Issue #275 | June 9, 2026 | Reading time: 22 mins
Hello!
A big thank you to all our readers for supporting us on this journey as we reach our 275th edition. If you attended WordCamp Europe 2026, we’d love to hear your key takeaways and favourite moments from the event.
This week on The WP Week Newsletter, we cover the new Protect The Shire initiative that adds a 24 hr cooldown period for plugin and theme auto-updates, the revert of the React 19 update in Gutenberg, a call for WP 7.0.1 release managers, benchmarking over 55000 plugins, WordCamp Europe 2026 reflections and the announcement that Málaga, Spain will host WordCamp Europe 2027, along with new projects and more.
Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.
See you next week!
Team WP-CONTENT.CO
🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
🗣️TALK OF THE TOWN
The new Protect The Shire initiative aims to strengthen the security of WordPress.org’s plugin and theme ecosystem through AI-assisted and human review. As a first step, new plugin and theme releases will be delayed by up to 24 hours before reaching sites through auto-updates, providing additional time to detect potential security issues and supply chain threats.
📰 WORDPRESS & AROUND
All the updates around WordPress and its closely related technologies
The new version introduces a set of updates, including a new experimental dashboard redesign that supports drag-and-drop interactions for adding, moving, resizing, and rearranging widgets in the admin interface. The release also brings changes to media handling, block styling, and includes a React 19 upgrade that was later reverted due to compatibility issues. Also, Matt Mullenweg has proposed weekly Gutenberg feedback sessions, where community members can share their small frustrations with Gutenberg and work through them together. The idea has received a positive response from the community.
- Call for WordPress 7.0.x Release managers: Aaron Jorbin has issued a call for volunteers to serve as WordPress 7.0.x maintenance release managers for the WordPress 7.0 series, responsible for bug triage, release coordination, announcements, and documentation updates ahead of the planned June 2026 7.0.1 release.
- Auto-generate block editor handbook docs from block.json PR merged: The proposal was shared earlier for feedback, and now has been merged into Gutenberg. This automatically generates detailed reference pages for core blocks from block.json metadata, helping keep documentation synchronized with the codebase while preserving contributor-written content where needed.
- Announcing a collaborative editing outreach effort for 7.1: The initiative invites early adopters using the latest Gutenberg plugin to provide ongoing real-world feedback through a dedicated Slack channel, helping the team improve the feature’s stability, usability, and overall readiness for release.
- Call for testing: client-side media processing: The feature is targeted for WordPress 7.1, and it processes images directly in the browser before upload, enabling support for modern image formats, reducing server load, and providing more consistent image handling across hosting environments. The testing effort aims to identify bugs, validate performance, and ensure the feature is ready for wider adoption.
- Plugins queue continues to see heavy backlog: The Plugins Team processed 673 plugin requests, approving 376 while rejecting 162 and closing 50. The current queue stands at 4,802 plugins.
- Monthly Education Buzz Report – May 2026: Destiny Kanno’s report recaps a milestone month for WordPress education programs, with Campus Connect surpassing 6,200 attendees, continued growth in the WP Credits program, and new student clubs launching in Costa Rica and India.
- WooCommerce drops block-based Product Editor Beta, leaving Classic Editor as the only option: WooCommerce has announced that the block-based product editor beta will be removed from core with the release of WooCommerce 11.0, scheduled for July 28, 2026. Ahead of its removal, WooCommerce 10.9 (scheduled for June 23, 2026) will introduce deprecation notices and warnings for store owners and extension developers. Following this change, the classic editor will become the sole product editing experience available in WooCommerce core.
- WooCommerce 10.9: What’s coming for developers: The beta is now available for testing ahead of its planned June 23 release. The update focuses on checkout and dashboard performance improvements, introduces built-in transactional email logging, and includes several experimental and beta features.
- Court orders new discovery productions and extends Matt Mullenweg deposition in WP Engine v Automattic case: The court has issued a series of discovery rulings in the WP Engine v. Automattic case, ordering additional document production, directing further responses to certain discovery requests, and granting WP Engine three additional hours to depose Matt Mullenweg. The rulings also denied a number of requests from both parties while setting deadlines for further productions and responses.
- Wordfence Intelligence Weekly WordPress Vulnerability Report (May 25, 2026 to May 31, 2026): There were 277 vulnerabilities disclosed in 184 plugins and 70 themes.
- Quarterly WordPress Threat Intelligence Report by Wordfence: The report highlights a significant increase in WordPress vulnerabilities, with 2,738 vulnerabilities disclosed during the quarter (+23.7% from the previous quarter), including 158 classified as high threat.
