The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#276 – Five Awesome Motive Plugins Compromised, Sunsetting Wordfence Login Security Plugin, Unicode Email Support

Issue #276   |   June 16, 2026   |   Reading time: 21 mins

Hello!

This week on The WP Week Newsletter, we cover the security breach affecting multiple plugins under the Awesome Motive fleet, a call for testing of newly merged Unicode email address support, the Studio desktop app now being available for Linux, the Wordfence Login Security plugin being discontinued next month, a new Akismet PHP SDK, along with new projects and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

🗣️TALK OF THE TOWN

Uncanny Automator has issued a security incident notice after discovering unauthorized access involving a third-party service used by the company. The disclosure comes just days after Sansec researchers discovered an active supply chain attack hitting WordPress sites running OptinMonster, TrustPulse, PushEngage, and MonsterInsights websites were compromised, taking the tally of affected Awesome Motive plugins to five.

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

A call for testing of newly merged Unicode email address support in WordPress, introducing changes that allow WordPress accounts to use email addresses containing non-ASCII characters. The update enables is_email() and sanitize_email() to accept such addresses on sites using utf8mb4 databases and introduces a new WP_Email_Address class.

🔧 TIP OF THE WEEK

Disable Lazy Loading for LCP Images

❌ Bad:

<img loading=”lazy”>

for hero images.

✅ Hero images should load immediately.

Use lazy loading only for below-the-fold content.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

The plugin is being discontinued as its features are already included in the main Wordfence plugin. Ross Morsali also highlighted this upcoming change on X, saying he has his own security setup and only needs two-factor authentication, not the full Wordfence plugin, and asked for alternative recommendations from the community.

