Latest / Wpfavs - Your favourite WordPress news / WordPress 7.1 Architecture, Abandoned Plugins, and AI Tooling

Transcript

WordPress 7.1 Architecture, Abandoned Plugins, and AI Tooling · Wpfavs - Your favourite WordPress news

• 0:13
  Welcome to Wpfavs, your favourite WordPress news.
• 0:17
  This is the autumn roundup, and the big one first.
• 0:19
  WordPress 7.1 shipped on August 19th, timed with WordCamp US in Phoenix.
• 0:25
  Beta 4 had already closed more than 114 updates and fixes, 51 in the Editor and 63
• 0:31
  in Core.
• 0:32
  But the headline for builders is architectural.
• 0:34
  Right, and it's the iframe.
• 0:37
  The post editor canvas is now fully isolated in an iframe.
• 0:40
  When it comes to building blocks, that's a real shift.
• 0:43
  If your block leans on global scripts, or on CSS inheriting from the admin,
• 0:48
  you'll want to test it before you update client sites.
• 0:51
  That's the practical takeaway.
• 0:53
  Staging first, then check every custom block.
• 0:56
  What I like is the direction.
• 0:57
  The editor gets more predictable, and the styling engine gets more granular.
• 1:02
  Before, applying a local style change globally was all or nothing.
• 1:06
  Now you can pick it property by property.
• 1:08
  Add the persistent top toolbar for navigation, plus JSON Schema preparation so
• 1:14
  outside clients can talk to WordPress more reliably.
• 1:17
  It feels like the platform is preparing for non human users.
• 1:21
  And that's exactly what WordCamp US leaned into.
• 1:23
  They ran a Core AI Prompt Bar, an in person space for contributors building AI
• 1:28
  tooling into core.
• 1:30
  Think about it.
• 1:31
  WordPress 7.0 was described as laying the foundation for AI across the experience,
• 1:36
  and 7.1 is where the plumbing gets tidier.
• 1:39
  This is moving fast.
• 1:40
  Now the less glamorous news, but I think it matters more.
• 1:44
  Chris Morris pointed to a report from WP Goldmine, The State of WordPress Plugin
• 1:48
  Opportunities 2026.
• 1:50
  They analyzed 57,383 plugins in the directory to see how many have gone stale.
• 1:56
  And the number is ugly.
• 1:57
  In the band with 10,000 to 100,000 active installs, 24% haven't been updated in over
• 2:03
  two years.
• 2:04
  That's 1,209 plugins with real user bases and no maintainer.
• 2:09
  In the 100,000 to 1 million band, it's 10.2%.
• 2:13
  The examples hurt.
• 2:14
  Limit Login Attempts, Layout Grid Block, and WP Downgrade are among the most
• 2:19
  installed abandoned plugins.
• 2:21
  We're also seeing veterans step back.
• 2:23
  Ajay D'Souza is retiring Popular Authors, and 1.5.0 is the final release.
• 2:29
  WP Plugin Info Card is open for a developer takeover.
• 2:34
  My advice for agencies: audit your stack for last updated dates.
• 2:38
  That's a quick check, and it catches a lot.
• 2:40
  I'd add a thought.
• 2:42
  If a quarter of those popular plugins are orphaned, that's also an opportunity.
• 2:46
  Somebody could adopt them.
• 2:47
  The report is literally framed as plugin opportunities.
• 2:51
  The risk for site owners is the flip side of the same coin.
• 2:54
  Which brings us to security, because the risk is not theoretical.
• 2:58
  GuardingWP published its first State of WordPress Security 2026 report.
• 3:04
  Their scans found 52.8% of sites running at least one plugin with a known
• 3:09
  vulnerability.
• 3:10
  55.9% leak their WordPress version through the generator meta tag.
• 3:15
  And 93.2% are missing one or more modern security headers, like HSTS,
• 3:20
  CSP, and X Frame Options.
• 3:22
  Their line was that defaults from the 2015 web are still the defaults in 2026.
• 3:28
  Those headers are a streamlined fix, honestly.
• 3:30
