Behind the headline release, the month brought critical plugin patches, a major brand consolidation in the hosting space, and growing pressure on the ecosystem around supply chain security and AI infrastructure governance.

Mergers, Acquisitions, and Investments

May 2026 brought no new acquisitions, but one of the most significant brand restructurings in WordPress hosting history did.

• StellarWP Brand Dissolved: Liquid Web officially retired the StellarWP brand on April 22, with product redirects going live on May 12. The entire plugin portfolio, including LearnDash, Kadence, GiveWP, The Events Calendar, SolidWP, Restrict Content Pro, IconicWP, and MemberDash, was collapsed into four core products under Liquid Web by Nexcess. The rollout was rocky, with customers reporting missing pages, license issues, and login problems across multiple product sites.

• Envato Ends Exclusive Author Model: Envato announced on May 13 that all ThemeForest and CodeCanyon sellers will move to a flat 50% revenue share from July 1, 2026. Top exclusive authors who previously earned up to 87.5% per sale are the worst affected. The move is accelerating migration toward direct sales channels and independent product businesses across the WordPress theme and plugin community.

WordPress Core Updates

May 2026 delivered the biggest WordPress release in years alongside a fast-follow maintenance update.

• WordPress 7.0 “Merryl” Released on May 20: The headline release of 2026 officially launched at 17:00 UTC on May 20. It introduced the AI Connectors screen under Settings, natively supporting OpenAI, Anthropic (Claude), and Google (Gemini). DataViews replaced the classic admin list tables across posts, pages, and media. The navigation overlay, visual revisions, patterns as single blocks, the Icon Block, viewport-based block visibility controls, and the Font Library for all themes are all shipped in this release. The admin received its most visible redesign in years with a new color scheme and page fade transitions.

• Real-Time Collaboration Removed: On May 8, Matt Mullenweg made the decision to pull real-time collaboration from the 7.0 scope after race conditions, fuzz testing failures, and server memory issues under concurrent load were identified. The feature will be reconsidered for a future release cycle.

• WordPress 7.0 Beta on WordPress.com: Between April 12 and May 20, WordPress.com offered the 7.0 beta to Business and Commerce plan users. The rollout helped surface compatibility issues before the public launch.

Other WordPress News

May was defined by the WordPress 7.0 launch, WordCamp Europe preparations, and a growing conversation around AI infrastructure security.

• WordPress 7.0 AI Key Security Concern: Following the 7.0 launch, a security researcher flagged that AI provider credentials stored in the new Connectors screen could be exposed to attackers. The concern centered on how API keys are stored and accessed within the new infrastructure layer. No official patch was confirmed publicly by the month’s end.

• WordPress.com Opens Plugins to All Paid Plans: From May 1, all paid WordPress.com plans, including Personal, gained access to 50,000+ plugins from the WordPress Plugin Directory. Previously limited to higher-tier plans, the change significantly expanded what lower-tier WordPress.com users could do with their sites.

• CERN Migrating 1,000+ Sites to WordPress: After evaluating 100 CMS platforms, CERN chose WordPress for its full web migration. CERN engineers are set to open WordCamp Europe 2026 in Krakow on June 4, marking a significant milestone for the platform’s credibility at the enterprise and scientific research level.

• WooCommerce x YouTube Shopping: Google for WooCommerce launched an integration that enables merchants to sell directly on YouTube, connecting WooCommerce stores to 2.7 billion YouTube shoppers. The extension is available from the WooCommerce Marketplace.

• WordPress 7.1 Development Underway: With 7.0 shipped, the core team turned its attention to WordPress 7.1, officially targeted for August 19, 2026, aligned with WordCamp US in Phoenix. Real-time collaboration, the iframed post editor, advanced connector filtering, and DataViews extensibility are all scoped for 7.1. WordPress 7.2 is scheduled for December 2026, with native multilingual support on the roadmap.

• WordPress AI Experiments 0.9.0 Released: The WordPress AI team shipped AI Experiments 0.9.0 ahead of the 7.0 launch, adding comment moderation and content generation experiments. Version 1.0 is being targeted for the 7.1 development cycle.

• WordCamp US 2026 Tickets Live: WordCamp US 2026 is confirmed for Phoenix, Arizona, from August 16 to 19. Ticket registration opened this month ahead of the event, which will serve as the anchor for the WordPress 7.1 release.

Security Alerts and Plugin Vulnerabilities

May closed with critical patches across several widely used plugins and ongoing supply chain concerns following April’s incidents.

• Convert Plus Critical Vulnerability: A critical, unauthenticated administrator-creation flaw was patched in Convert Plus, scoring a perfect 10.0 CVSS. An attacker could create a full admin account without any login credentials. Patched in version 3.4.3.

• Burst Statistics Authentication Bypass: A critical authentication bypass was patched in Burst Statistics, scoring 9.8 on the CVSS scale. Sites running outdated versions were at immediate risk of unauthorized access.

• Avada Builder SQL Injection: A SQL injection vulnerability was patched in Avada Builder, affecting over 1 million active installations. The flaw allowed attackers to extract data from the site’s database.

• MonsterInsights OAuth Token Theft: A vulnerability allowing OAuth token theft was patched in MonsterInsights, affecting over 3 million active installations. The flaw could allow attackers to gain unauthorized access to connected Google Analytics accounts.

• AI API Key Exposure Post-7.0: Following the WordPress 7.0 launch, security researchers flagged a structural concern around how AI provider API keys are stored in the new Connectors screen. No active exploits were confirmed, but site owners using the Connectors feature were advised to review their key storage practices.

Industry Trends and Insights

May 2026 confirmed two things clearly. AI is no longer a side feature in WordPress; it is becoming foundational infrastructure. And the plugin ecosystem’s security and governance model is under more pressure than ever.

• AI Is Now Core Infrastructure: The Connectors screen and WP AI Client in WordPress 7.0 are being called the most consequential infrastructure addition the platform has shipped in years. For the first time, AI provider credentials are managed at the platform level rather than the plugin level, changing how developers build AI-powered features on WordPress.

• Plugin Supply Chain Risk Growing: Following April’s Essential Plugin and Smart Slider 3 Pro attacks, May’s critical patches in MonsterInsights and Avada confirmed that plugin security is a systemic issue. The ecosystem lacks standardized ownership-transfer review or code-signing requirements, leaving millions of sites exposed to attacks delivered through trusted update channels.

• Hosting Consolidation Accelerating: The StellarWP dissolution and Envato model change both point to a market restructuring around fewer, larger players. Independent plugin and theme developers are responding by moving toward direct sales, SaaS models, and platform-agnostic distribution.

• WordPress Market Share Debate Intensifying: A Search Engine Journal report flagged that over 10% of WordPress sites appear abandoned, raising questions about active market share versus total install base. Astro downloads hitting 2.5 million per week added fuel to the conversation about whether newer frameworks are beginning to draw developers away from the edges.

• WordPress Returning to Three-Release Cadence: WordPress 7.0 in May, 7.1 in August, and 7.2 in December confirms the platform is back to a three-release-per-year schedule after shipping only two major releases in 2025. The faster cadence signals renewed momentum in the core development team.

Theme of the Month: Templately

Templately is an AI-powered template cloud for WordPress that works with both Elementor and Gutenberg. It gives users access to 6,500+ ready-made templates across a wide range of niches, with one-click full site import and a built-in AI content generator.

Teams can save designs to the cloud and collaborate through shared workspaces, making it a practical tool for agencies managing multiple client builds. With 400,000+ active installations and a freemium model, it fits both solo users and larger teams looking to speed up site delivery.

Plugin of the Month: Weglot

Weglot makes it easy to translate a WordPress site into 110+ languages without any coding. It automatically detects all site content, runs it through DeepL, Google Translate, and its own AI language model, and delivers multilingual SEO out of the box, including hreflang tags, translated URLs, and metadata.

Trusted by 110,000+ websites globally, Weglot is fully compatible with WooCommerce, Elementor, and Yoast SEO. A free plan is available for smaller sites, with paid plans scaling based on word count and number of languages needed.

Agency of the Month: Seahawk Media

Seahawk Media is a full-service WordPress agency offering development, design, maintenance, security, and white-label services for businesses and agencies worldwide. Their team handles everything from custom builds and WooCommerce development to hacked site repair and ongoing site care.

For agencies looking to scale without growing their internal team, Seahawk’s white-label program lets partners resell WordPress services under their own brand. Their broad service range and deep WordPress focus make them a dependable partner for high-volume client work.

Host of the Month: HostWP

HostWP is a managed WordPress hosting provider built on LiteSpeed Enterprise servers with NVMe SSD storage, Redis Object Cache, and a global CDN covering 83+ locations. Every plan includes business email, domain registration, and premium plugins at a flat monthly price with no traffic overage charges.

Free site migration is included, and the team is available 24/7 for support. PHP 8.5 support is available across all plans, keeping sites on the latest stack with no manual configuration required.

Founder of the Month: Mark Zahra

Mark Zahra is the CEO of RebelCode, the team behind WP Mayor, WP RSS Aggregator, and Spotlight Instagram Feeds. He joined WP Mayor in 2014 as a content writer after teaching himself web development, working his way up through support and project management before taking the CEO role.

In 2026, Mark and the team launched a new chapter for WP Mayor, narrowing its focus to what matters most in WordPress and AI, and raising the editorial bar for a community navigating the fast-moving ecosystem.

Looking Ahead to June 2026

June opens with WordCamp Europe in Krakow from June 4 to 6, the community’s first major gathering since WordPress 7.0 launched. Matt Mullenweg delivers the closing keynote, and CERN engineers open the event. The conversations in Krakow will shape the direction of WordPress 7.1 and beyond.