- Unauthenticated privilege escalation vulnerability patched in Kirki WordPress plugin: The vulnerability that makes it possible for unauthenticated attackers to take over arbitrary user accounts on the site, including administrator accounts, by leveraging the plugin’s password reset functionality to have the password reset link delivered to an attacker-controlled email address has been patched. Users are to update to the latest version immediately.
- Attackers actively exploiting critical vulnerability in Burst Statistics plugin: A critical authentication bypass vulnerability in the Burst Statistics plugin, affecting versions 3.4.0 through 3.4.1.1, allows unauthenticated attackers who know an administrator username to impersonate that user and potentially take over a site. Wordfence says attackers began exploiting the vulnerability on the same day it was disclosed, with its firewall blocking more than 112,800 attack attempts. Users are strongly advised to update to the patched version, 3.4.2.
🔧 TIP OF THE WEEK
Preload Only the LCP Image
For hero/banner images:
<link rel=”preload” as=”image” href=”hero.jpg”>
This tells the browser:
“Download this first.”
⚠️ Preload only the most important image.
💵 INVESTMENTS, ACQUISITIONS & PARTNERSHIPS
- Progress Planner acquired by Your.Online: Your.Online has acquired Progress Planner, the company founded by Joost de Valk and Marieke van de Rakt. As part of the acquisition, de Valk, van de Rakt, and their team will join the hosting group to lead the development of AI capabilities across its brands. No financial details of the acquisition have been shared.
- Rocket.net announces partnership with WP Umbrella: This gives agency customers free access to WP Umbrella for all sites hosted on Rocket.net, combining hosting with a full site management toolkit. The package includes safe updates with rollback for WordPress core, plugins, and themes, continuous uptime and performance monitoring, vulnerability scans every six hours, and automated client reporting. It also includes white-label reports and AI-enabled workflows through natural-language commands via Claude integration.
👥 COMMUNITY NEWS
Updates and News from the WordPress Community
Marcin Dudek benchmarked 55,202 WordPress.org plugins and found that the median plugin added 0 ms to homepage load times. He argues that plugin count is a poor indicator of performance, with site speed more often affected by a small number of heavy plugins, caching, hosting, and configuration choices.
- Review Signal Publishes 2026 Hosting Benchmarks: This year’s top performers are 34SP.com, DreamHost, GreenGeeks, Lightning Base , WP Buzz, Bluehost, GoDaddy , ICDSoft, Pressable and WPX while 20i, HostArmada and Heart Internet got honorable mentions. This is the first edition in three years.
- What happened at WordCamp Europe 2026: Nicholas Garofalo highlighted the key moments from WordCamp Europe 2026 in Kraków, which brought together more than 2,400 attendees from 81 countries. The event featured Contributor Day, the announcement that CERN’s main website now runs on WordPress, discussions around WordPress 7.0 and AI, technical and business-focused sessions, and a closing fireside chat. WordCamp Europe 2027 will be held in Málaga, Spain and those interested can watch the full WordCamp Europe 2026 session on YouTube. Several attendees have recapped their WordCamp Europe 2026 experiences, including Lana Miro, Daniel Stanica, Ernst-Jan Bach, and Coder’s Jungle.
- Rino de Boer reflects on conversations at WordCamp Europe 2026: Following WordCamp Europe, Rino de Boer said conversations at the event reinforced his view that the biggest threat to WordPress is economic rather than technical. He pointed to concerns about plugin sales, declining interest in WordPress content, and people exploring AI tools and other platforms, and said it feels like many in the ecosystem already have one foot outside WordPress. The response from Matt Medeiros to Rino de Boer received criticism from the community over its framing and assumptions.
- Sybre Waaijer criticizes WooCommerce subscription bug response: He argues that a WooCommerce Subscriptions bug that he reported earlier, affecting renewal reminders for switched subscriptions, isn’t fully fixed. He also criticizes WooCommerce for failing to directly notify affected merchants, claims recovery guidance was not adequately communicated, and warns that the lack of outreach may have contributed to lost merchant revenue.
- The future of the Patchstack bug bounty program: Dave Jong announced significant changes to the program in response to the rise of AI-assisted security research, which has led to a surge in low-impact, duplicate, and poorly validated vulnerability reports. Beginning June 1, 2026, the program will narrow its focus to higher-impact vulnerabilities, tighten submission requirements, revise its bounty structure, and introduce temporary bans for submissions that clearly violate the program’s rules.
- WP Engine enhances Global Edge Security with bot management to control AI-driven website traffic: WP Engine has added customizable bot management features to its Global Edge Security platform, powered by Cloudflare, giving web teams greater visibility and control over unwanted bot traffic. The update includes customizable access rules, instant lockdown capabilities, and tools to help teams detect, classify, and manage automated traffic.
