine)
  • Akismet has turned 21 with more than 570 billion pieces of spam blocked, after releasing an official Drupal module and a PHP SDK this year. "One of the biggest opportunities I see is bringing Akismet's protection to more of the web beyond WordPress," wrote Automattic's Peter Westwood (Akismet / Peter Westwood)
  • AgentReady, an open specification for making products usable by AI agents, has released version 2.0, making an MCP server or CLI a requirement for products that want agents to complete tasks. Elementor Head of WordPress Miriam Schwab, whose team worked with Ora on how the spec applies to WordPress sites, wrote, "A large part of the web runs on WordPress, so I'm glad we could help make sure the standard fits it 🙂" (AgentReady / Miriam Schwab on LinkedIn)
  • Wordfence has launched a Threat Response Team, led by Senior Web Application Vulnerability Researcher Alex Thomas, to handle the first 72 hours of emerging threats, with a dedicated email address for reporting active exploits, supply-chain compromises, and mass attack campaigns. Reports will go straight to team members rather than a general support queue, while the Threat Intelligence Team focuses on longer-term research and disclosure work (Wordfence)
  • EventKoi co-founder Lesley Sim says flexible building blocks, not more features, are her plugin's edge in a crowded events market, 18 months after selling Newsletter Glue. "In WordPress, the one thing that we can guarantee is that nobody ever wants the same thing," she told WP Builds host Nathan Wrigley (WP Builds) (Backstory: The Repository)
  • WPZOOM has adopted WPBruiser, the CAPTCHA-free anti-spam plugin that went unmaintained for years, and returned it to the WordPress.org directory with a security fix and new login lockout features (WPZOOM)
  • Patchstack CEO Oliver Sild has built Vulnocalypse, a live tracker of new vulnerabilities mentioned by CERTs, vendors, research labs, and newsrooms in more than 200 countries, complete with a "Panic meter" (Vulnocalypse)

THIS WEEK'S POLL

The AI Team wants to merge MCP, Abilities, and OAuth in WordPress 7.3. Is that the right call?

Last week's poll: Do you use an MCP tool to manage your sites with AI tools?

✅ Yes, it's part of my regular workflow (34%)
🤔 I've tried it, but I'm not sold yet (24%)
🚫 No, I don't let AI near my sites (42%)

Your two cents:
  • 🚫 Anonymous: "I will not let AI directly on my sites. I may use tools like ChatGPT but only through their website. I can't trust AI tools to make the exact changes I want, and be able to undone them if the changes aren't exactly what I requested."
  • 🚫 D.A: "AI is fkng hype."
The Repository is an independent media outlet dedicated to reporting the latest news in the WordPress ecosystem. Our publisher is Rae Morey and our proofreader this week is Dee Teal. A big thanks to Kinsta, our hosting sponsor, and MailPoet, our email sponsor.

You're receiving this email because you subscribed on our website.

© 2026 The Repository WP, Northcote VIC Australia 3070