Security governance will stay in focus following May’s critical patches and ongoing supply chain concerns. WordCamp US in Phoenix runs August 16 to 19, anchoring the WordPress 7.1 release timeline. With the three-release cadence back in place, June marks the halfway point of one of the most active WordPress years in recent memory.

Through it all, WordPress continued to move forward. AI integration deepened, block editor tooling expanded, and the community showed up in force at WordCamp Asia. The foundation for what comes next is being laid, and May 2026 is set to deliver on it.

Mergers, Acquisitions, and Investments

In April 2026, no major mergers, acquisitions, or investment announcements were recorded in the WordPress ecosystem. The month remained quiet on the deal-making front, with industry attention centered on the WordPress 7.0 release and WordCamp Asia in Mumbai.

WordPress Core Updates

April 2026 marked a historic milestone with the release of WordPress 7.0. The launch took place live at WordCamp Asia in Mumbai on April 9, making it the first major WordPress release tied directly to a community event.

• WordPress 7.0: Released on April 9 during Contributor Day at WordCamp Asia in Mumbai. The release introduced a Connectors UI dashboard under Settings → Connectors, enabling users to centrally manage external AI connections. It also enforced the iframed editor for classic themes, added viewport-based block visibility controls, and introduced per-block instance custom CSS support via the Advanced → Additional CSS sidebar control.

• WordPress 7.0.1: Released shortly after as a follow-up maintenance update to address early reported issues and improve overall stability following the major version launch.

Other WordPress News

April was one of the most active months of 2026, driven by a major community event, a significant security incident, and key platform updates.

• WordCamp Asia 2026: The event ran April 9–11 at the Jio World Convention Center in Mumbai with 2,627 attendees from over 50 countries. Contributor Day saw 1,500+ participants across 20+ contribution tables. WordCamp Asia 2027 will be held in Penang, Malaysia.

• WordPress 7.0 Release Delayed: Originally planned to launch live at WordCamp Asia on April 9, the release has been moved to May 20, 2026. The Core team cited architectural improvements needed for the real-time collaboration feature as the reason for the delay.

• Essential Plugin Supply Chain Attack: On April 7, WordPress.org permanently closed 31 plugins after a backdoor was discovered across the Essential Plugin portfolio. An attacker bought the portfolio on Flippa in 2025, planted dormant malicious code, and activated it on April 5. The malware served hidden spam only to Googlebot, making it invisible to site owners.

• Smart Slider 3 Pro Compromised: In the same week, Smart Slider 3 Pro, with over 800,000 active installations, was separately compromised through its own update infrastructure. A weaponized version was pushed through the official update channel.

• No Twenty Twenty-Six Theme: A dedicated default theme for 2026 will not be released. Efforts remain focused on the Twenty Twenty-Five theme and block editor improvements.

• Block Visibility Expanded: The Block Visibility feature now includes viewport-based controls for mobile, tablet, and desktop via CSS. Developers can control how blocks display across different screen sizes without removing them from the DOM.

• WordCamp India Announced: WordPress Executive Director Mary Hubbard formally announced a dedicated WordCamp India during the WordCamp Asia closing keynote. It marks a significant milestone for the South Asian WordPress community.

Security Alerts and Plugin Vulnerabilities

April was a rough month for WordPress security. Two supply chain attacks occurred in the same week, and critical patches were released for some of the most widely used plugins in the ecosystem.

• Essential Plugin Supply Chain Attack: 31 plugins were permanently closed on April 7 after a hidden backdoor was found across the entire portfolio. The attacker activated it on April 5, injecting spam code into wp-config.php, which was visible only to Googlebot. Updating the plugin alone did not fix it; sites needed manual server cleanup.

• Smart Slider 3 Pro: A separate attack pushed a weaponized update through the plugin’s own official update channel, hitting over 800,000 active installations in the same week as the Essential Plugin incident.

• Elementor Website Builder: A cross-site scripting vulnerability was patched in version 3.35.6. Given Elementor’s install base, sites running older versions were at high risk.

• Advanced Custom Fields (ACF): A broken access control issue was fixed in version 6.7.1. The plugin is one of the most widely used developer tools in WordPress.

• W3 Total Cache: A high-risk sensitive data exposure flaw was resolved in version 2.9.4, affecting millions of sites on shared and managed hosting.

• ManageWP Worker: A cross-site scripting issue was patched in version 4.9.32, which poses a notable risk given that the plugin is used by agencies managing large numbers of client sites.

• Ultimate Member: A privilege escalation vulnerability was disclosed, affecting over 200,000 active installations and allowing attackers to gain elevated access to affected sites.

Industry Trends and Insights

April made it clear that WordPress faces two pressing realities at once. Security governance in the plugin ecosystem has a structural problem, and AI is moving from optional to foundational across the platform.

• Plugin Governance Under Pressure: The Essential Plugin attack exposed a longstanding gap. WordPress.org has no process for reviewing ownership transfers or requiring code signing for updates. A buyer with enough money can inherit user trust overnight.

• Vulnerability Numbers Keep Rising: Plugin vulnerabilities hit record levels in 2026. Over half of the notified developers did not patch before public disclosure, putting millions of sites at risk even after issues were reported.

• WordPress Still Dominates: WordPress powers 43.4% of all websites globally and holds 60.8% of the CMS market as of April 2026. The nearest competitor, Shopify, sits at just 5.1%.

• WooCommerce and Elementor Remain Deeply Embedded: WooCommerce runs on 20% of all WordPress sites, and Elementor on 31.1%. Commerce and visual building remain the two biggest use cases driving adoption.

• Headless WordPress Growing: More teams are using WordPress as a backend content layer with React or Next.js on the frontend. Enterprise and agency projects are leading this shift.

• AI Moving from Experimental to Standard: The Abilities API from WordPress 6.9 and the Connectors UI in 7.0 are building the infrastructure for AI agents to work directly with WordPress sites. WordCamp Asia sessions confirmed that this is now a core part of the platform’s evolution.

Theme of the Month: Templately

Templately is an AI-powered template cloud for WordPress that works with both Elementor and Gutenberg. It gives users access to 6,500+ ready-made templates across a wide range of niches, with one-click full site import and a built-in AI content generator.

Teams can save designs to the cloud and collaborate through shared workspaces, making it a practical tool for agencies managing multiple client builds. With 400,000+ active installations and a freemium model, it fits both solo users and larger teams looking to speed up site delivery.

Plugin of the Month: Weglot

Weglot makes it easy to translate a WordPress site into 110+ languages without any coding. It automatically detects all site content, runs it through DeepL, Google Translate, and its own AI language model, and delivers multilingual SEO out of the box, including hreflang tags, translated URLs, and metadata.

Trusted by 110,000+ websites globally, Weglot is fully compatible with WooCommerce, Elementor, and Yoast SEO. A free plan is available for smaller sites, with paid plans that scale up based on word count and the number of languages needed.

Agency of the Month: Seahawk Media

Seahawk Media is a full-service WordPress agency offering development, design, maintenance, security, and white-label services for businesses and agencies worldwide. Their team handles everything from custom builds and WooCommerce development to hacked site repair and ongoing site care.

For agencies looking to scale without growing their internal team, Seahawk’s white-label program lets partners resell WordPress services under their own brand. Their broad service range and deep WordPress focus make them a dependable partner for high-volume client work.

Host of the Month: HostWP

HostWP is a managed WordPress hosting provider built on LiteSpeed Enterprise servers with NVMe SSD storage, Redis Object Cache, and a global CDN covering 83+ locations. Every plan includes business email, domain registration, and premium plugins at a flat monthly price with no traffic overage charges.

Free site migration is included, and the team is available 24/7 for support. In February 2026, HostWP also rolled out PHP 8.5 support across all plans, keeping sites on the latest stack with no manual configuration required.

Founder of the Month: Mark Zahra

Mark Zahra is the CEO of RebelCode, the team behind WP Mayor, WP RSS Aggregator, and Spotlight Instagram Feeds. He joined WP Mayor in 2014 as a content writer after teaching himself web development, working his way up through support and project management before taking the CEO role.

In 2026, Mark and the team launched a new chapter for WP Mayor, narrowing its focus to what matters most in WordPress and AI, and raising the editorial bar for a community navigating the fast-moving ecosystem.

Looking Ahead to May 2026

The biggest moment in May is the WordPress 7.0 release, officially scheduled for May 20. All eyes will be on how the real-time collaboration feature performs after months of architectural rework to stabilize it before launch.

Security governance will stay in focus following April’s supply chain attacks, with growing pressure on WordPress.org to address how plugin ownership transfers are handled. WordCamp Europe is also approaching, giving the community a major gathering point as the 7.0 era begins.

For more such WordPress-related news, visit WPEdition.

At the same time, the community prepared for a historic moment: the upcoming WordPress 7.0 release, set to launch live in Mumbai. Alongside this, platform updates, policy shifts, and steady market growth showed that WordPress continues to evolve, even as security and reliability take center stage.

Mergers, Acquisitions, and Investments

March saw limited activity across mergers and acquisitions, with only one notable deal in the WordPress ecosystem. There were no major funding announcements or multi-company movements during the month, as industry focus remained on product development and the WordPress 7.0 release cycle.

WP Engine Acquires WPackagist

WP Engine announced its acquisition of WPackagist, a widely used Composer repository that allows developers to install and manage WordPress plugins and themes within modern PHP workflows. Originally created by Outlandish, the service has become a core part of many professional development setups.

Under WP Engine’s ownership, WPackagist will continue to operate as a free and publicly accessible service. The move reflects a growing emphasis on maintaining essential developer infrastructure within the WordPress ecosystem, especially as more teams adopt Composer-based project management workflows.

WordPress Core Updates

Last month worked quickly to protect sites and fix issues without disrupting user experience.

Developers handled a rare “triple-update” cycle, moving fast to patch vulnerabilities and stabilize the platform. The editor experience stayed smooth, while critical backend fixes ensured sites remained secure and functional.

