Latest / Wpfavs - Your favourite WordPress news / Abandoned Plugins and the WordPress 7.1 Reckoning

Transcript

Abandoned Plugins and the WordPress 7.1 Reckoning · Wpfavs - Your favourite WordPress news

• 0:13
  I, I was looking through this WP Goldmine report recently, and honestly,
• 0:18
  the number just stopped me in my tracks.
• 0:20
  They ran an analysis of 57,383 plugins in the WordPress Org plugin directory,
• 0:26
  and when you look at the 10K to 100K active install tier, 24% of them have not been
• 0:31
  updated in over two years.
• 0:33
  That is 1,209 plugins that people rely on every single day,
• 0:37
  completely abandoned.
• 0:39
  1,209 plugins with real user bases?
• 0:41
  That, that means hundreds of thousands of live sites are running code that nobody is
• 0:45
  watching.
• 0:46
  Exactly.
• 0:47
  I mean, we are talking about staples here, tools like Limit Login Attempts,
• 0:51
  Layout Grid Block, WP Downgrade.
• 0:54
  People install them, they work, and then they just forget about them.
• 0:58
  But under the hood, the clock is ticking.
• 1:00
  Wait, if the plugin works today, why is it such an immediate threat?
• 1:03
  Is it just theoretical vulnerability, or does it actually break when core shifts?
• 1:08
  It breaks hard, especially when security patches roll out.
• 1:12
  Look at what happened with the WordPress 7.0.2 release.
• 1:15
  That was an emergency patch for a REST API batch route SQL injection that could lead
• 1:20
  to Remote Code Execution.
• 1:22
  When core has to patch a severe flaw like that, unmaintained plugins that touch
• 1:27
  those same API routes become instant attack vectors.
• 1:31
  Right, because the core security team fixes WordPress core,
• 1:34
  but nobody is patching those 1,209 abandoned plugins to align with the new REST
• 1:39
  behaviors.
• 1:40
  Precisely.
• 1:41
  And if you are running an agency or managing client sites on retainers,
• 1:46
  you are caught in a brutal dilemma.
• 1:48
  Do you take on the internal maintenance liability of forking a stale plugin
• 1:52
  yourself, or do you leave it and pray it does not blow up a client site on a Sunday
• 1:56
  night?
• 1:57
  So your curated plugin stack, the thing you built to save time and streamline your
• 2:01
  workflow, quietly morphs into hidden technical debt without you even changing a line
• 2:06
  of code.
• 2:06
  That is the hidden trap.
• 2:08
  You think you built a reliable system, but a quarter of that mid tier stack is
• 2:11
  sitting on quicksand.
• 2:13
  And this brings us right to the horizon, because WordPress 7.1 is landing on August
• 2:17
  19, 2026.
• 2:19
  Beta 4 just dropped with 114 updates across Core and Editor,
• 2:23
  and there is one change in particular that is going to force a reckoning for all
• 2:26
  these older plugins.
• 2:28
  The Post Editor moving entirely into an isolated iframe.
• 2:31
  Yep.
• 2:32
  The Post Editor is going full iframe.
• 2:34
  If a plugin relies on legacy metaboxes or injects custom block scripts into the top
• 2:38
  level admin DOM, it is going to break.
• 2:40
  It will not render, or it will execute in the wrong context.
• 2:44
  Which means those abandoned plugins we just talked about, if they touch the editor
• 2:47
  scripts or old metabox APIs, they are dead in the water come August 19.
• 2:53
  Agencies cannot just defer maintenance anymore.
• 2:56
  They have to audit their stacks right now.
• 2:58
  What is really interesting to me is how this intersects with what is happening on
• 3:02
  the AI side.
• 3:03
  We are seeing tools like Ahentic AI workspace and WP Rocket MCP that interact
• 3:09
  directly with native WordPress APIs without relying on external servers or heavy
• 3:15
  third party MCP layers.
• 3:16
  Ahentic literally inspects the site, installs plugins, and configures things
• 3:21
  directly through core APIs.
• 3:23
  Which means if your backend REST schema is a mess because of outdated plugin hooks
• 3:27
  or custom admin hacks, these autonomous AI agents cannot read or manage your site
• 3:33
  cleanly either.
• 3:34
  So the play for agencies shifts entirely.
• 3:36
  It is no longer about building clever visual overrides or layering page builder
• 3:40
  hacks on top of legacy code.
• 3:43
  The strategy now is cleaning up the backend, sticking to standardized block schemas,
• 3:47
  and making sure every component is clean enough to survive iframe isolation and
• 3:52
  autonomous AI parsing.
• 3:53
  Simplify the stack, ditch the abandoned tools, and make sure your data schema is
• 3:58
  clean.
• 3:59
  That is how you survive 7.1.
• 4:01
  Alright, that is the reality check for this week.
• 4:03
  Time to go audit those plugin lists.