- GoDaddy’s WordPress hosting has evolved, and it’s time to retire outdated criticism: Adam W. Warner argues that GoDaddy’s Managed WordPress Hosting has significantly improved in recent years, claiming that outdated criticisms from past users no longer reflect its current performance. Citing the 2026 WordPress Hosting Benchmarks independent third-party testing results showing “Top Tier” status in the under $25/month category, he highlights strong speed, uptime, and load handling results, and says the platform has been rebuilt with major infrastructure, caching, and performance upgrades. Also, GoDaddy has partnered with Patchstack to add vulnerability detection to managed WordPress hosting.
- FluentBoards celebrates 2 years with a limited-time anniversary discount: FluentBoards is offering a flat 50% discount to mark the occasion, and the promotion runs until June 15.
- Plausible adds User Journeys Explorer feature: Michael B shares an update from Plausible about the User Journeys Explorer, a feature he notes helps make it easier to see user paths and goals in one place.
- Siren Affiliates is now an official Gravity Forms add-on: It allows site owners to track leads, sales commissions, and collaborator sign-ups directly from form submissions, with automatic setup when both plugins are installed.
- Introducing the Bluehost AI Website Builder: The new platform uses an AI agent to guide users from a simple prompt to a fully hosted website, asking clarifying questions to tailor the site to their business. It also allows users to continue refining and updating their site through a conversational interface after the initial build.
- BuddyPress Polls v5.0.0 released: The update introduces new Poll and Poll List blocks for the block editor, rating (5-star) and Yes/No poll types, new hooks and filters, and so much more.
- SureForms 2.10.1 released: The update improves Block API compatibility, fixes textarea character counter alignment issues, and resolves a bug that prevented the {entry_id} smart tag from working correctly in email notifications.
- Pootle Playground adds a built-in URL shortener for sharing Playground blueprints: Jamie Marsland highlighted this update aimed at users creating educational resources, plugin demos, and other shareable WordPress experiences.
- Introducing KramaKit: Michael B announced that he is bringing all of his separate plugins under a new umbrella brand, KramaKit. The new site currently serves as a central hub linking to his existing plugin websites, with plans to eventually consolidate all content and plugins there and launch new products in the future.
- All new Tabisto: A new project by Yash Kapoor, this is a new Chrome extension that transforms every tab into a calm, personalized workspace where you can manage bookmarks, tab sessions, notes, and reminders, all styled according to your chosen theme.
- MagicPath is now available as an official Codex plugin: With this, users can give Codex an infinite multiplayer canvas where it can design, build, and iterate alongside you.
- Jonathan Bossenger shared his workshop resources from WordCamp Europe 2026: He has published the slides, code, and supporting resources from his Build Your First AI-Powered WordPress Plugin workshop at WordCamp Europe 2026.
- Makarand Mane receives the Yoast Care fund for his contribution to the WordPress community: Makarand Mane, a valued member of the WordPress community, is the latest recipient of the Yoast Care fund.
🚀 NEW PROJECTS
| “Many SEO plugins come packed with features that most users never use. With RankBix SEO, the goal is to provide essential SEO tools while keeping websites fast, clean, and easy to manage.“ Sumit Singh about creating Rank Bix SEO. |
- Rank Bix SEO: A new SEO plugin by Sumit Singh, with sitemaps, schema, redirects, AI meta, bulk editing, IndexNow, LLMs.txt, and 404 Monitor.
- ReadMeWP: The plugin by James Welbes allows WordPress administrators to create internal README-style documents such as guides, SOPs, and onboarding materials that are displayed within the admin sidebar. These documents can be assigned to specific roles or individual users, ensuring that each person only sees the information relevant to them.
- Content Lifecycle Manager: Developed by WP Vibes, it allows site owners to maintain published content after it goes live. It adds a structured workflow for assigning content ownership, scheduling reviews, tracking posts that need attention, and recording maintenance actions such as reviews and archiving.
- WP.MD – Popular Themes: A new project by Pavel Ciorici, which tracks the most popular WordPress.org themes and their rankings.
- AI View Sync: Developed by GcCo, the plugin allows users to create and maintain their site’s llms.txt file in WordPress to help AI crawlers discover and understand key content on your site.
- Dismissed: A new project by Austin Ginder that tracks intrusive WordPress admin notices, highlighting common plugin nags and linking them to the code responsible for displaying them.
🔖 INTERESTING READS & PODCASTS
More posts and podcasts from the WordPress Community you don’t want to miss
- On this episode of WP Tavern Jukebox, Austin Ginder discusses the growing threat of WordPress supply chain attacks, sharing insights from his investigation into compromised plugins and the creation of the WP Beacon project.