• WordPress 6.9.2: Released on March 10 as a major security update. It fixed high-risk issues like blind SSRF, stored XSS in navigation menus, and an AJAX authorization bypass. This update was essential to protect sites from serious attacks.

• WordPress 6.9.3: Released just hours later as a fast follow-up. It fixed a critical bug from 6.9.2 that caused white screens on some sites due to theme template loading issues. This ensured sites could load properly again.

• WordPress 6.9.4: Released on March 11 to complete the security fixes. The Core team identified gaps in earlier patches, and this version finalized the system’s hardening to keep WordPress fully secure.

These updates may feel invisible on the surface, but they play a big role. Sites stay stable, the editor runs smoothly, and developers can work without worrying about security risks or sudden breakages.

Other WordPress News

March 2026 brought a mix of major community moments, important platform shifts, and ecosystem-wide updates. While core focused on stability, the broader WordPress space saw strong movement in events, security, and platform growth.

• WordCamp Asia 2026: The upcoming WordCamp Asia (9 April – 11 April) in Mumbai became a key highlight this month. WordPress 7.0 is set to launch live during Contributor Day, marking a historic first. The event also introduced scholarships and a culturally meaningful mascot, showing a stronger push toward inclusivity and regional representation.

• Plugin Security Wave: A large number of popular plugins, including Elementor, Yoast SEO, and WPForms, have released important security patches. These updates fixed serious issues such as unauthorized access and data exposure, reminding site owners to stay up to date.

• WordPress.com Platform Update: WordPress.com expanded flexibility by allowing themes and plugins across all paid plans. This removes a major limitation and gives users more control over how they build and scale their websites.

• AI Guidelines Introduced: New guidelines were introduced to manage AI-generated code in the plugin ecosystem. The focus is on transparency and human oversight to help maintain quality as AI usage continues to grow.

Security Alerts and Plugin Vulnerabilities

March was a high-alert month for WordPress security. Multiple critical plugin vulnerabilities surfaced, impacting millions of websites and reinforcing the need for faster updates and stronger monitoring.

• Critical Plugin Vulnerabilities: Several high-risk flaws were discovered in popular plugins, allowing attackers to take full control of websites. Plugins like User Registration (WPEverest) and WPvivid Backup & Migration exposed sites to serious threats like unauthorized admin access and remote takeovers without login credentials.

• Authentication and Access Bypass Issues: Some plugins, including Tutor LMS Pro and Modular DS, experienced issues allowing attackers to bypass login systems or escalate privileges. In some cases, these vulnerabilities were already being actively exploited, making immediate updates essential.

• Major Plugin Security Patches: Leading plugins such as Yoast SEO, Elementor, WPForms, and Really Simple Security released urgent updates. These fixes addressed risks such as stored XSS, data exposure, and broken access controls, affecting millions of active installations.

• Supply Chain and Hidden Threats: A few cases went deeper than typical bugs. Smart Slider 3 Pro faced a supply-chain attack where a compromised version of the plugin included malicious code. This highlights risks beyond just plugin usage, extending to how software is distributed.

• File Upload and Deletion Risks: Plugins like Ninja Forms and Perfmatters addressed vulnerabilities that allowed attackers to upload or delete files without proper checks. These types of flaws can quietly damage a site without immediate detection.

Industry Trends and Insights

March exposed how fast and large-scale WordPress security risks have become. Critical vulnerabilities affected millions of sites, underscoring that security gaps cannot be addressed with delayed updates or basic checks.

Most issues came from plugins, not core. High-install plugins introduced risks like admin access takeover and sensitive data exposure. Attack windows are shrinking, with some flaws being exploited almost immediately.

Supply-chain incidents also showed that even trusted plugins can turn into entry points. Security now demands constant monitoring, fast patching, and stricter control over plugin usage.

Theme of the Month: Spectra

Spectra stands out for its strong integration with the block editor and its focus on building modern, flexible websites. It extends Gutenberg with powerful design blocks, making it easier to create advanced layouts without relying on heavy page builders.

What makes Spectra especially relevant is its balance between performance and design control. Users can build visually rich pages while keeping sites fast and lightweight. As more users shift toward native block editing, Spectra fits naturally into that workflow and helps simplify the overall site-building experience.

Plugin of the Month: accessiBe

accessiBe continues to gain attention as website accessibility becomes more important. It helps site owners make their websites more usable for people with disabilities without needing big technical changes. This makes compliance and inclusivity easier to manage.

As regulations and awareness grow, tools like accessiBe are becoming essential rather than optional. It allows businesses to quickly improve accessibility, helping them reach a wider audience while reducing legal risks.

Agency of the Month: Seahawk Media

Seahawk Media remains a reliable choice for businesses that need full WordPress support. From development to maintenance and security, their wide service range helps brands manage everything in one place. Their focus on ongoing site care makes them especially relevant in a security-heavy month.

They also offer scalable solutions for agencies through white-label services, making it easier to handle more clients without increasing internal workload. This flexibility keeps them competitive in a fast-moving market.

Host of the Month: InMotion Hosting

InMotion Hosting stands out for its strong performance and dependable infrastructure. It offers solid speed, uptime, and support, making it a good fit for growing websites. For users looking for stability and scalability, it remains a trusted hosting option.

Its focus on performance optimization and customer support adds extra value for businesses that rely on consistent uptime. As hosting plays a bigger role in security and speed, providers like InMotion remain relevant.

Founder of the Month: Ben Gillbanks (Pro Theme Design)

Ben Gillbanks is a long-time contributor to the WordPress theme ecosystem and the founder of Pro Theme Design. He is known for creating clean, user-friendly themes that focus on simplicity, accessibility, and performance without unnecessary complexity.

His work reflects a practical approach to WordPress design. Instead of overloading features, he focuses on building themes that are easy to use and reliable. In a time when performance and usability matter more than ever, his approach remains relevant for users who want straightforward, well-built WordPress experiences.

Looking Ahead to April 2026

April 2026 is set to be a defining month with the expected release of WordPress 7.0. The community will closely watch how the new version performs, especially around stability, editor experience, and AI-related features introduced during the beta cycle.

Security will remain a key focus. With recent vulnerabilities highlighting faster attack cycles, developers and site owners will need to stay alert and test updates early. All eyes will also be on WordCamp Asia in Mumbai, where the global community will come together during a major moment for WordPress.

The month also welcomed the WordPress community at WordCamp Pune, introduced AI-native editing on WordPress.com, and closed with a sobering security whitepaper from Patchstack that reframed how the ecosystem must approach plugin safety.

Developers saw meaningful progress on block enhancements, UI primitives, and Playground tooling, signaling a productive lead-up to WordPress 7.0’s scheduled April release.

Mergers, Acquisitions, and Investments

In February 2026, there were no major mergers, acquisitions, or investment announcements in the WordPress ecosystem. The month was largely quiet on the deal-making front, with industry attention focused instead on the accelerating pace of AI integration and the lead-up to the WordPress 7.0 release.

On the product side, WP Engine launched Newsroom on February 3, a platform purpose-built for editorial teams that need structured content workflows at scale.

The launch reinforces WP Engine’s strategy to expand beyond managed hosting into full digital experience solutions, following its earlier acquisition of BigBite.

WordPress Core Updates: Refinement and Evolution in February 2026

February 2026 kept the Core team busy on two fronts: closing out the 6.x maintenance cycle with a stability release and advancing the 7.0 beta cycle with meaningful new features.

WordPress 6.9.1 Maintenance Release

February opened with the release of WordPress 6.9.1 on February 3, 2026. The maintenance update addressed 49 bug fixes across Core and the Block Editor, delivering stability improvements expected by the community ahead of the 7.0 cycle.

WordPress 7.0 Beta 2

WordPress 7.0 Beta 2 was released on February 26, 2026, containing more than 70 updates and fixes across the Editor and Core since the Beta 1 release. The scheduled final release date for WordPress 7.0 remains April 9, 2026.

A notable addition in Beta 2 is a new Connectors UI dashboard page that makes AI provider management more intuitive. WordPress users can now manage external AI connections in a central place in wp-admin, under Settings → Connectors, enabling them to add, delete, and update external connections through an extensible, route-based architecture.

Block authors should also be aware that WordPress 7.0 enforces the iframed editor for classic themes when all blocks use Block API version 3. Gutenberg 22.6, released on February 25, will also be enforced in WordPress 7.0.

Developer Highlights

The developer roundup for February 2026 covered several key features landing in WordPress 7.0: an always-iframed post editor regardless of Block API version, viewport-based block visibility controls, and per-block instance custom CSS support via the Advanced → Additional CSS sidebar control.

The WordPress UI package also received significant updates, including new dropdown and tooltip components, standardized button elements, and form-field building blocks, all aimed at helping developers build more consistent and accessible interfaces.

Other WordPress News

Beyond core development, February delivered a standout product launch, a thriving community event in India, and a policy update that opens new doors for theme authors.

WordPress AI Assistant Launches on WordPress.com

On February 17, 2026, WordPress.com introduced the WordPress AI Assistant, available at no extra cost to sites on Business or Commerce plans. Unlike standalone AI tools, it works inside the editor and Media Library, understanding content and layout to take action directly where users are already building.

The assistant supports site-wide design and layout changes, content editing and refinement, and AI-powered image generation and editing in the Media Library using the latest Nano Banana models.

WordCamp Pune 2026

WordCamp Pune 2026 took place on February 8, 2026, at MCCIA Trade Tower, SB Road, Pune, drawing over 300 attendees. The event followed its signature “Only Workshops” conference format, featuring six two-hour hands-on workshops led by multiple facilitators throughout the day.

AI-Generated Images Now Allowed in Theme Directory

The WordPress Themes Team confirmed during its January 27 meeting that AI-generated images may be bundled with themes in the directory, provided they are explicitly disclosed and licensed in a GPL-compatible way. This signals a maturation in how the community is approaching AI-assisted development.

