WordPress News Roundup June 2026: WordCamp Europe in Kraków and the Protect The Shire Update Cooldown

June 2026 was the first full month of the WordPress 7.0 era, and it was dominated by two things: the community gathering in Kraków and a sharp turn toward supply chain security. WordCamp Europe brought more than 2,400 people to Poland, where CERN confirmed that its flagship site now runs on WordPress. A day later, Matt Mullenweg launched Protect The Shire, an initiative that holds every new plugin and theme release for up to 24 hours before it reaches sites through auto-updates.

Behind those headlines, a critical UpdraftPlus flaw put millions of backup-enabled sites at risk, attackers went after Gravity SMTP and Everest Forms Pro, and the WordPress 7.1 release squad was named with an August launch at WordCamp US in view.

Mergers, Acquisitions, and Investments

No significant WordPress acquisitions or funding rounds were confirmed in June. The business story of the month was legal rather than financial: in WP Engine v. Automattic, the hearing on Automattic’s motion to dismiss WP Engine’s antitrust claims, and on WP Engine’s motion to dismiss the counterclaims filed by Automattic, WooCommerce and the WordPress Foundation, was moved to June 25 in the Northern District of California. A ruling had not arrived by month’s end.

WordPress Core Updates

There was no new core release in June. WordPress 7.0 “Armstrong”, released on May 20, kept spreading quickly, and the focus moved to planning WordPress 7.1.

• Fast 7.0 adoption: In his Protect The Shire post, Mullenweg noted that more than half of WordPress sites had moved to 7.0 within two weeks of release, crediting hosts, developers and the push to make upgrades happen automatically.
• WordPress 7.1 release squad: On June 17, the core team announced the 7.1 squad. Anne McCarthy leads the release, with Benjamin Zekavica and Krupa Nanda on coordination and Aki Hamano and Joe Dolson as tech leads. A June 19 roadmap post set the release for August 19, the final day of WordCamp US.
• Classic block proposal: A June 23 dev note proposed hiding the Classic block from the block inserter in 7.1, the first step toward phasing it out, while keeping existing classic content editable.

Other WordPress News

Kraków set the tone for the month, and the WordPress.org news feed filled up with community programs.

• WordCamp Europe 2026: The event ran June 4–6 at the ICE Kraków Congress Centre with 2,458 ticket holders from 81 countries, nearly a quarter of them first-timers. The official recap lists 49 talks and eight workshops covering WordPress 7.0, the Abilities API, the HTML API, Playground and AI.
• CERN goes live: The opening keynote from CERN’s Joachim Valdemar Yde and Francisco Borges Aurindo Barros explained why the birthplace of the web chose WordPress. Yde announced that home.cern is now live on WordPress, with the rest of CERN’s sites to follow over the coming months.
• Closing fireside chat: Executive Director Mary Hubbard talked with Matías Ventura, the 7.0 release lead, and Rich Tabor about AI in the design system, WP-CLI, Studio Code and desktop-mode experiments. Hubbard also announced that Kraków University of Technology will begin a WordPress course in October.
• Next stop Málaga: WordCamp Europe 2027 will take place in Málaga, Spain, from May 27 to 29, 2027.
• Plugins Team grows: The Plugins Team added three reviewers and reopened applications for a second cohort, closing June 26, as plugin submissions hit new records.
• Community programs: WordPress.org recapped support from its five Global Partners (Jetpack, WordPress.com, WooCommerce, Bluehost and Hostinger), opened the Kim Parsell Memorial Scholarship for WordCamp US, relaunched the Mercantile swag store, and celebrated about 40 students as the first AI Leaders Micro-Credential graduates in Chicago on June 23.

Security Alerts and Plugin Vulnerabilities

June’s biggest security change was a policy, not a patch, but several widely used plugins also needed urgent updates.

• Protect The Shire: On June 5, Mullenweg announced that new plugin and theme releases would wait up to 24 hours before being distributed through auto-updates, giving reviewers and automated tools time to inspect changes. He pointed to supply chain attacks on npm, PyPI, GitHub and RubyGems, April’s Essential Plugin backdoor and fast-improving AI coding ability, and said the window could shrink as the process matures.
• UpdraftPlus authentication bypass: CVE-2026-10795 (CVSS 8.1) let unauthenticated attackers forge signed remote commands and run them with administrator rights on sites running UpdraftPlus 1.26.4 or earlier. Fixes shipped in 1.26.5 (free) and 2.26.5 (premium), and SiteGround force-updated vulnerable copies across its hosted sites on June 11.
• Gravity SMTP under attack: An unauthenticated information disclosure in Gravity SMTP (CVE-2026-4020) exposed API keys, OAuth tokens and mail provider credentials through an open REST endpoint. Wordfence reported blocking more than 17 million attempts, with a spike on June 7. Version 2.1.5 fixes it, but exposed credentials should also be rotated.
• Everest Forms Pro takeovers: Attackers continued exploiting CVE-2026-3300 (CVSS 9.8), a code injection flaw in the plugin’s calculation feature, to create rogue administrators. It was patched in 1.9.13 in March, so any site still on 1.9.12 or older should be checked for unknown admin accounts.

Industry Trends and Insights

• Market share keeps slipping: W3Techs put WordPress at 41.5% of all websites in June, down from a peak of 43.6% in early 2025, while HTTP Archive’s crawl put it at about 33%. The datasets differ, but the direction is the same.
• Security becomes infrastructure: Protect The Shire marks a shift from trusting developers to publish instantly toward platform-level review of every release. The trade-off between blocking malicious updates and delaying legitimate security fixes will shape the debate for months.
• Enterprise credibility: CERN’s move, with automated migration of content into blocks and a shared distribution across hundreds of sites, is one of the strongest public endorsements of WordPress for large institutions in years.
• AI is changing both sides of security: Mullenweg framed AI as a threat and an opportunity at once, arguing that deep automated review of 78,000 plugins and themes is now “a matter of time and tokens.”

Theme of the Month: Twenty Twenty-Five

With more than half of all WordPress sites on 7.0 within weeks, Twenty Twenty-Five remained the default block theme most new sites met first. It is the easiest way to explore 7.0’s new blocks, design tools and redesigned admin without a third-party theme getting in the way.

Plugin of the Month: Wordfence

Wordfence was at the centre of June’s security news, publishing details of the UpdraftPlus flaw, tracking the Gravity SMTP attack wave and pushing firewall rules to its users. In a month when attackers moved within hours of disclosure, a firewall that blocks known exploits before every site has updated earned its place.

Host of the Month: SiteGround

SiteGround stood out by force-updating the vulnerable UpdraftPlus plugin across every hosted site still running an affected version on June 11, rather than waiting for customers to act. It was a clear example of how managed hosts can close the gap between a patch and real-world protection.

Founder of the Month: Rich Tabor

Rich Tabor, who founded the CoBlocks block collection before it became part of GoDaddy, has long been one of the most visible product voices behind the block editor. In Kraków he joined Mary Hubbard and Matías Ventura for the closing fireside chat on where WordPress design and AI tooling go next, a fitting role for a founder who has spent years shaping how people build with blocks.

Looking Ahead to July 2026

July should bring the first WordPress 7.1 beta, with responsive styling and collaboration improvements on the roadmap and real-time collaboration still unresolved. Watch for adjustments to the Protect The Shire cooldown as the Plugins Team responds to developer feedback, and for a ruling on the motions to dismiss in the WP Engine case. WordCamp US in Phoenix, August 16–19, is the next big date on the calendar, with Kim Parsell scholarship applications open now.