CVE-2026-3589 is a CSRF flaw in the WooCommerce Store API, affecting versions 5.4 to 10.5.2, that can be used to create admin accounts through batch requests. How the flaw works, and how to check your own version with WP-CLI or a small PHP snippet.
WordPress 7.0 lets you register a block entirely in PHP. The autoRegister flag tells the editor to build the inspector controls from your attribute definitions, so a server-rendered block needs no JavaScript. The setup, and the attribute types it skips.
WordPress 7.0 adds a programmatic watch() to the Interactivity API and populates state.url on the server, so the guard code around that first undefined value can go. Also covers the deprecated core/router navigation properties and what to use instead.
After fourteen years, I moved away from enterprise WordPress maintenance. Four things pushed me out: release cycles measured in weeks, proprietary wrappers that hide core, six-month footer tickets, and a culture that punishes shipping.
Beta 2 landed on February 26th and Beta 3 is due March 5th. The parts that matter for developers: blocks you can register in PHP alone, an iframed editor that isolates your CSS, and the handbook back in sync with Gutenberg 22.6.
WordPress 7.0 reworks DataViews and DataForm. The Field API gains a format property and adaptiveSelect, DataForm gets a native details layout with built-in validation, and groupByField becomes a groupBy object that breaks 6.9 view configs without warning.
WordPress 7.0 ships a native Breadcrumbs block, so the plugin can go. Two filters, block_core_breadcrumbs_items and block_core_breadcrumbs_post_type_settings, let you rewrite the trail and pick which taxonomy path wins when a post sits in several terms.
Mobile menus in WordPress 7.0 are template parts you edit in the Site Editor. This covers the navigation-overlay area, the theme.json registration, the close block you should add yourself, and the full-screen-only limit in this first release.
WordPress 6.9 introduces assertEqualHTML(), which tests HTML by comparing structure instead of literal text. It normalizes attributes, class names, and markup so your test suite survives minor formatting changes.
WordPress 7.0’s AI updates are heading into Beta 2. This post covers the pivot away from the Abilities API, the new Connector Screen, and the dependency issues in the AI Experiments plugin.