Security Alerts and Plugin Vulnerabilities

Stay informed about potential risks so you can quickly address vulnerabilities and keep your WordPress site protected from emerging threats.

Critical RCE in WPvivid Backup and Migration Plugin (CVE-2026-1357)

A critical vulnerability in the WPvivid Backup & Migration plugin, installed on more than 900,000 websites, was publicly disclosed in February 2026. Tracked as CVE-2026-1357 with a CVSS score of 9.8, it can be exploited to achieve remote code execution by uploading arbitrary files without authentication.

Researchers at Defiant noted that only sites with the non-default “receive backup from another site” option enabled are critically impacted, and that attackers have a 24-hour window to exploit it using a generated key.

A security update addressing the flaw was released in version 0.9.124 on January 28, 2026, adding RSA decryption checks, filename sanitization, and restricted file type uploads. All WPvivid users should immediately upgrade to v0.9.124 or later.

Patchstack State of WordPress Security 2026 Whitepaper

Patchstack released its State of WordPress Security in 2026 whitepaper on February 25, revealing that 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, a 42% increase compared to 2024. Of these, 91% were found in plugins, and the weighted median time to mass exploitation for heavily targeted vulnerabilities was just 5 hours.

The whitepaper also found that traditional host defenses blocked only 26% of total vulnerability attacks in large-scale pentesting studies, and that 46% of vulnerabilities did not receive a patch by the time of public disclosure. Site owners should prioritize automated virtual patching solutions and regular plugin audits.

Industry Trends and Insights

In February 2026, it was confirmed that AI is no longer a peripheral feature in WordPress; it is becoming core infrastructure.

The WordPress AI Assistant, the new Connectors UI in WordPress 7.0 Beta 2, and the expanded AI Experiments plugin collectively signal that AI-native workflows are now expected at every layer of the stack.

Patchstack’s 2026 whitepaper further highlighted that vibe coding is rapidly merging with WordPress, with agencies generating plugins on demand and using AI to build React-powered frontends, expanding the attack surface far beyond core, plugins, and themes.

Security strategies must evolve accordingly, moving from periodic patching toward continuous, automated mitigation.

Theme of the Month: aThemes

aThemes, makers of the popular Sydney and Airi block themes, exemplify the direction WordPress theme development is heading in 2026.

The February confirmation that AI-generated imagery is now permitted in the WordPress theme directory opens new creative possibilities for theme authors, reducing reliance on stock photography while maintaining GPL-compliant licensing.

Their focus on clean, modern block-based designs positions aThemes well as WordPress 7.0 introduces viewport-based block visibility and per-block CSS, features that give theme authors more granular, declarative control over responsive layouts without bespoke custom code.

Plugin of the Month: Rank Math

Rank Math continues to be a standout in the WordPress SEO plugin space as AI integration becomes central to content workflows.

With the WordPress AI Assistant now capable of content generation and rewriting directly in the editor, Rank Math’s in-editor SEO analysis is a natural companion, enabling users to optimize AI-generated content for search without leaving the WordPress environment.

Rank Math’s consistent update cadence and depth of schema markup make it particularly relevant in February 2026, as publishers scale AI-assisted content operations and need structured data accuracy to maintain search visibility.

Agency of the Month: Seahawk Media

Seahawk Media remains one of the most versatile WordPress agencies in the ecosystem, offering end-to-end services spanning custom development, redesigns, hacked-site repair, speed optimization, and white-label programs that enable agencies to scale without expanding headcount.

In a month when AI tools and security vulnerabilities demanded rapid site-level responses, Seahawk’s broad managed maintenance offering, covering security checks, updates, monitoring, and performance optimization, proved particularly relevant for clients navigating the heightened disclosure and the WordPress AI Assistant rollout.

Their transparent pricing and partnerships with leading WordPress platforms continue to earn consistent recognition across industry guides.

Host of the Month: Bluehost

Bluehost remains a reliable and widely trusted choice for WordPress hosting in 2026, particularly for small businesses, bloggers, and growing online ventures.

As WordPress.com’s AI Assistant began reaching Business and Commerce plan users in February, Bluehost’s own investment in AI-assisted site-building tools reflects the broader hosting industry’s move toward intelligent, automated workflows.

Their combination of affordable entry-level pricing, one-click WordPress installation, and performance-focused infrastructure continues to make Bluehost a competitive option for users looking for dependable, scalable hosting in a consolidating market.

Founder of the Month: Matt Heaton, Founder of Bluehost

Matt Heaton founded Bluehost in 2003, building it into one of the most recognized WordPress hosting brands in the world before it was acquired by Endurance International Group (now Newfold Digital). His founding vision, affordable, accessible, reliable web hosting, established the blueprint that continues to guide Bluehost’s product strategy today.

Heaton’s legacy is particularly notable in a February defined by the role of hosting infrastructure in vulnerability defense, a recurring theme from the Patchstack whitepaper.

His emphasis on accessible hosting democratized WordPress for millions of users, and the platform he built remains a foundational layer in how those sites are protected and served today.

Looking Ahead to March 2026

WordPress 7.0 Beta 3 is expected in March, with the community focused on bug triage and final compatibility testing ahead of the April 9 release. Developers should validate blocks against Block API version 3 requirements and test against the latest Gutenberg builds to surface any iframed editor regressions early.

Security teams should expect continued high-volume vulnerability disclosures, with Patchstack’s data suggesting that even heavily patched plugins still carry risk windows measured in hours, not days. Virtual patching and proactive plugin audits remain non-negotiable best practices.

WordCamp season in India continues to build momentum following Pune’s success, and the broader community will be watching how the WordPress 7.0 Connectors UI shapes third-party AI integrations as the release cycle enters its final stretch.

From post-release improvements in WordPress 6.9 to important community conversations and evolving industry trends, January set a steady foundation for 2026. This roundup covers the key updates, decisions, and developments that shaped the WordPress ecosystem during the month.

Mergers, Acquisitions, and Investments

January 2026 recorded limited merger and acquisition activity across the WordPress ecosystem.

WP Engine acquired BigBite, expanding its capabilities in enterprise WordPress development and digital experience services. The acquisition strengthens WP Engine’s service portfolio and deepens its presence in the agency and enterprise segments.

No other major mergers, acquisitions, or investment announcements were reported during the month.

WordPress Core Updates

January focused on refinement and stability. The core team worked on tightening WordPress 6.9, improving editor consistency, and preparing the first maintenance release of the cycle.

• WordPress 6.9.1 RC1: Released on January 29, 2026, as the first Release Candidate in the 6.9 maintenance cycle, targeting bug fixes across Core and the Block Editor.

• WordPress 6.9.1 General Release: Scheduled for February 3, 2026, to address reported issues and improve overall platform stability and editor reliability.

• Editor Improvements: Developers refined block behavior, improved responsiveness inside the editor, and resolved minor UI inconsistencies to make content creation smoother and more predictable.

• Core Stability Work: Focus remained on resolving edge cases, improving performance consistency, and ensuring safer updates across installations.

• UW Theme Updates: On January 14, 2026, institutional services such as WiscWeb upgraded to WordPress 6.9 alongside coordinated theme updates to maintain compatibility and visual consistency.

Other WordPress News

January 2026 included a mix of community discussion and platform-level milestones beyond core development.

• WordPress.org X Account Controversy: The official WordPress.org account drew criticism after posting mocking and sarcastic comments about the FAIR (Federated and Independent Repository) Project. Developers and contributors widely described the post as unprofessional, with concerns increasing after several critical replies were later hidden.

• Global Language Shift: For the first time, more than 56 percent of WordPress sites are now published in languages other than English. Japanese overtook Spanish as the second most used language, underscoring WordPress’s continued global growth.

Security Alerts and Plugin Vulnerabilities

January 2026 exposed several high-severity plugin vulnerabilities that required immediate attention from site owners and administrators.

• Modular DS Connector (v2.5.2+): A critical CVSS 10.0 vulnerability allowed unauthenticated attackers to create administrator accounts. The issue was actively exploited in the wild starting mid-January, making rapid patching essential.

• WPvivid Backup & Migration (v0.9.124+): A severe CVSS 9.8 remote code execution flaw was patched on January 28. The vulnerability affected more than 900,000 sites and allowed attackers to execute arbitrary code through a faulty RSA decryption routine.

• LA-Studio Element Kit (v1.3.8+): A backdoor-style vulnerability enabled unauthenticated privilege escalation. A fix was released on January 14 for the plugin’s 20,000+ active installations.

• Quiz and Survey Master (QSM): A critical SQL injection vulnerability was disclosed in late January, impacting over 40,000 sites and exposing affected installations to data compromise risks.

These issues reinforced the importance of regular updates, active monitoring, and limiting plugin exposure across WordPress installations.

Industry Trends & Insights

January 2026 reflected clear shifts in collaboration, AI integration, performance, and eCommerce modernization.

• WooCommerce Evolution: High-Performance Order Storage (HPOS) is now the standard for WooCommerce, improving checkout speed and scalability. The fully block-based checkout experience is also driving cleaner flows and lower cart abandonment.

• Collaboration Focus: As WordPress 7.0 development progresses toward its April 2026 release, real-time collaborative editing is becoming a priority. The shift from single-author sites to multi-user workflows is shaping the next phase of the Block Editor.

• Abilities API Transition: The industry is moving away from traditional Roles and Capabilities toward the new Abilities API to manage more advanced permissions for both human users and AI systems.

• AI at the Core Level: AI is being integrated as a system-level participant. Developers are building agent-ready sites using the AI Experiments Plugin and exploring AI-generated patterns for dynamic layouts.

