AI plugin 1.5.0 adds MCP Access and WebMCP experiments
The official AI plugin's new MCP Access experiment installs and activates the MCP Adapter plugin from WordPress.org and adds a Tools → MCP Access screen to choose which abilities agents can use. A WebMCP experiment lets an agent browser edit in the block editor through document.modelContext. It also adds Mistral and Vercel AI Gateway as featured connectors (wpai_featured_connectors filter) and ai/v1 REST routes to list and run abilities.
To give agents MCP access on a site, enable MCP Access in the AI plugin instead of bundling the adapter yourself.
AI plugin 1.5.0 breaking changes to core abilities
The AI plugin removes the core/read-settings, core/read-users and core/read-content aliases, reshapes inputs to where / fields / pagination, and core/settings-get now uses REST names (title, not blogname).
Update any agent prompt or code that calls the old core/read-* abilities or the old input shape.
Fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, several stored XSS issues (block markup, Interactivity API, Customizer selective refresh, Categories, Playlist, image and comments pagination blocks), leaking of unpublished Customizer changesets, and Notes readable by users who cannot edit the post. Root certificates were updated after the eMudhra revocation.
Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7.
Adds rich text formatting across blocks and an Avatar UI component, removes the @wordpress/lazy-import package, extracts core actions into @wordpress/core-actions script modules, and grows the React 19 list of incompatible plugins.
Remove any import of @wordpress/lazy-import and test your plugin with the Gutenberg React 19 experiment.
Beta 2 continues work on the Abilities API (content querying, capability requirements, schema handling and permissions) and adds server-side registration for DataViews and DataForm. Final 7.2 release is scheduled for December 8, 2026.
Test plugins on the latest 7.2 pre-release (see current.nextWordpress), never on production.
Matt Mullenweg approved MCP as a de facto part of the WordPress experience (AI contributor meeting, 21 October), and the AI team aims to propose MCP for core in 7.3.
Expect MCP support to become standard; build on abilities and the MCP Adapter rather than custom endpoints.
The PHP project fixed two critical vulnerabilities that affect any PHP application, not only WordPress. No WordPress update is required. PHP versions before 8.2 no longer receive security updates from the PHP project.
Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server).
WordPress 7.2 Beta 1 introduces a Secrets API to store credentials such as API keys and tokens, with encryption at rest, credential rotation and custom storage providers (Trac #66187).
On 7.2+, plan to store plugin API keys through the Secrets API instead of plain options; the API may still change during beta.
WordPress 7.2 loads admin scripts and stylesheets individually instead of combining them into large files, for better browser caching, and prefetches resources for the admin screen the user is likely to visit next (Trac #57548).
Don't rely on admin asset concatenation when debugging or ordering admin assets on 7.2; declare dependencies properly.
7.2: text shadows, wider responsive styles, new admin icons
WordPress 7.2 adds text shadow controls with presets in theme.json, extends viewport-specific styling to more design tools and blocks, and replaces legacy Dashicons in the admin bar and sidebar with icons from the WordPress icon library.
Define text shadow presets in theme.json instead of custom CSS, and don't assume core admin menu icons are Dashicons.
The MCP Adapter (official WordPress plugin, not part of core) turns abilities into MCP tools, resources and prompts. Abilities are private by default: set meta.public or meta.mcp.public to true (an explicit meta.mcp.public => false overrides meta.public => true). The default server offers three meta-tools (mcp-adapter/discover-abilities, mcp-adapter/get-ability-info, mcp-adapter/execute-ability) at /wp-json/mcp/mcp-adapter-default-server, or over STDIO with wp mcp-adapter serve --server=<id> --user=<user>.
Register an ability with meta.public => true and install the MCP Adapter plugin. Always pass --user to wp mcp-adapter serve: without it, STDIO runs unauthenticated.
Session initialization data is now limited to 4 KiB to prevent oversized data from causing repeated database failures; affected clients must reconnect once. In 0.7.1, an ability not exposed through MCP returns ability_not_found instead of ability_not_public_mcp.
Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp.
wpdb::set_sql_mode() now removes NO_BACKSLASH_ESCAPES from the session SQL modes, like it already did for STRICT_ALL_TABLES, TRADITIONAL and ANSI. It only affects the WordPress connection, not the server's global settings.