- In this episode of Do the Woo, Katie Keith and James Kemp look back at Radical Speed Month at WooCommerce, discussing what the initiative was, what was delivered, and what it could mean going forward.
- This WP Minute+ episode features Matt speaking with Beaver Builder’s Robby McCullough about the evolution of Beaver Builder, including its new AI features. They cover community sentiment in WordPress, the role of open source, adapting to AI-driven change.
- On the Impressive Hosting podcast, host Jesse Friedman speaks with Chris Coyier about the launch of CodePen 2.0 and its evolution from a code-sharing platform into a tool for building, deploying, and hosting websites.
- Mark Zahra reflects on the fallout from SiteGround’s AI plugin rollout and says that the controversy highlights the importance of user consent and trust, while also raising questions about the impact of forced installs on the WordPress plugin ecosystem.
- Rodolfo Melogli reflects on how WooCommerce is entering a new phase and how that is changing the opportunities available to businesses in its ecosystem. As a result, he is moving away from client work, passive learning resources, small utility plugins, and most affiliate partnerships, while focusing more on sponsorships, community building, events, and larger software products.
- Alexa Peduzzi highlights Studio Code’s /annotate feature, which lets users click on page elements in a browser window, add feedback, and send all requested changes back to Studio Code at once.
- Maciej Pilarski highlights the growth of WordPress education initiatives in Poland, where universities, schools, and students are engaging with the WP Credits Program and Campus Connect events to contribute to open source.
🛠 GUIDE ZONE – HOWTO’S and MORE
Handpicked fresh guides from WordPress circle
- How to use WordPress Block Notes: From Speckyboy
- Environment Variables vs. Database: Securing the Connectors API: From Delicious Brains
- Customize your site’s navigation menus with AI: From WordPress.com
- How to register custom icons in WordPress 7.0: From Justin Tadlock
- The future of the WordPress site editor: From Dave on WP
- Rank Math SEO tutorial: How to get more traffic in 2026: From
WP Roads – Pascal Claro - Front End Form Submission – with Elementor to ACF: From Imran Siddiq – Web Squadron
- Craylor compared real-world WordPress hosting performance data from WP Hosting Performance Benchmarks, examining how different hosts perform.
📆 SAVE THE DATES
Do not miss a WordPress event ever again
- ColorCode: Buffalo 2026 on July 25: The early bird tickets are now available.
- WordCamp US, Phoenix on August 16 -19 2026: The call for sponsors and volunteers is now open. The tickets are now available.
- WordCamp Philippines 2026 on August 28-29: The call for sponsors is now open.
- LoopConf 2026 on Sept 23-24: The tickets are now available.
- WordCamp Rajasthan 2026 on 3–4 October: The event is in the early planning stages. The team has unveiled the story behind their logo.
- WordPress Accessibility Day 2026 on October 7th-8th: The call for sponsors is open. Also, interested folks can apply to be a part of the Translation Team.
- WP Suomi 2026 on October 16: The call for sponsors is now open.
- WordCamp Canada 2026 on November 5-6: The call for sponsors and speakers is now open.
- CMS Conf 2026 on 12-14 November: The tickets are now available.
🎁 WORDPRESS DEALS OF THE WEEK
Again, these are the best deals of the week, handpicked by yours!
EXCLUSIVE DEALS
- 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
- 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
- Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
- 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS
- NordVPN Special Offer (27 May–29 July) – Get up to 77% off + 3 extra months on the 2-year plan (prices start from €2.99 / £2.29 / $3.09).
- 30% off for 4 months on Cloudways + 10 Free migrations ( Promo code- TREAT25).
- Up to 50% off on BookingPress plugin
- Up to 50% off on Paid Membership Pro plans.
- Up to $100 OFF Essential Blocks PRO plugin.
- 50% off 3 months on Liquid Web’s Bare Metal server hosting
- 20% off for Constellation plugin
- 28.65% off for the lifetime plan for the Modern Cart for WooCommerce plugin.
- 33% off for the Uncanny Automator plugin.
This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸♂️🙌
Last but not least, updates from WP-CONTENT.CO 👇
Gutenberg 23.3 introduces a set of updates, including a new experimental dashboard redesign that supports drag-and-drop interactions for…
A ruling in WP Engine Inc v Automattic Inc has issued an order addressing multiple discovery disputes, granting…
The WordPress Plugins Team has released Plugin Check 2.0.0, bringing several improvements to the tool that helps developers identify…
Your.Online has acquired Progress Planner, the company founded by Joost de Valk and Marieke van de Rakt. As…
Team WP-CONTENT.CO
Issue #275 | June 9, 2026 | Reading time: 22 mins
This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings
Built with Newsletter Glue.