• Performance and Architecture: With WordPress 7.0 dropping support for PHP 7.2 and 7.3, hosting providers accelerated server upgrades. Headless implementations using Astro and Next.js continue to grow, alongside wider adoption of the Interactivity API for smoother, app-like experiences.

Theme of the Month: Kalium

Kalium continued to stand out for its clean design system and flexibility. The theme supports modern block-based layouts while maintaining strong performance and visual consistency.

It offers a wide range of ready-made demos and layout controls, making it suitable for portfolios, agencies, online stores, and corporate websites.

Its integration with WooCommerce and popular plugins adds versatility without slowing down performance. Regular updates and strong documentation also make it reliable for long-term projects.

Plugin of the Month: Orderable

Orderable gained attention for simplifying online ordering workflows, especially for WooCommerce stores. It improves how customers browse products, build orders, and complete purchases.

The plugin is designed for speed and clarity, offering features like timed slots, customizable order flows, and streamlined cart experiences. It works particularly well for restaurants, local delivery businesses, and service-based stores that depend on efficient checkout systems.

Agency of the Month: Seahawk Media

Seahawk Media remained a strong presence in the WordPress services ecosystem. The agency supports businesses with development, migrations, maintenance, white-label services, and performance optimization.

Its WordPress-specialized model allows it to deliver scalable solutions for both small businesses and enterprise clients. Strategic hosting partnerships and global delivery teams continue to strengthen its market position.

Host of the Month: Hostinger

Hostinger continued expanding its managed WordPress hosting platform with a focus on speed and simplicity. Performance enhancements and improved server infrastructure remained key priorities.

The company also invested in user-friendly tools, automated updates, and security layers to support growing websites. Its balance of affordability and performance keeps it competitive among startups, creators, and fast-scaling online businesses.

Founder of the Month: Yoni Luksenberg (Elementor)

Yoni Luksenberg is the co-founder and CEO of Elementor, one of the most widely used website builders in the WordPress ecosystem. Elementor has played a major role in shaping how users design and build WordPress sites without heavy technical overhead.

Under his leadership, Elementor expanded beyond page building into hosting, performance tools, and AI-assisted design features. As WordPress continues to balance blocks, themes, and visual builders, Elementor remains a major influence on user experience and site creation workflows.

Looking Ahead to February 2026

February 2026 is expected to focus on the general release of WordPress 6.9.1 and post-maintenance stability. Developers and site owners will likely prioritize testing, compatibility checks, and refining workflows following the first update of the year.

Work toward WordPress 7.0 is also expected to gain momentum, particularly around collaborative editing and the evolving Abilities framework. Performance improvements, PHP version upgrades, and broader adoption of modern APIs are likely to remain central themes.

Security monitoring and plugin maintenance will continue to demand attention as the ecosystem moves deeper into the new release cycle. February will likely set the pace for technical direction and platform maturity heading into the second quarter of 2026.

The release of WordPress 6.9, insights from State of the Word 2025, and a continued focus on performance and stability set the tone for what comes next.

This roundup highlights the key updates from December 2025 and explains what they mean as WordPress moves into 2026.

Mergers, Acquisitions, Investments

December 2025 remained relatively quiet for major mergers and acquisitions across the WordPress ecosystem. Most companies focused on year-end maintenance, product stability, and preparing for upcoming releases rather than large-scale corporate moves.

One notable exception stood out during the month. CloudLinux’s investment in Seahawk, strengthening its presence in the WordPress services and agency space. The investment highlighted continued interest in WordPress-focused infrastructure, support, and service-driven businesses.

Outside of this activity, attention across the ecosystem shifted toward platform updates, security improvements, and planning for the new year instead of aggressive expansion or consolidation.

WordPress Core Updates

WordPress 6.9, named “Gene,” officially launched in December 2025. The release focused on stability, performance improvements, and refinements across core features rather than introducing major new systems.

This version continued WordPress’s shift toward safer updates and long-term reliability. Many changes targeted smoother workflows, better defaults, and improved performance for everyday sites.

WordPress 6.9 also marked the end of an intensive development cycle leading up to State of the Word. With this release, the platform entered 2026 with a stronger and more predictable foundation.

Other WordPress News

December 2025 included several important developments beyond core releases. Community events, performance improvements, and platform direction updates shaped the broader WordPress landscape.

State of the Word 2025 Event

State of the Word 2025 took place in early December and set the tone for where WordPress is headed next. The keynote emphasized stability, performance, and long-term sustainability over rapid feature expansion.

The event reinforced a shift toward refining existing systems. WordPress leadership highlighted safer updates, clearer priorities, and a more mature approach to platform growth.

Performance Focus Across WordPress

Performance remained a major focus throughout December. Features like speculative loading, introduced earlier in WordPress 6.8, continued to play a key role in improving perceived load times.

Additional performance optimizations targeted themes and core output. The goal is to make WordPress sites faster by default, with fewer manual tweaks required from site owners and developers.

Security Alerts & Plugin Vulnerabilities

December 2025 brought several serious security issues across popular software and platforms. These alerts showed why regular updates and monitoring matter, especially for WordPress sites that rely on third-party tools.

Security Alerts

Several high-impact vulnerabilities were reported in core software and infrastructure tools. Some of these issues were actively exploited, making patching urgent for affected systems.

• React “React2Shell” RCE (CVE-2025-55182): A critical issue in React Server Components that allowed attackers to run code remotely without login. The flaw was actively exploited and affected multiple React versions.

• Windows MSHTML RCE (CVE-2025-36918): A zero-day bug in Microsoft Office and Outlook that attackers used in phishing emails before fixes were available.

• Apache Tika XXE/SSRF (CVE-2025-66516): A serious vulnerability that let attackers access internal systems through malicious documents if Apache Tika was not updated.

• Net-SNMP Buffer Overflow (CVE-2025-68615): A critical flaw that could crash servers or allow remote attacks through specially crafted network traffic.

• SmarterTools SmarterMail RCE (CVE-2025-52691): A file upload issue that attackers could use to place malicious files and gain control of servers.

Plugin Vulnerabilities

WordPress plugins and related software continued to be a major source of risk. Several high-severity issues required immediate updates to prevent exploitation.

• Microsoft Patch Tuesday: December updates fixed 56 security issues, including a zero-day flaw that attackers were already using to gain higher system access.

• WordPress Plugin Login Bypass Issues: Serious authentication flaws were found in WP Directory Kit and DesignThemes LMS, allowing unauthorized access.

• WordPress Plugin File Upload Flaws: Flex QR Code Generator and Starter Templates contained issues that allowed unsafe file uploads.

• Sneeit Framework Plugin RCE: A critical and actively exploited vulnerability allowed attackers to run code remotely on affected sites.

• Jenkins Security Issues: Several problems were reported in Jenkins core and plugins, including a flaw that could disrupt services.

Industry Trends & Insights

December 2025 reflected a more cautious and practical approach across industries. Businesses focused on stability, efficiency, and long-term value as market conditions and budgets tightened.

• Shift Toward Maturity: Companies moved away from experimentation and focused on strengthening systems that already deliver reliable results.

• Practical AI Adoption: AI use centered on real-world applications, stable infrastructure, and measurable outcomes rather than novelty.

• Mixed Global Economy: Growth slowed in the U.S. and parts of Europe, while India and ASEAN markets continued to show stronger momentum.

• Simpler Marketing Strategies: Tighter budgets pushed brands to reduce tools and focus on efficiency and clear returns.

• Rising Cyber Resilience Focus: Security and compliance became core business priorities tied to trust and continuity.

• Long-Term Value Mindset: Businesses prioritized reliability, efficiency, and sustainability over rapid expansion.

Theme of the Month: Uichemy

Uichemy gained attention in December 2025 for its structured design system and modern approach to building WordPress websites. The theme is built with the block editor in mind and supports flexible layouts without relying on heavy page builders.

It works well for designers, agencies, and site owners who want consistency across pages. Uichemy balances design control with performance, making it suitable for professional and content-focused sites.

Plugin of the Month: Perfmatters

Perfmatters continued to stand out as a performance-focused WordPress plugin. It helps reduce unnecessary scripts, manage assets, and improve page speed without adding complexity.

Users value Perfmatters for its lightweight design and clear purpose. Instead of adding features, it focuses on removing what slows WordPress sites down, which aligns well with performance-first strategies.

Agency of the Month: Seahawk Media

Seahawk Media remained a strong presence in the WordPress services space through 2025. The agency supports businesses with development, maintenance, migrations, security, and performance optimization.

Its global team and WordPress-only focus allow it to deliver consistent results at scale. Seahawk’s partnerships with hosting providers and brands also strengthened its position in the ecosystem.

Host of the Month: GoDaddy

GoDaddy continued to invest in its WordPress hosting offerings throughout 2025. The company focused on improving performance, security, and ease of use for managed WordPress customers.

Its tools and integrations helped simplify site management for small businesses and growing brands. GoDaddy’s scale and ongoing WordPress involvement keep it relevant across different user segments.

Founder of the Month: Matt Mullenweg (WordPress / Automattic)

Matt Mullenweg, co-founder of WordPress and founder of Automattic, remains one of the most influential figures in the WordPress ecosystem. His leadership continues to shape the platform’s direction, governance, and long-term vision.

Through WordPress and Automattic products like WordPress.com and WooCommerce, his work impacts millions of websites worldwide. His focus on openness, sustainability, and community remains central to WordPress’s growth.

Looking Ahead to January 2026

January 2026 is expected to focus on post-release stability following the launch of WordPress 6.9. Developers and site owners will likely spend the month testing updates, fixing edge cases, and preparing sites for early-year traffic.

Work on the block editor and performance improvements is expected to continue, with smaller refinements rather than major new features. Teams will likely prioritize polish, usability, and performance consistency across themes and plugins.