If you truly need this mode, remove it from the incompatible_sql_modes filter in a db.php drop-in (plugins load too late).
Seven security fixes, including a stored XSS on the Comments admin page, a DoS in WP_Http::make_absolute_url(), a second-order SQL injection in WXR export, Author users able to sticky posts, unauthenticated disclosure of comments on private posts, and forgeable parameters to the {status}_{type} hook.
Update to WordPress 7.1.3 or later (7.1.4 is current).
MCP Adapter 0.7.0: new MCP spec, now a WordPress.org plugin
Adds MCP revision 2026-07-28 (older clients are served through 2025-11-25) and is the first release in the WordPress.org plugin directory. Breaking: the generated DTO classes, McpToolValidator, McpResourceValidator, McpPromptValidator and the mcp_adapter_validation_enabled filter were removed, and custom transports must delegate to HttpRequestHandler or McpWireOrchestrator.
Install MCP Adapter as a plugin; bundling it as a Composer library is deprecated. Read the v0.7.0 migration guide before upgrading extensions.
An unauthenticated attacker could, under certain conditions, make page template resolution include a readable local PHP file outside the active theme, which can lead to remote code execution (CVE-2026-87902).
MCP stays a plugin in 7.2; MCP in core proposed for 7.3
The 7.2 roadmap requires AI features to prove adoption in the AI plugin first, so MCP, WebMCP, embeddings and streaming are developed there with no 7.2 guarantee. 7.2 does add three read-only core abilities (core/content-query, core/users-query, core/settings-get). The AI team aims to propose MCP for core in 7.3, merged or bundled.
Don't assume core includes an MCP server before 7.3: use the MCP Adapter plugin (or the AI plugin's MCP Access).
Fixes include stored XSS in wpautop(), an HTML API set_modifiable_text() comment breakout, authenticated path traversal in the REST Templates controller, Contributor+ arbitrary post overwrite, and comments (including notes) that any logged-in user could reparent.
7.1 adds Playlist and Tabs blocks, an API to register your own icons, a persistent admin bar across admin and editors, responsive styling for blocks, a new media editor, and Notes with rich text and @mentions.
Target WordPress 7.1 APIs (abilities filters, icon API, responsive styles) when writing code for current sites.
Authenticated Author+ users could achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript (CVE-2026-65640).
Update to the latest 7.0.x or 7.1.x release, especially on servers with Imagick and Ghostscript.
wp_get_abilities() now filters by category, namespace and meta
wp_get_abilities( $args ) accepts category, namespace, meta (strict, nested), item_include_callback and result_callback, combined with AND logic. New filters wp_get_abilities_item_include and wp_get_abilities_result apply site-wide. The REST list endpoint filters by category, namespace and meta (see rest_abilities_collection_params).
Use wp_get_abilities( array( 'namespace' => 'my-plugin' ) ) instead of filtering the full registry by hand; filtering is not authorization.
wp_new_comment_notify_postauthor() checks approval before applying notify_post_author. The default is false for unapproved comments, it is always a strict boolean, and returning true now sends a notification even for held, spam or trashed comments.
If you force notifications with __return_true, check comment_approved first or authors will get emails for spam.
Abilities can set meta.public => true to signal they are meant for external clients (REST, MCP, agents). REST exposure resolves as show_in_rest ?? public ?? false, so a channel-specific flag still wins. Exposure is not authorization: permission_callback still applies.
Use 'meta' => array( 'public' => true ) instead of setting show_in_rest and MCP flags separately.
7.1 deprecates experimental block helpers and legacy packages
__experimentalCloneSanitizedBlock and __experimentalSanitizeBlockAttributes now log deprecations in favor of cloneSanitizedBlock and sanitizeBlockAttributes. @wordpress/nux is a no-op package and @wordpress/reusable-blocks public APIs log deprecation warnings.
Switch to the stable cloneSanitizedBlock/sanitizeBlockAttributes, use the Guide component instead of NUX, and core entity methods for synced patterns.
getEntityRecords() returns all records for non-paginated entities
Core Data no longer slices non-paginated entities (like post types) to 10 records client-side; slicing only happens for entities that declare supportsPagination: true.
