WordPress 6.9.2 landed on March 11, 2026 with fixes for ten vulnerabilities, among them blind SSRF, a PoP chain in the HTML API and an XXE in getID3. What each one lets an attacker do, and how to ship the update with WP-CLI.
WordPress 7.0 Beta 3 ships 148 fixes and swaps the static AI provider list for the WP AI Client registry. Here is what changed in the connectors screen and how to test it on staging before the April 9 release.
Core was tagging hidden Gutenberg images as high priority and hurting LCP. Ticket #64823 fixes that, and Performance Lab is dropping Web Worker Offloading after 6,000 updates with no feedback.
WordPress 7.0 in Beta 3: RTC syncs over HTTP polling with Yjs, AI connectors give plugins one shared interface, and patterns default to content-only editing. Patch 6.9.2 before you touch any of it.
WordPress 7.0 Beta 2 adds one Connectors screen for AI providers and forces Block API v3 blocks into the iframed editor. Both change what your plugin code has to do before the April 9 release.
AI Experiments 0.4.0 puts prompt-based image generation in the Block Editor and the Media Library, and adds a Generate Review Notes pass for accessibility and readability. It also points at the WordPress AI rename in 0.5.0.
WordPress 7.0 supports :hover, :focus, :focus-visible and :active inside theme.json for blocks and their variations. What that replaces, how the JSON looks, and the limits worth knowing before you refactor.
WordPress is featuring eight plugins every two weeks, picked from those with under 10,000 installs and less than a year in the directory. What the criteria check, and the code cleanup worth doing first.
CVE-2026-3589 is a CSRF flaw in the WooCommerce Store API, affecting versions 5.4 to 10.5.2, that can be used to create admin accounts through batch requests. How the flaw works, and how to check your own version with WP-CLI or a small PHP snippet.
WordPress 7.0 lets you register a block entirely in PHP. The autoRegister flag tells the editor to build the inspector controls from your attribute definitions, so a server-rendered block needs no JavaScript. The setup, and the attribute types it skips.