Security and maintenance will remain key priorities as sites settle into the new release cycle. January also sets the tone for 2026, with early signals around roadmap planning, community initiatives, and upcoming core milestones.

The month also saw fresh tools, hosting updates, and community activity that shaped how users and businesses build with WordPress.

This roundup gives you a quick look at the key highlights from November 2025 so you can stay updated on everything that happened and what it means for the weeks ahead.

Mergers, Acquisitions, Investments

November 2025 did not bring any major confirmed mergers or acquisitions within the WordPress hosting, plugin, or agency ecosystem. Most companies focused on product launches, partnerships, and year-end upgrades rather than corporate buyouts.

Key Updates Related to Investments and Product Activity

• IONOS Momentum Launch (November 11, 2025): IONOS released its new GDPR-compliant AI ecosystem for SMBs and the public sector, focusing on AI model hosting and fine-tuning.

• Yoast x Microsoft Collaboration (November 25, 2025): Yoast announced a partnership with Microsoft aimed at helping AI systems better understand open-web content, including WordPress-powered sites.

WordPress Core Updates

November 2025 was focused on final preparations for the upcoming WordPress 6.9 release. The development team pushed the release toward its final testing phase, with steady progress across key areas of the platform.

WordPress 6.9 Release Candidate 3

Release Candidate 3 (RC3) shipped on November 25, 2025. This update marked one of the final checkpoints before the full WordPress 6.9 launch, expected to coincide with the State of the Word on December 2.

Block Editor Enhancements

The block editor has received several improvements aimed at enhancing smoother workflows, improved performance, and expanded creative control for site builders. The updates continued refining the experience introduced in earlier Gutenberg releases.

DataViews Improvements

DataViews saw updates focused on faster loading, cleaner layouts, and more intuitive data interaction. These refinements support both developers and everyday users managing structured content.

Interactivity API Progress

Work on the Interactivity API continued, giving developers simpler and more efficient ways to build dynamic features inside WordPress. The API aims to make interactive elements easier to create without heavy JavaScript dependencies.

Other WordPress News

November 2025 brought several notable updates across the broader WordPress ecosystem, with new tools, feature rollouts, and community developments that shaped the month.

Gutenberg Updates Continue

The Gutenberg team pushed steady improvements across usability, performance, and design flexibility. New refinements to patterns, layout controls, and site editing features were tested throughout the month.

WooCommerce Feature Enhancements

WooCommerce introduced updates focused on checkout speed, improved inventory handling, and better integrations for subscription and payment extensions. These changes support stores preparing for the 2025 holiday season.

New Accessibility Improvements

The WordPress Accessibility Team released new guidelines and updates to help theme and plugin authors meet WCAG standards more easily. Testing tools and documentation were also enhanced to simplify accessibility checks.

Community Events and Contributor Activity

WordPress meetups and contributor groups remained active globally, with increased testing efforts around WordPress 6.9. Several teams reported higher participation as the community prepared for the State of the Word in early December.

Security Alerts & Plugin Vulnerabilities

November 2025 saw a high volume of new WordPress plugin and theme vulnerabilities disclosed, along with several important patches released by developers. Security teams emphasized staying updated as third-party extensions remained the primary source of risk for WordPress sites.

New Vulnerabilities Reported

According to the November 5, 2025 SolidWP Vulnerability Report, 108 new vulnerabilities were identified across WordPress plugins and themes. These issues included cross-site scripting (XSS), privilege escalation, access control problems, and injection risks.

Patched Plugins and Themes

The same report confirmed that 77 vulnerable plugins and themes received patches during the period. Users were advised to update immediately to address the issues fixed by developers.

WPScan Database Enhancements

WPScan, which has been part of Automattic since its acquisition in 2021, continues to publish detailed vulnerability entries used by major security tools across the WordPress ecosystem. The database remained a key source for tracking newly disclosed plugin and theme vulnerabilities throughout November.

Industry Trends & Insights

November 2025 showed steady movement across the WordPress ecosystem as businesses, creators, and enterprises focused on performance, security, and more efficient workflows.

• Growing Adoption of Block and Site Editing: More users are relying on block-based tools and Full Site Editing, leading to increased demand for custom block patterns, flexible layouts, and improved design systems.

• Stronger Focus on Performance and Core Web Vitals: Website owners continued prioritizing speed, caching, CDNs, and optimized themes to meet user expectations and search engine performance standards.

• Higher Demand for Security and Maintenance Services: With plugin and theme vulnerabilities still the most common risk, more businesses invested in managed updates, monitoring, and routine security checks.

Theme of the Month: GREYD

GREYD stood out for its all-in-one approach to building WordPress websites. It combines a flexible theme with built-in design tools, automation features, and a strong focus on performance. Users can create full websites without relying on multiple plugins or heavy page builders.

Businesses and agencies like GREYD because it supports dynamic content, integrates well with the block editor, and offers fast, clean output. Its visual tools make it easy to build professional layouts, while its workflow features help teams move faster. GREYD continues to grow as a powerful option for anyone wanting a modern, efficient WordPress setup.

Plugin of the Month: Thrive Themes

Thrive Themes continued to stand out for users who want powerful marketing and conversion tools built directly into WordPress. The suite includes landing page builders, opt-in forms, A/B testing, quizzes, and other features that help websites grow leads and engagement.

Small businesses, bloggers, and online course creators rely on Thrive Themes because it combines speed, clean design, and marketing-focused features in one system. Its tools work well with the block editor, are easy to customize, and help users create pages that look good and convert well. Thrive’s all-in-one approach makes it a strong choice for anyone focused on results and growth.

Agency of the Month: Seahawk Media

Seahawk Media earned the spotlight for its strong global presence in WordPress services. The agency handled everything from custom development and maintenance to migrations, hacked-site repair, and SEO.

Their fast delivery times, transparent workflows, and enterprise partnerships set them apart. They worked closely with hosting companies, brands, and startups, helping clients scale with secure, performance-focused WordPress solutions.

With a team specializing only in WordPress, Seahawk remained a top choice for companies that want consistent quality and reliable support.

Host of the Month: Indystack

Indystack gained attention for delivering high-performance hosting designed specifically for WordPress. It offered one-click site deployment, automatic scaling, built-in caching, and strong developer tools on an optimized cloud infrastructure.

Users praised its fast loading speeds, easy management, and predictable pricing. Agencies liked its staging tools and multi-site management features. Developers appreciated the container-based architecture that reduced conflicts and improved stability.

With a focus on speed, uptime, and simplicity, Indystack continued to grow as a dependable option for modern WordPress hosting.

Founder of the Month: Ben Gillbanks (GeneratePress)

Ben Gillbanks, the creator of GeneratePress, has made a major impact on the WordPress ecosystem through his focus on speed, clean code, and long-term stability. GeneratePress became one of the most trusted lightweight themes, widely used by developers, agencies, and businesses that want fast, secure, and flexible websites.

His commitment to performance, accessibility, and a user-first experience helped shape modern theme development standards. With a theme that stays fast even as sites grow, Ben’s work continues to influence how WordPress users build efficient, high-quality websites.

Looking Ahead to December 2025

December is expected to bring key milestones for the WordPress ecosystem, including the public release of WordPress 6.9 and insights from the annual State of the Word. Developers and site owners can also expect continued improvements to the block editor, performance tools, and new features rolling out across major plugins and hosting platforms.

The month will likely focus on stability, security, and year-end updates as businesses prepare for holiday traffic and planning cycles. With major releases, community announcements, and platform upgrades on the horizon, December is poised to bring significant developments for users, creators, and agencies across WordPress.

The ecosystem continued to grow with steady progress, active collaboration, and a clear vision for the future of open web publishing.

Mergers, Acquisitions, and Investments

October 2025 saw limited but notable movement in the WordPress and web technology space.

Surfer SEO Acquired by Positive Group

Positive Group acquired Surfer SEO, one of the leading AI-driven content optimization platforms. The acquisition expanded Positive Group’s reach in the SEO and marketing technology sectors, strengthening its position in AI-powered digital publishing tools that closely align with WordPress workflows.

Shopify Launches Official WordPress Plugin

Shopify made a strategic entry into the WordPress ecosystem by launching its official plugin. While not an acquisition, this launch represented a significant investment in bridging content management with e-commerce. The move allows WordPress users to integrate Shopify’s commerce features directly into their sites, marking a closer relationship between the two platforms.

No other major mergers, acquisitions, or investment announcements were reported within the WordPress community during October 2025.

WordPress Core Updates

The WordPress 6.9 development cycle continued throughout October 2025. Core contributors worked on testing new features, improving block editor performance, and refining accessibility. The month focused primarily on beta preparation and ongoing code optimization for better workflow efficiency.

No major core release or public milestone was completed during October, but steady progress kept the roadmap for WordPress 6.9 on track for its upcoming release window.

Other WordPress News

October brought a range of important developments across the WordPress and hosting ecosystem.

GoDaddy Announces Premium Domain Marketplace

GoDaddy unveiled its upcoming Premium Domain Marketplace, set to operate on DomainNames.com. The new marketplace aims to create a secure, transparent environment for buying and selling high-value domains, appealing to investors and business owners.

Porkbun Reaches Three Million Domains

Porkbun achieved a major milestone by surpassing three million managed domains. This accomplishment reflects the company’s consistent growth and its reputation as a customer-friendly, independent domain registrar.

cPanel Confirms 2026 Pricing Update

cPanel announced new pricing for 2026, which will take effect in January. Hosting providers are reviewing the changes and adjusting their service plans accordingly. The update has renewed industry discussions about cost efficiency and multi-license management.

WordPress 6.9 Development Continues

Development for WordPress 6.9 progressed steadily, with contributors testing features focused on performance, accessibility, and full-site editing improvements. The release cycle remains on schedule for 2026.