Drop the per_page: -1 workaround where it was only a fix for this, and declare supportsPagination: false on custom non-paginated entities.
Starting with 7.1, the post editor is iframed regardless of theme type or block API versions, including when legacy meta boxes are registered. In 7.0 it was only iframed when every inserted block used block API version 3+.
Get the canvas document via ownerDocument/defaultView instead of global document/window, and use useRefEffect for listeners.
New filters wp_ability_validate_input and wp_ability_validate_output supplement JSON Schema validation, and the wp_ability_invoked action fires on every call. REST-style validate_callback/sanitize_callback schema keywords are not run by abilities. REST GET/DELETE run input is now coerced to schema types.
Put custom ability validation in wp_ability_validate_input, not in schema callbacks, and expect typed values in callbacks on 7.1+.
wp_prepare_json_schema_for_client() for MCP and AI tool schemas
New wp_prepare_json_schema_for_client( $schema, $profile = 'draft-04' ) converts WordPress-style schemas to portable Draft 4 (moves property-level required into a required array, strips server-only keywords). Core applies it automatically to ability schemas in REST and AI Client function declarations.
Call it on a copy of your schema when exposing it in a custom REST endpoint, JS config, MCP tool or AI function declaration.
WP_Ability::execute() now runs wp_pre_execute_ability (short-circuit), wp_ability_normalize_input, wp_ability_permission_result and wp_ability_execute_result, around the existing wp_before_execute_ability and wp_after_execute_ability actions.
Use wp_pre_execute_ability for caching, rate limiting or maintenance mode, and wp_ability_permission_result for extra authorization.
WordPress 7.1 bundles jQuery UI 1.14.2 (was 1.13.3), drops IE support, and removes $.fn._form, $.ui.ie, $.ui.safeActiveElement and $.ui.safeBlur. jQuery.uiBackCompat is set to true.
Remove any use of the removed jQuery UI helpers and retest jQuery UI widgets on 7.1.
WordPress 7.1 still ships React 18.3. The React 19 upgrade was reverted and is now an opt-in experiment in the Gutenberg plugin (since 23.4). The main breakage comes from plugins bundling react/jsx-runtime and from APIs removed in React 19 (string refs, default props on function components, legacy context).
Externalize react-jsx-runtime instead of bundling it, and test with the Gutenberg React 19 experiment.
SVG Icon API: wp_register_icon() and wp_get_icon()
WordPress 7.1 adds wp_register_icon_collection(), wp_unregister_icon_collection(), wp_register_icon() (inline content or file_path, names like collection/icon-name) and wp_get_icon() to render icons in PHP. Registered icons also show in the Icon block.
Register custom icons on init with this API instead of shipping your own SVG sprite logic.
@wordpress/components form controls are always 40px tall; __next40pxDefaultSize has no effect and false no longer opts out. The deprecated Navigation component and __experimentalApplyValueToSides were removed.
Stop passing __next40pxDefaultSize, and use Navigator instead of Navigation.
Images uploaded in the editor are resized and encoded in the browser with wasm-vips, then uploaded; wp_generate_attachment_metadata still fires. Server hooks wp_image_editors, image_memory_limit and image_make_intermediate_size do not fire for these uploads. Editor screens send Document-Isolation-Policy on Chromium 137+.
Disable it with add_filter( 'wp_client_side_media_processing_enabled', '__return_false' ) if your plugin depends on server-side image editors.
WordPress 7.0.2 fixes critical SQL injection and RCE
Fixes a facilitated SQL injection and a REST API batch-route confusion with SQL injection leading to remote code execution. Forced auto-updates were enabled. Fixed versions also include 6.9.5 and 6.8.6.
Make sure no site runs 7.0.0 or 7.0.1, or a 6.9/6.8 release older than 6.9.5/6.8.6.
Admin and Editor removed from the default role picker
In 7.0, Administrator and Editor can no longer be chosen as the new user default role under Settings → General. Site Health warns if one was set before. A default_role_dropdown_excluded_roles filter controls the excluded roles.
