Last week I was enjoying the first PressConf EU event in Barcelona. And today I find myself in Miami, prepping for CloudFest Americas. All the while there’s tons of stuff happening in our little world worth covering. .
Hope you enjoy it!
🎓 From The Guild
Last week was all about PressConf EU in Barcelona, the conference for professionals driving the WordPress economy.
Having attended the first two PressConf events in the US, I enjoyed seeing how the European edition differed.
My Inward and Outward talk was well received, and I got a lot of questions afterward. The talk was about something I’ve had to work through myself: what do you do when the approach that helped you build your business no longer gets the same results?
More on that ​in my blog post​.
🎓 From The Guild
Last week was all about PressConf EU in Barcelona, the conference for professionals driving the WordPress economy.
Having attended the first two PressConf events in the US, I enjoyed seeing how the European edition differed.
My Inward and Outward talk was well received, and I got a lot of questions afterward. The talk was about something I’ve had to work through myself: what do you do when the approach that helped you build your business no longer gets the same results?
More on that ​in my blog post​.
🗞️ Within WordPress News
Here’s what I saw happening:
- I’m sure you haven’t missed this one, but ​WordPress 7.1.4​ is out and it fixes security issues, including a race condition during Core updates and stored XSS; update your sites now!
- There’s an update for the WordPress AI plugin: ​AI 1.5.0​ adds opt-in experiments for post audio, revision summaries, and C2PA credential detection, plus security fixes.
- WordPress 7.2 ​Beta 4 is ready to test​, following ​the applicable security fixes in Beta 3​, alongside ​admin-menu refinements​ that keep submenus and the collapse button moving with the menu.
- Possibly the most needed feature for WordPress is the new Notifications feature. ​The Feature Notifications design​ groups site and plugin messages under one bell, keeping critical alerts visible until resolved and letting users mute tips and offers.
This remains prototype work; existing admin notices would keep working. Compare the proposed priorities in the ​catalog simulator​.
- The WordPress AI Team’s ​agentic-web proposal​ joins MCP, native Abilities, OAuth and the connection experience into four coordinated workstreams. WordPress 7.3 is the target, with inclusion dependent on technical readiness, security, and Core review.
This can’t happen fast enough, IMO. Great to see things moving!
- ​PHPStan has landed in Gutenberg’s development checks​ at rule level 5. The ​initial 226 baselined findings​ include type-stub issues as well as code fixes, and the issue explains how contributors can work through the list.
- Cool one: ​PhotoFetch​ adds the WordPress Photo Directory to the media picker: search, preview, and import CC0 photos without leaving the editor. ​Built at WordCamp US Contributor Day​, the plugin’s 2.0 rename requires existing Photo Directory Importer users to deactivate and remove the old plugin, then install PhotoFetch fresh.
- ​WordPress Studio’s rebuilt workspace​ keeps chats beside a live preview and saves design choices in
DESIGN.md. Rich Tabor ​explains the direction​; the ​MCP guide​ shows how Claude Code, Codex, or Cursor can work with local Studio sites. Built-in AI uses WordPress.com credits or your own Anthropic API key.
I’ve been using Studio a lot these past couple of weeks with Codex and Claude, and I gotta say, it’s quickly replacing Local for all my local WP dev needs. Really smooth upgrade.
- ​GeneratePress AI​ builds GenerateBlocks pages as drafts and stages live-page edits for approval. To try the optional plugin on a test site, the ​setup guide​ requires an active GeneratePress One license, WordPress 7.0+/PHP 8.1+, GenerateBlocks 2.3+ and a single-site installation.
- Good one to read: ​WordPress.com’s MCP walkthrough​ covers seven jobs for an AI assistant, including checking stale posts and comparing traffic. Gives you a lot more ideas of what can be achieved with an MCP inside of WordPress.
- The agentic-first theme ​Delta 0.4​ now adds ​a Simply Static integration​ for an agent to check, start, and inspect static exports. Delta is still in early development, but it looks really good and versatile.
- Ollie is going into this agentic route more and more as well. Mike McAlister is ​teasing Ollie OS​, a WordPress project aimed at people and agents. The ​coming-soon page​ names MCP, AI tools and a site planner, with a signup rather than a release to try.
- Danny van Kooten ​celebrates seven years of Koko Analytics​, with WordPress.org now showing 70,000+ active installations. The plugin collects visitor stats in the site’s own WordPress database.
- Marcus Burnette’s ​ConnectLocal​ adds free, independent Local add-ons for Bluehost, Cloudways, Kinsta and Hostinger: push or pull files and databases, or compare files before syncing. These early releases need Local 6+ and SSH; ​back up and check deletion settings​ before testing on staging. A database push can overwrite newer live data.
- ​Custom HTML Block Extension 5.0​ by Aki Hamano brings its Monaco editor to the post/site Code Editor and individual blocks’ “Edit as HTML” view; ​the release screenshots​ show block-delimiter and shortcode highlighting. The upgrade requires WordPress 7.1+ and PHP 8.2+.