  Many hosts let you add them in a few clicks.
• 3:33
  And on core, update if you haven't.
• 3:36
  WordPress 7.0.2 was a security release.
• 3:40
  Adam Kues at Assetnote and Searchlight Cyber reported a REST API batch route
• 3:46
  confusion and SQL injection issue that could lead to remote code execution.
• 3:51
  Separately, TF1T, dtro, and haongo reported a facilitated SQL injection issue.
• 3:57
  And here's the part that surprised me.
• 3:59
  Wordfence PRISM, an autonomous AI vulnerability intelligence agent,
• 4:04
  caught a critical authentication bypass backdoor in the Advanced Responsive Video
• 4:09
  Embedder plugin, which has roughly 20,000 active installs.
• 4:14
  It flagged it within two hours after the malicious code was introduced.
• 4:18
  Two hours.
• 4:19
  Compare that to a site owner who checks plugins once a quarter.
• 4:22
  I'd call that a signal.
• 4:24
  Attackers are going to use agents too, so defense has to be machine speed.
• 4:28
  I'd say watch this space closely.
• 4:30
  Now the business side.
• 4:32
  Envato moved to a flat 50% author fee from July 1st, ending the exclusive author
• 4:38
  model where some authors paid the platform a lower fee.
• 4:42
  Vova, who just launched VovaBlocks, said going independent is inevitable.
• 4:47
  Xaver said the marketplace model feels dated.
• 4:49
  Lawrence Ladomery asked whether it's time to sell direct.
• 4:53
  And consolidation continues.
• 4:54
  StellarWP no longer exists as a brand.
• 4:57
  Its products now sit under Liquid Web.
• 4:59
  Some keep their names, some are rebranded, and some features are merged into other
• 5:04
  plugins.
• 5:04
  That sparked a lot of community reaction, and I understand why.
• 5:07
  If your site depends on one of those plugins, check the roadmap.
• 5:10
  Now the AI tooling, and there's a real fork.
• 5:13
  Benjamin Intal, founder of Stackable and WP Interactions, shared an experiment
• 5:18
  called Ahentic AI workspace.
• 5:20
  In the preview, it understands the whole site, helps launch it,
• 5:24
  and helps install plugins, with no external servers, services,
• 5:27
  or MCPs.
• 5:28
  Just WordPress and its new APIs.
• 5:30
  The opposite philosophy is Novamira CLI.
• 5:34
  It lets terminal agents, Claude Code, Codex CLI, Gemini CLI,
• 5:39
  or anything that can run shell commands, connect to a site running Novamira.
• 5:45
  And Novamira's pitch includes PHP execution, database queries,
• 5:49
  and file operations.
• 5:50
  That's a lot of power.
• 5:51
  Power is great, but I'd say scope it carefully.
• 5:54
  Native APIs give you guardrails.
• 5:57
  Raw shell access gives you speed and risk.
• 6:00
  Pick per project, and never on a production client site without a backup.
• 6:04
  Two more AI items.
• 6:05
  AttribuLead recognizes referrals from ChatGPT, Claude, Perplexity,
• 6:09
  and Gemini as their own channel.
• 6:11
  If you care about AI visibility, you finally get a way to see it.
• 6:14
  And Vercel released an AI Gateway plugin, 40 plus providers through a single API
• 6:19
  key.
• 6:19
  WP Rocket also shipped an MCP server, so AI clients can see your real performance
• 6:24
  data.
• 6:25
  Finally, three underrated tools.
• 6:27
  Dynamic OSM Maps gives you a Gutenberg map block on OpenStreetMap and Leaflet,
• 6:33
  with no Google API keys or recurring fees.
• 6:37
  Reviso lets clients pin feedback on live pages, with no logins,
• 6:41
  inside Gutenberg, Bricks, and Elementor.
• 6:44
  And the official WordPress Browser Extension for Chrome and Safari moves the admin
• 6:49
  bar out of the front end, so it stops affecting layouts.
• 6:52
  That's the roundup.
• 6:53
  Update, audit your plugins, and test your blocks in the iframe.
• 6:57
  See you next week.