Don't tell users to set Administrator or Editor as the default role; use the filter if a plugin truly needs it.
contentOnly editing now applies more broadly to patterns
In 7.0, contentOnly mode is the default for patterns that relied on unrestricted inner block editing. Opt out for unsynced patterns with the disableContentOnlyForUnsyncedPatterns setting (via block_editor_settings_all). A listView block support adds a List View tab to the inspector.
Add "role": "content" to content attributes in block.json so your blocks stay editable inside contentOnly patterns.
get_the_author_link() and the_author_link() take a new $use_title_attr parameter (pass false to drop the tooltip), and the "Posts by Author" title attribute is removed from the author posts link by default.
Don't rely on the author posts link having a title attribute; the text is still available in the the_author_posts_link hook.
WordPress 7.0 ships a provider-agnostic AI Client. wp_ai_client_prompt( 'text' ) returns a WP_AI_Client_Prompt_Builder with methods like using_system_instruction(), using_temperature(), using_model_preference(), as_json_response( $schema ), then generate_text(), generate_image() or generate_text_result(). Failures return WP_Error. Core bundles no providers: official Anthropic, Google and OpenAI provider plugins add them.
Check is_supported_for_text_generation() before showing AI UI, and handle WP_Error; never assume a provider is configured.
Migrating from php-ai-client and wp-ai-client packages
On 7.0+, core loads wordpress/php-ai-client, so loading it again via Composer causes duplicate class conflicts. AI_Client::prompt() is replaced by wp_ai_client_prompt(). The wp_ai_client_prevent_prompt filter can block prompts. The client-side JS prompt API is not in core and needs an admin-level capability.
Require WP 7.0 and drop the Composer dependency, or only load your Composer autoloader when wp_get_wp_version() is below 7.0.
7.0 adds a JavaScript Abilities API in two script modules: @wordpress/abilities (store, registerAbility, registerAbilityCategory, getAbilities, executeAbility) and @wordpress/core-abilities, which loads server abilities from /wp-abilities/v1/.
Call wp_enqueue_script_module( '@wordpress/core-abilities' ) and import from @wordpress/abilities dynamically.
Connectors API and the Settings → Connectors screen
7.0 adds a registry for external service connections, starting with AI providers (Anthropic, Google and OpenAI are featured connectors; the providers themselves are separate plugins). Query it with wp_is_connector_registered(), wp_get_connector() and wp_get_connectors(), and modify it on wp_connectors_init. API keys come from an env var, then a PHP constant (e.g. ANTHROPIC_API_KEY), then the database (stored unencrypted, masked in UI).
Don't build your own AI key settings page: AI provider plugins registered with the AI Client get a connector automatically.
Blocks can be registered entirely in PHP: call register_block_type() with 'supports' => array( 'autoRegister' => true ) and a render_callback. The editor shows the block without any JavaScript and generates inspector controls from the attributes.
For simple server-rendered blocks, use autoRegister instead of writing a JS edit component.
7.0 adds watch() to @wordpress/interactivity to rerun a callback when signals change. Accessing state.navigation in the core/router store is deprecated, and state.url is now populated on the server.
Use watch() with state.url to track client-side navigations instead of reading state.navigation.
WordPress 7.0 dropped PHP 7.2 and 7.3; the minimum is now PHP 7.4.0 and the recommended version stays 8.3. Sites on PHP 7.2/7.3 stay on the 6.9 branch. Core is fully compatible with PHP 8.0 to 8.3 and has beta support for 8.4 and 8.5. The Gutenberg plugin also requires PHP 7.4.
Set Requires PHP: 7.4 or higher for code that targets WordPress 7.0+, and test on PHP 8.4 and 8.5.
Since 6.9, register abilities with wp_register_ability( 'namespace/name', $args ) on the wp_abilities_api_init action (with label, description, category, input_schema, output_schema, execute_callback, permission_callback). Categories must be registered first with wp_register_ability_category() on wp_abilities_api_categories_init. Run one with wp_get_ability( $name )->execute( $input ).
Register abilities only inside wp_abilities_api_init (elsewhere it fails with _doing_it_wrong()). REST (/wp-json/wp-abilities/v1/) only lists abilities with meta.show_in_rest => true (on 7.1+, meta.public also works).