Can’t believe I’ve never seen this plugin before, but it’s a really nice one.
- Jonny Harris launched a super nice tool. It’s called ​wrapido​, and it turns exposed WordPress REST routes into CLI commands, without SSH or a local WordPress install. This early 0.1.x tool needs Node.js 20+; try staging first.
- Cathy Mitchell wrote about ​AI Website vs WordPress for Small Businesses​.
- André Daus forked WP Control into ​cronhelm​.
🚀 Performance & Security
- Fortbridge ​demonstrates a pingback-to-Brotli RCE path​ in a pinned WordPress 7.1.3 lab. The route needs reachable pingbacks, an accepting post, allowed access to the attacker’s URL, and cURL using vulnerable Brotli. Ask your host to apply a vendor-fixed package or image and restart affected processes, checking for backported fixes; updating WordPress alone does not replace that library.
- Yagiz Nizipli ​explains X’s web rewrite​. Profile and post pages carry content in streamed HTML, avoiding the old browser-side request chain; signed-in rollout is still proceeding country by country.
- ​Psalm 7​ enables security analysis alongside type and dead-code checks, with ​examples of the new injection checks​ to inspect.
- ​cve.now​ brings several public vulnerability databases into one free feed, with RSS and MCP access. Its model-written summaries are labeled and link back to the source records.
- ​Cloudflare Access custom pages​ add HTML/Liquid login, denial, and CLI-approval screens, currently limited to ​paid Zero Trust accounts​. ​Kenny Johnson’s example​ shows failed policy checks; existing Access policies still decide who gets in.
- Riad Benguella has ​added MCP access to CodeVitals​. The ​connection guide​ lets an assistant read public project metrics without a login and compare performance changes with commits.
🔆 Within WordPress Highlight
WebDevStudios’ ​It Looks Done​ walks a vibe-coded app and a WordPress site through a fictional launch day. A crawler arrives, spam hits the contact form, marketing uploads a huge image, and someone needs to fix the copy. Suddenly, there’s a lot more to deliver than the homepage.
The scenarios and costs are illustrative, with plugins and hosting supplying parts of the WordPress side. The useful checklist is the work a client will expect after launch: publishing access, forms, redirects, security updates and maintenance.
đź’ˇ Interesting Finds
- CSS-Tricks is independent again, with Geoff Graham taking ownership from DigitalOcean. Geoff ​sets out plans for the site​, including a beginner HTML/CSS course and the newsletter’s return.
- Nik McLaughlin ​argues that plugin developers should expose reusable operations through the Abilities API​. Exposing those registered operations through MCP lets agents compose workflows beyond the plugin’s existing screens.
- ​Echo-3​ turns phone capture into a shareable 3D scene. Ricardo Martin-Brualla ​shows a house walkthrough​ from a reported ten-minute iPhone capture; processing happens in the cloud.
- David Abitbol ​describes Revolut’s move to self-hosted GLM​ to give engineers more room to use AI beyond coding. Frontier models remain available for exceptions; the reported gains are an internal comparison, not an isolated model benchmark.
- Noah Kagan shares ​AppSumo’s weekly SEO playbook​: compare Search Console and GA4, review the last three actions, then choose at most three next steps. The thread includes the prompt and a reusable file with dated experiments and a change log.
đź›’ WooCommerce News
- ​WooCommerce 11.3 Beta 2​ is ready to test, including ​sale badges that show the amount or percentage saved​. Test on a non-production site running WordPress 6.8+; ​WooCommerce Beta Tester​ users need version 4.0.0 first.
- ​WooCommerce’s PHP stubs package​ lets PHPStan check integrations with included extensions without installing each extension in the analysis environment. Pin the minimum extension version you support; checking only the latest can miss calls that break on older sites.
- WooCommerce has ​merged a session-save fix​, targeted at 11.4, that keeps a cart refresh from discarding an item during a slow add-to-cart. Simultaneous changes to the same session key still use the last save.
- Katie Keith ​examines self-hosted ecommerce’s shrinking share of websites​, using 29 platforms in HTTP Archive’s August 2023–August 2026 crawls, adjusted for sample size. Katie argues that asking merchants to choose hosting before trying a store creates friction Shopify avoids.
- Metorik Engage’s ​Q3 audience sync​ keeps saved customer, order, subscription, or cart segments synced to six advertising platforms. An abandoned-cart audience can drop a shopper after a purchase, cutting out repeated CSV exports.
- Jonny Martin ​explains Built Mighty’s AI migration workflow to Brian Coords​: agents build block themes, then validation scripts check the output. Custom ERP integrations still need separate work.
🔎 Scanfully Updates
We’ve had a few busy weeks at Scanfully, releasing 2.5 and 2.6. V2.5 was mostly refinement and doing things smarter in how and what we’re exactly doing in determining your site is down, but the 2.6 release is the big one I’m excited about: ​WooCommerce Checkout Monitoring​ is finally here:
Read all about it in ​our release blog post​!
That’s it for this week’s edition of Within WordPress. Thanks for reading!
Best, Remkus
Leave a Reply