  • Website Traffic Trends Reports by WP Engine: The report finds that non-human traffic now accounts for roughly 30% of global web traffic, while AI-driven bots can generate up to 70% of total requests and consume up to 70% of costly hosting and performance resources.
  • Kinsta introduces free bot protection across all hosting plans: Available at no additional cost across all Kinsta plans, the new feature gives site owners self-serve controls to manage AI crawlers, automated traffic, and malicious bots. Key features include four configurable protection levels, AI crawler blocking, Cloudflare-powered CAPTCHA challenges, managed allow lists with custom exceptions, emergency lockdown protection during attacks, and a dedicated analytics dashboard that categorizes traffic by bot and human activity.
  • Introducing the official Akismet PHP SDK: Akismet has released a first-party PHP client for the Akismet API, bringing it to custom PHP applications, SaaS backends, and frameworks such as Laravel and Symfony. The SDK covers the full Akismet API and also powers the recently launched official Drupal module.
  • Elementor’s 10th birthday sale is now live: The sale is open till June 17 and offers up to 30% off select plans.
  • Beaver Build releases alpha version of Beaver Builder AI: This is a new plugin and brings AI-powered website building directly into the Beaver Builder editor, generating fully editable layouts within a reusable design system. It offers multiple ways to build, including an in-editor chat experience that creates full page layouts from prompts, integration with external AI tools via API keys and MCP connections, and the ability to import design kits built in other AI platforms.
  • RunCache is now in beta: RunCloud has launched the beta version of RunCache, a WordPress caching solution that combines full-page, object, and edge caching in a single plugin. The tool includes built-in Cloudflare edge caching, supports both Apache and NGINX servers, and is compatible with WooCommerce.
  • ACF 6.8.4 released: The release adds a security update where AJAX field handlers now validate that the request nonce was created for the expected field type, along with several enhancements and fixes.
  • TablePress v3.3.2 is now available: This is a security and maintenance release, with a fix for a reflected XSS vulnerability alongside several enhancements and bug fixes.
  • FluentCommunity 2.6.0 is live: The update introduces course welcome banners, one-click lesson and quiz duplication, a smoother quiz editor, and much more.
  • Simon Harper has announced that after four years and 210 issues, “Loop WP” is going on an extended hiatus: Loop WP is his newsletter covering happenings across the WordPress and WooCommerce ecosystem, with Simon noting that while open and click rates and advertising revenue have improved, net subscriber growth has declined, and the overall effort required to maintain the publication is no longer worth sustaining.
  • Devin Walker asked whether a product’s website influences how much users trust it: In a poll on X, Walker questioned if people would still trust a premium WordPress product when its website is built with Astro instead of WordPress. Responses were mixed, with 42.3% voting yes, 33.8% voting no, and 23.9% unsure.
  • Danny van Kooten shared his WCEU 2026 takeaways on WordPress growth, AI, and leadership: He shared a number of personal takeaways from WordCamp Europe 2026, saying that WordPress’ decline may be more significant than commonly understood and that many product owners he spoke with were experiencing declining new revenue. He also said that no one he spoke to had found an effective workflow for managing site content with AI, that many people were looking beyond the WordPress ecosystem, and that Matt Mullenweg’s absence from the event affected the mood around WordPress leadership. Despite these concerns, he described the event, attendees, venue, and Kraków itself as amazing.
  • Remkus de Vries says WordPress needs a learning conference built for professionals: He voiced that while WordPress has no shortage of conferences, it lacks a learning-focused event dedicated to helping experienced professionals reach a higher standard. He proposes a curated, two-day, single-track conference built around refinement, with invited expert speakers, connected session themes, practical learning materials, compensated speakers, and networking designed as part of the learning experience. Rather than focusing on beginner tutorials, the event would serve professionals looking to deepen their expertise across the WordPress ecosystem.
  • Rodolfo Melogli says it is time for WordCamp organizers and speakers to be paid for their work: Drawing on his experience organizing Checkout Summit 2026, Melogli argues that the volunteer model behind flagship WordCamps may not be sustainable in the long term. He contends that organizers and speakers who dedicate significant time and effort to planning and delivering events should receive financial compensation, noting that free tickets do not adequately recognize the work involved.
  • Katie Keith on how AI-driven search is reducing plugin traffic and forcing changes to her product strategy: She noted that AI-powered search tools are having a significant impact on her plugin business despite improved search rankings. She reports that clicks to product and blog pages have declined as AI Overviews intercept search traffic, while tools such as ChatGPT often recommend code snippets or alternative solutions instead of plugins. As a result, she plans to focus on her largest products, consolidate smaller plugins where appropriate, and expand into other channels such as agency-focused products and Shopify apps. Keith adds that recurring renewals continue to provide financial stability as she adapts the business to changing search behavior.
  • Jamie Marsland’s “Tame the Blocks” plugin experiment lets users control the editor without touching theme files: The idea includes locking brand colours, setting typography scales, controlling spacing, and hiding block controls editors shouldn’t access, along with a “Brand Lock Mode” to prevent rogue design decisions. Interested folks can now try it on Playground and provide feedback.
  • Pavel Ciorici questioned Elementor’s banner on admin pages: He voiced that the banner is viewable on all admin pages, and soon after, Miriam Schwab (Head of WordPress at Elementor) replied, “Hi! We’re really sorry about that and are fixing it. You all deserve better. Apologies.“ Pavel also talked about the new 24-hour WordPress.org plugin and theme auto-update delay, which breaks the fast feedback loop between developers and users
  • Imokol Faith Ruth receives the Yoast Care fund for her contribution to the WordPress community:  Imokol Faith Ruth, a valued member of the WordPress community, is the latest recipient of the Yoast Care fund.
🚀 NEW PROJECTS
“It’s built for WordPress 7.0, one of the first plugins to take advantage of the brand-new AI Connectors.“