WordPress Showcase Features Kobu

The Kobu website was featured in the official WordPress Showcase for its creative design, performance, and innovative use of the block editor. It stands as an example of how modern WordPress sites can balance functionality with aesthetics.

Security Alerts & Plugin Vulnerabilities

There were no major new core security vulnerabilities reported in October 2025. Routine plugin and theme updates continued across the ecosystem, with developers encouraged to keep installations current. Security firms emphasized ongoing monitoring and prompt patching as best practices.

Industry Trends & Insights

October 2025 reflected growing integration between WordPress and broader digital ecosystems.

• AI-driven content creation and automation tools continued to evolve, improving how users design, publish, and optimize content.

• E-commerce convergence expanded, with Shopify’s new plugin signaling tighter cooperation between platforms rather than competition.

• Hosting providers and registrars focused on scalability, security, and sustainability, preparing for 2026 pricing shifts and greener infrastructure demands.

Overall, the month underscored how WordPress remains central to the future of online publishing, adapting quickly to technological and business changes.

Theme of the Month: KadenceWP

KadenceWP stood out in October 2025 for its balance of speed, design flexibility, and ease of use. Known for its lightweight framework and customizable block-based design system, KadenceWP continues to be a favorite among developers and creators. 

It integrates seamlessly with WooCommerce, page builders, and performance plugins, making it ideal for both beginners and advanced professionals. Founded by Ben Ritner, KadenceWP remains focused on empowering users to build beautiful, fast-loading websites without sacrificing control.

Plugin of the Month: GeoDirectory

GeoDirectory earned attention for its ability to transform WordPress sites into powerful, scalable directories. Built by AyeCode Ltd, the plugin supports custom post types, advanced search filters, and full map integration. 

It is widely used for building local business directories, event listings, and service networks. With growing compatibility across builders and themes, GeoDirectory continues to expand how creators manage and monetize directory-based websites.

Agency of the Month: Seahawk Media

Seahawk Media continued to impress as a global leader in white-label WordPress services. The agency partners with major hosting providers and businesses to deliver expert design, development, and support. 

Co-founded by Ryan James and Gautam Khorana, Seahawk’s team focuses on creating strong brand identities, maintaining top-tier site performance, and offering reliable WordPress maintenance. 

Their hands-on approach and consistent delivery have made them a trusted name in the industry.

Host of the Month: Nexcess

Nexcess stood out this month for its reliable managed WordPress and WooCommerce hosting solutions. Known for its focus on speed, scalability, and customer support, Nexcess serves a wide range of clients from small startups to enterprise-level businesses.

The hosting company offers built-in performance optimization, strong security, and tools that simplify website management. Its ongoing investments in technology make it a solid choice for anyone seeking stable and high-performing WordPress hosting.

Founder of the Month: Ben Ritner

Ben Ritner, founder of KadenceWP, continues to shape how creators build and manage websites in WordPress. His vision of combining visual design freedom with technical performance led to the creation of the Kadence Theme and Kadence Blocks. 

His work focuses on accessibility, speed, and user empowerment, values that resonate deeply within the WordPress community. Ritner’s dedication to creating intuitive tools has helped thousands of users build professional-grade websites with less effort.

Looking Ahead to November 2025

November 2025 is expected to continue the push toward smarter, faster WordPress experiences. Developers are exploring new AI-powered tools for design, automation, and content creation. Hosting companies are focusing on eco-friendly infrastructure and sustainability practices. 

Plugin and theme creators are prioritizing accessibility, cleaner code, and improved user interfaces. As the ecosystem grows, collaboration and innovation remain the driving forces behind WordPress’s continued evolution.

Developers also saw steady progress toward the next major release with new APIs, block capabilities, and theme.json enhancements that signal a more mature block era ahead.

Billion‑Dollar Shake‑Up: Namecheap’s Next Chapter

CVC Capital Partners has struck a deal to acquire a majority stake in Namecheap for approximately $1.5 billion, including debt. Founder and CEO Richard Kirkendall will retain a significant ownership position and leadership role, underscoring continuity amid the scale investment in a top registrar-host brand.

Coverage consistently framed the transaction as intensifying competition across registrars, hosting, and control‑panel ecosystems, given CVC’s adjacent footprint near WebPros properties such as cPanel, Plesk, and WHMCS.

Industry watchers positioned the move alongside broader private‑equity activity in web infrastructure, highlighting recurring‑revenue logic and integrated bundle strategies as the deal’s underlying thesis.

Core in Focus: WordPress 6.8.3 and the 6.9 Horizon

WordPress 6.8.3 shipped as a security release addressing two issues: an authenticated data exposure vulnerability and an authenticated XSS vector in navigation menus, prompting immediate update guidance across supported branches.

Accompanying documentation reaffirmed the active support scope and set expectations for the next primary target on the roadmap, keeping site owners aligned on timelines leading up to the 6.9 cycle.

The net effect is a hardening milestone for fleets as teams rebaseline patch status and prepare to validate new features landing through Gutenberg toward 6.9.

Product and Community Highlights: Typepad’s Sunset, Telex Debuts, LoopConf Returns

Typepad’s shutdown deadline of September 30 triggered a visible migration wave to WordPress.com, with official import guidance supporting preservation of posts, media, and metadata via the Movable Type format.

Automattic also unveiled Telex, an experimental tool that converts natural-language prompts into working WordPress blocks, lowering the barrier to block creation and hinting at AI-assisted developer workflows ahead.

LoopConf returned on September 25 in London, reestablishing its role as an advanced developer-centric event, with confirmations from the official conference site and sponsors underscoring high-quality engineering content.

Patch Now: September Security Alerts and Vulnerabilities

Security teams tracked the sustained disclosure volume across plugins and themes, with weekly reports cataloging hundreds of issues and emphasizing the importance of virtual patching for unpatched Windows systems in production.

A late-month roundup highlighted critical unauthenticated attack paths, such as arbitrary file uploads, option updates, and privilege escalation patterns, recurring vectors that operators must continuously mitigate.

The 6.8.3 core patch directly addressed authenticated exposure and XSS risks, reinforcing urgent update guidance and confirming backports to eligible branches where applicable.

• Apply 6.8.3 immediately across fleets and confirm successful deployment via host or CI checks.

• Review weekly advisories for affected extensions and prioritize virtual patching or hotfixes during vendor lead time.

• Audit admin‑level capabilities, block risky file‑type uploads, and monitor WAF logs for probes tied to newly disclosed CVEs.

Read More: Internal WordPress Dispute Goes Public Amid Core Contributor Tensions

Signals and Trends: What Shaped September

The Typepad shutdown catalyzed a late-month migration funnel to WordPress, reflected in official support content, agency offerings, and partner enablement, targeting preservation and continuity for long-running blogs.

On the developer side, new block patterns, such as the Accordion suite built on the Interactivity API, and stronger Data Views signify a maturing block era with improved UX, accessibility, and data-heavy view patterns.

The Namecheap–CVC transaction reinforces the sustained shift toward vertically integrated stacks spanning domains, hosting, and management layers, with likely downstream impacts on pricing, bundles, and partner ecosystems.

Theme of the Month: Block Design Systems Level Up

The most consequential “theme” story this month is not a single release, but platform-level enhancements for all modern block themes: border-radius presets via theme.json, expanded styling for form controls, and richer Date block bindings for metadata-aware layouts.

These upgrades reduce bespoke CSS, improve design-system consistency, and provide theme authors with declarative control over more granular, accessible UI elements out of the box.

Teams preparing for the next major release should validate these capabilities against existing design tokens and templates in the latest Gutenberg builds to minimize post‑upgrade surprises.

Plugin of the Month: Solid Security’s Disclosure Cadence

Solid Security stood out through a consistent cadence of vulnerability reporting in September, helping operators triage exposure windows and apply mitigations while upstream fixes rolled out.

Product updates and guidance emphasized smarter vulnerability surfacing and coverage for unpatched intervals, reinforcing a pragmatic, defense‑in‑depth posture for large plugin portfolios.

The combination of actionable advisories and operationally sound features made Solid Security a practical standout in a month dominated by rapid disclosures and a core security patch.

Agency of the Month: Seahawk Media

Seahawk Media stands out for its end-to-end WordPress execution, including custom builds, redesigns, migrations, hacked-site repair, and speed optimization, reinforced by mature white-label programs that help agencies scale without expanding headcount.

Industry roundups consistently list Seahawk among the top WordPress providers, citing competitive hourly pricing, a broad service catalog, and partnerships with leading platforms in the WordPress ecosystem.

• Why it stands out: a broad, production‑ready stack, custom development, maintenance, security, and performance, delivered with agency‑friendly white‑label workflows and transparent pricing.

• Proven affordability at scale: commonly referenced hourly pricing from $59 for custom services, supporting rapid ramp‑up without long procurement cycles.

• Reliable care and continuity: managed maintenance plans with updated handling, security checks, and monitoring to reduce downtime and risk.

• Partnerships and trust signals: recognized by industry guides and connected with major WordPress hosts and brands across multiple verticals.

Host in Focus: Namecheap’s Investment‑Powered Ambition

Namecheap’s profile rose on the back of the CVC majority‑stake agreement, with reporting underscoring continued leadership by the founder‑CEO and a trajectory aimed at scaling registrar‑hosting integrations.

The deal slots into a broader consolidation arc, raising expectations for tighter product bundling and partner‑program shifts in the competitive field alongside GoDaddy and large European providers.

Operators should watch for changes in pricing, packaging, and potential control‑panel synergies as the integration roadmap becomes public.

Founder Spotlight: Richard Kirkendall

Richard Kirkendall merits recognition for steering Namecheap through a pivotal transaction while maintaining leadership continuity, a crucial factor in post-deal execution within infrastructure categories.

Investor framing highlights durable subscription revenue and cross‑sell opportunities across domain, hosting, and security lines, an archetype increasingly common among founder‑led web infrastructure companies.

