WordPress News Roundup August 2026: WordPress 7.1 Mary Lou Launches at WordCamp US in Phoenix

August 2026 belonged to Phoenix. WordCamp US brought the North American community together from August 16 to 19, and on the final day the release leads pressed the button on WordPress 7.1 “Mary Lou” from the stage. The release added responsive styling, a new media editor and a far richer Notes system, and it shipped on schedule only three months after 7.0.

The road there was busy. Two more 7.0 security releases landed in the first half of the month, WordPress.org launched an official browser extension, and critical flaws in Elementor Pro and the WPMU DEV Dashboard kept agencies patching through the summer.

Mergers, Acquisitions, and Investments

No major WordPress acquisitions or funding rounds were announced in August. The calendar was dominated by WordCamp US and the 7.1 release, and the WP Engine case was still awaiting a decision on the motions to dismiss.

WordPress Core Updates

• WordPress 7.1 “Mary Lou” (August 19): Named for jazz pianist and composer Mary Lou Williams, 7.1 adds responsive controls so blocks can be styled per screen size without custom CSS, with breakpoints definable in theme.json. A new media editor modal handles cropping, rotation and metadata, and image compression and resizing now run in the browser using a WebAssembly build of libvips, with support for AVIF, HEIC and HDR gain maps. Notes can now be attached anywhere in content and support rich text and @mentions. New Playlist and Tabs blocks, interactive Button states, a public SVG Icon API and a fully iframed post editor round out the release. More than 800 people contributed, over 170 of them for the first time.
• Release squad: Anne McCarthy led the release, with Benjamin Zekavica and Krupa Nanda on coordination and Aki Hamano and Joe Dolson as tech leads.
• Release candidates: RC1 arrived on August 5, and later candidates picked up the month’s security fixes ahead of launch.
• WordPress 7.0.3 (August 6): A security release with 12 fixes, including a pre-authentication reflected XSS on the login screen, a multisite privilege escalation, several Contributor+ stored XSS issues and a server-side request forgery in URL validation. Reporters included pwn.ai, Aikido Security and Anthropic.
• WordPress 7.0.4 (August 12): A single-issue release fixing authenticated Author+ remote code execution through malicious uploads on servers using Imagick and Ghostscript, reported by pwn.ai. John Blackbourn led both 7.0 releases.
• WordPress 7.2 planning: On August 12, the core team issued a call for volunteers for 7.2, the final major release of 2026, proposed for early December.

Other WordPress News

• WordCamp US 2026: More than 1,100 people registered for the four days at the Phoenix Convention Center, according to the official recap, with thousands more on the livestreams. Contributor Day drew 425 participants in 26 teams, and the program ran more than 50 sessions across four tracks.
• Phoenix WordPress Day: Before Matt Mullenweg’s closing session with Robert Jacobi, the city’s Chief Innovation Officer read a proclamation from Mayor Kate Gallego naming August 19 Phoenix WordPress Day.
• Mullenweg’s message: Mullenweg said he wants WordPress known for simplicity, showed “Piplets,” a concept for a single self-modifying PHP file that stores its own data, announced short w.org/@username profile links, and questioned whether Five for the Future pledges reflect real contribution. He also suggested the plugin directory should favour fewer plugins that work better.
• Showcase Day: The Ankler described moving 15 newsletters to WordPress, and Daily Kos walked through migrating 1.5 million posts, 88 million comments and 2.7 million users.
• WordPress Browser Extension: On August 13, WordPress.org released an open source extension for Chrome, Chromium browsers and Safari on macOS that lets logged-in users hide the admin bar while keeping its shortcuts in the browser toolbar.
• Open weight AI letter: On August 27, Executive Director Mary Hubbard announced that WordPress had signed the Open Weights and American AI Leadership letter, which asks US policymakers not to impose early restrictions on open weight models. More than 270 organisations have signed.
• Upcoming events: The recap pointed ahead to State of the Word, WordCamp Asia 2027 in Penang, Malaysia (April 9–11, 2027), and WordCamp Europe 2027 in Málaga.

Security Alerts and Plugin Vulnerabilities

• Elementor Pro file upload: CVE-2026-32475 (CVSS 9.8) allowed unauthenticated PHP file uploads in Elementor Pro 4.2.1 and earlier, on sites with a published form that includes an optional File Upload field. Elementor patched it in 4.2.2 on August 19.
• WPMU DEV Dashboard bypass: CVE-2026-76581 (CVSS 9.8) could give an unauthenticated visitor an administrator session on connected sites using Hub single sign-on. Version 5.0.2, released August 24, fixes it.
• BdThemes supply chain compromise: Wordfence warned that a poisoned remote JSON feed used for admin banners in the BdThemes ecosystem was injecting malicious scripts into administrators’ browsers, which can lead to rogue admins and webshells. Plugin files were untouched, so affected sites need to audit for signs of compromise.
• TranslatePress account takeover: CVE-2026-19632 (CVSS 9.8) could leak administrator password reset links to unauthenticated users in TranslatePress 3.3.1 and earlier under certain settings.
• Cooldown under the microscope: Patchstack published an analysis showing that 81 releases fixing known CVEs, across 79 plugins with about 9.9 million combined installs, passed through the update hold in the 17 days after it was shortened in mid-July. It argued that confirmed security fixes should be fast-tracked.

Industry Trends and Insights

• Back to a fast cadence: Shipping 7.1 three months after 7.0, with 7.2 already planned for December, confirms WordPress is back to three major releases a year.
• AI firms are finding core bugs: Anthropic and AI security startup pwn.ai were among the credited reporters in August’s security releases, a sign that AI-assisted auditing has become part of how WordPress gets tested.
• Taking a policy position on AI: Signing the open weight letter puts the WordPress project on record in favour of open models, consistent with its argument that open source and security are not in conflict.
• Enterprise migrations keep coming: Daily Kos and The Ankler joined CERN as high-profile 2026 moves to WordPress, both citing ownership of content and audience data.

Theme of the Month: Astra

Astra, from Brainstorm Force, is one of the most widely installed WordPress themes and a common base for agency and WooCommerce builds. With 7.1 making the post editor fully iframed for every theme, large established themes like Astra were where many site owners first noticed the editor matching the front end more closely.

Plugin of the Month: Patchstack

Patchstack pairs a lightweight plugin with virtual patching rules that block exploits before a vendor fix is installed. Its August data on how the update hold delays security patches made it one of the most useful voices in the Protect The Shire debate, and its protection covers exactly the gap it described.

Host of the Month: Bluehost

Bluehost is one of the five Global Partners funding the 2026 WordPress event season, including WordCamp US, and was among the companies credited for coordinating July’s 7.0.2 security release. Its support for flagship events and core security work made it a natural pick for the month WordPress 7.1 shipped.

Founder of the Month: Markos Moulitsas

Markos Moulitsas founded Daily Kos, whose move to WordPress was one of the standout case studies at WordCamp US. Migrating 1.5 million posts, 88 million comments and 2.7 million users, with a public beta involving more than 500 community members, showed that WordPress can absorb one of the largest community publishing sites on the web.

Looking Ahead to September 2026

With 7.1 out, attention turns to the first 7.1 maintenance release and the formation of the WordPress 7.2 release squad, along with its roadmap and new default theme. A ruling on the motions to dismiss in WP Engine v. Automattic is still pending, and the Plugins Team is expected to keep refining how the update hold and automated review handle security releases.