Jake Goldman about creating Auto Release Posts for GitHub.
  • Auto Release Posts for GitHub: Developed by Jake Goldman (President at 10up), the plugin monitors GitHub repositories for new releases and uses AI to research each release and generate a human-readable blog post about it.
  • LolaCore: An AI WordPress admin assistant built by Fran Barbero, with persistent memory that remembers decisions, facts, and fixes across sessions, so you never have to re-explain your setup.
  • CommerceGurus Turbo: A performance plugin built specifically for WooCommerce with features like page caching, CSS and JS optimizer, Cloudflare integration, and more.
  • SandyWP: A new platform developed by Riza that allows users to create disposable WordPress sandboxes.
  • Content Decay Detector: Developed by Gauri Kaushik, the plugin detects decaying content by tracking traffic snapshots, scoring posts, and surfacing actionable fixes before rankings drop.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • Alexander Samokhin shares a breakdown of six months of solo development work on multiple products, highlighting the time invested in each and the revenue outcomes across them.
  • Maria Ansari examines Envato’s upcoming move to a flat 50% author fee, arguing that the change reflects broader shifts in how WordPress products are distributed.
  • Amber Hinds shared a behind-the-scenes look at how Accessibility Checker grew to 10,000+ active installs, explaining what it really takes to market a WordPress plugin over five years. She walks through the early challenges of launching during COVID with a limited audience and resources, and how growth was built through consistent community engagement, content creation, meetups, and WordPress involvement.
  • This episode of WP Tavern Jukebox features Cathy Mitchell, who has been working with WordPress since 2007 and is now working towards WordCamp Canada 2026. The conversation focuses on the role of community within the WordPress ecosystem, including how open, welcoming, and international it feels, and how involvement in WordPress can provide a sense of belonging and fulfillment.
  • Toby and Kurt mark the first anniversary of The WP Minute’s Agency Action podcast, reflecting on past conversations and listener engagement. They then discuss common challenges agencies face with website and brand redesigns, highlighting the importance of clear messaging, trusting experts, and learning from experience.
  • In this episode of Open Web Conversations, Zach Stepek and Carl Alexander speak with Alex Standiford, creator of Siren Affiliates, about the opportunities and challenges AI is bringing to software development.
  • Ivana Cirkovic of WPBakery reflects on the company’s experience at WordCamp Europe 2026 in Kraków, where the team took part in organizing, contributing, and speaking at the event.
  • Elliott Richmond reflects on his experience at WordCamp Europe 2026 in Kraków, sharing highlights from Contributor Day, conference sessions, and community events.
  • Nick Hamze suggested eight WordCamp session formats that put people and participation ahead of technical talks.
  • Adam Zieliński argues that generalized WordPress-to-WordPress synchronization is not possible, outlining challenges related to environment mismatches, environment-specific and sensitive data, plugin-managed information, and the difficulty of resolving semantic conflicts between sites.
  • Jono Alderson explores how AI and emerging browser technologies could reduce the web’s reliance on traditional page-based designs. He suggests that separating machine-readable information from human experiences may enable more expressive and immersive websites in the future.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Always-on, always-fast WordPress Hosting you’ll fall in love with. Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress Testing Opens for Long-Awaited Unicode Email Address Support

A call for testing of newly merged Unicode email address support in WordPress, introducing changes that allow WordPress…

Read more

UpdraftPlus Patches Vulnerability That Could Lead to Complete Site Takeover

A critical unauthenticated authentication bypass vulnerability in the UpdraftPlus plugin has been patched, which could allow unauthenticated attackers…

Read more

WordPress.org Rolls Out AI-Assisted Reviews, Bringing 24-Hour Cooldown to Plugin and Theme Auto-Updates

WordPress co-founder Matt Mullenweg has announced a new security initiative called Protect The Shire, aimed at strengthening the…

Read more

Gutenberg 23.3 Ships Experimental Dashboard, React 19 Upgrade Pulled Back

Gutenberg 23.3 introduces a set of updates, including a new experimental dashboard redesign that supports drag-and-drop interactions for…

Read more

Team WP-CONTENT.CO

Issue #276   |   June 16, 2026   |   Reading time: 21 mins

This weekly newsletter is kindly sponsored by ProfilePress, 20i and WP Job Openings

Built with Newsletter Glue.