The balance of capital infusion with institutional product knowledge positions Namecheap to accelerate roadmap delivery without losing operator‑centric sensibilities.

October 2025: What to Watch Next

Expect continued hardening downstream of 6.8.3 as hosts, agencies, and platform teams complete patch cycles and documentation updates across managed fleets.

Developer-facing work on Abilities API testing, Accordion block refinements, and theme.json enhancements should yield additional developer notes and early-adopter feedback that shape the 6.9 cut.

Given September’s elevated disclosure volume, plan for sustained weekly vulnerability reporting and triage guidance from security vendors through October and maintain vigilant monitoring for high‑impact CVEs.

Developers, designers, and site owners found themselves navigating a landscape of cutting-edge tools, core enhancements, and emerging vulnerabilities. This edition dives deep into everything that shaped WordPress last month, spotlighting trends, plugins, themes, and the people driving the platform forward.

The Pulse of the Community: WordCamp US and the Dawn of AI

August was dominated by WordCamp US 2025, the premier North American event for the WordPress community, which took place in Portland, Oregon, from August 26-29. Over 1,000 attendees gathered for four days of collaboration, learning, and connection, featuring a contributor day, a showcase day, and two full days of presentations.

The event’s programming reflected the major forces shaping the web today, with sessions covering everything from data visualization and accessibility to advanced e-commerce strategies. However, one topic stood above the rest: Artificial Intelligence.

WordPress Unveils Experimental AI Tool: Telex

The most significant announcement came from WordPress co-founder Matt Mullenweg during his keynote address. He introduced Telex, an experimental AI tool designed to democratize development by allowing users to create Gutenberg blocks using simple text prompts.

Described as a “vibe coding” service for WordPress, Telex can generate functional blocks and even simple animations, which can be downloaded as a plugin or tested in the WordPress Playground.

Mullenweg positioned Telex as a core part of WordPress’s mission: to take complex, code-heavy tasks and make them accessible to everyone. While still in its early “V0” or “Lovable” prototype phase, Telex offers a powerful glimpse into a future where anyone can build unique site components without writing a single line of code.

Keynotes and Community Highlights

The “hallway track” was as vibrant as ever, with the Sponsor Hall buzzing with activity, a Happiness Bar providing hands-on WordPress support, and even a Voodoo Donut Truck for attendees.

Beyond the AI buzz, other keynotes provided valuable insights. Google’s Danny Sullivan delivered a talk on the evolution of search and how it intersects with modern publishing, sparking conversations about how WordPress can adapt in the age of AI-driven content discovery.

The diverse program ensured something for everyone, cementing WordCamp US as the unmissable annual gathering for the WordPress community.

Under the Hood: Core Developments and Platform News

While the community gathered in Portland, development on the WordPress core continued steadily, with a strong focus on security, stability, and future features.

Mergers, Acquisitions, and Investments

The WordPress ecosystem remained relatively quiet on the mergers and acquisitions front in August 2025. No significant acquisitions or investment rounds involving prominent WordPress companies were publicly announced during the month.

WordPress Core Updates

August saw several essential maintenance and security releases for the WordPress core.

• Legacy Security Update: In a significant move, WordPress pushed a security update for older platform versions, from 4.7 through 6.7. This update backports a new root security certificate bundle to ensure that even legacy sites can maintain secure server-side connections for APIs and updates.

• Critical Security Patch: On August 4, a critical security patch for the WordPress core was released. It addresses serious vulnerabilities and reminds users to keep their sites updated.

• Roadmap to 6.9: Looking ahead, developers released the official roadmap for WordPress 6.9, outlining plans for evolving the site editor, refining the content creation experience, and improving performance. Key discussions this month focused on potentially expanding the core block library and giving theme authors more granular control over the user interface via theme.json.

Other WordPress News

In a notable move, WordPress.com launched a limited-time promotion from August 12 to August 25. During this period, new customers on Personal and Premium plans were given access to install plugins, a feature typically reserved for the higher-tier Business and Commerce plans.

This experiment allowed a wider range of users to explore the vast extensibility of the WordPress ecosystem.

Fortifying the Web: August’s Critical Security Landscape

August was a challenging month for WordPress security, with several high-severity vulnerabilities discovered in popular plugins, affecting millions of websites. The sheer volume of alerts underscored the critical importance of timely updates and proactive security measures.

Security researchers were busy in August, uncovering and patching hundreds of flaws. One report from early in the month alone detailed 133 publicly disclosed vulnerabilities across various plugins and themes.

Efimer Trojan Targets WordPress Sites for Crypto Theft

A stealthy malware campaign involving the Efimer trojan gained momentum, using hacked WordPress sites to distribute its payload. Attackers compromised websites and uploaded fake torrent files disguised as movie downloads. The Trojan infects their system when an unsuspecting user downloads and opens the file.

Efimer is designed to steal cryptocurrency by hijacking the user’s clipboard, swapping out legitimate wallet addresses for addresses controlled by the attackers. It also scans for and exfiltrates wallet seed phrases. The campaign has already infected thousands of users worldwide.

Critical Flaws in Popular Form Plugins

Some of the month’s most severe vulnerabilities were found in plugins associated with contact forms.

• Contact Form Entries Plugin: A critical (9.8/10 severity) PHP Object Injection vulnerability was discovered in the “Database for Contact Form 7, WPForms, Elementor Forms” plugin, which has over 70,000 active installations. The flaw allows an unauthenticated attacker to inject a malicious PHP object, which, when combined with the popular Contact Form 7 plugin, could be used to delete arbitrary files including wp-config.php, leading to a full site takeover. Users were urged to update to version 1.4.5 or later.

• Redirection for Contact Form 7: The “Redirection for Contact Form 7” plugin, which affects over 300,000 sites, was found to have a high-severity (8.8/10) vulnerability. The flaw, present in versions up to 3.2.4, allows an unauthenticated attacker to delete critical files on the server due to insufficient file path validation, which can also lead to remote code execution.

• Bit Form Plugin: The “Bit Form” plugin, with over 10,000 installations, was found to have a critical arbitrary file upload vulnerability in versions up to 2.20.4. The flaw allows an unauthenticated attacker to upload a malicious file (like a PHP web shell) and execute remote code.

TablePress Vulnerability Affects 700,000+ Sites.

A stored cross-site scripting (XSS) vulnerability was discovered in TablePress, a popular plugin used on over 700,000 websites. The flaw, affecting versions up to 3.2, was caused by insufficient input sanitization and output escaping.

It allowed an attacker with at least Contributor-level permissions to inject a malicious script into a table, which would then execute in the browser of anyone viewing that page. The developer quickly released a patch, and users are advised to update to version 3.2.1 or later.

Industry Trends & Insights

The events of August highlighted two overarching trends shaping the WordPress ecosystem.

First, AI is no longer a futuristic concept but a present-day reality. The introduction of Telex and the growing integration of AI into tools like Elementor and Divi signal a fundamental shift in website creation. The workflow moves away from manual, block-by-block assembly and toward a more conversational, prompt-driven process that empowers users of all skill levels.

Second, the relentless pace of vulnerability disclosures confirms that security cannot be an afterthought. As attackers deploy more sophisticated methods like the Eimer Trojan, and as flaws are found in even the most trusted plugins, maintaining a robust security posture through firewalls, regular updates, and careful plugin selection is more critical than ever.

Honorees of the Month

Each month, we highlight a theme, plugin, agency, host, and founder who have significantly impacted the WordPress community.

Theme of the Month: Baskerville 2

Baskerville 2 stands out for its elegant simplicity and power in a world of complex, feature-heavy themes. This free theme is perfect for bloggers and content creators who want their work to shine.

It’s a masonry-style theme beautifully displays text, images, and videos in a clean, responsive layout. With just enough customization options to make it your own without feeling overwhelmed, Baskerville 2 is a testament to the power of clean design and a worthy choice for anyone looking to start a blog.

Plugin of the Month: FormGent

Aligning with the month’s most significant trend, our plugin of the month is FormGent. Developed by WpWax, FormGent is a powerful form builder integrating AI to streamline creation.

It allows users to build complex forms more efficiently, tapping into AI to enhance functionality. With special introductory deals offered in August, FormGent represents the innovative spirit driving the plugin ecosystem forward.

Agency of the Month: Seahawk Media

Seahawk Media has established itself as a leading white-label WordPress development agency, partnering with over 1,000 hosting providers and digital agencies worldwide.

Seahawk specializes in custom development, site migrations, and malware removal and provides the scalable backbone that allows other businesses to grow. Their reliability and specialized focus make them a crucial, if often unseen, player in the WordPress economy.

Host of the Month: SiteGround

SiteGround is our host of the month for its blend of performance, user-friendly tools, and exceptional customer support. It consistently earns high marks from users, especially those new to WordPress.

With affordable introductory pricing, solid uptime, fast load times, and 24/7 support, SiteGround provides a reliable and accessible foundation for anyone looking to build a website.

Founder of the Month: Matt Mullenweg

As the co-founder of WordPress and the visionary behind Telex, Matt Mullenweg is the clear choice for founder of the month. His keynote at WordCamp US set the agenda for the platform’s future, reaffirming his commitment to democratizing publishing through open-source technology.

His leadership continues to steer the WordPress project toward innovation while staying true to its core mission.

Looking Ahead to September 2025

As we move into September, the WordPress community will digest the big ideas from WordCamp US. Development will continue on the path to WordPress 6.9, focusing on implementing the next generation of admin interfaces and developer tools. The launch of Telex, though experimental, will undoubtedly inspire a new wave of AI-powered tools from third-party developers.

On the security front, the vulnerabilities disclosed in August 2025 serve as a powerful catalyst for the entire community to double down on security best practices. Expect continued vigilance from security firms and a renewed push for users to keep their sites updated and protected.