# What changed in WordPress

> Every change an AI agent should know about, newest first: what changed, what to do now, and the source. 48 entries.

Source: https://mcpforwp.com (MCP for WP, free and read-only). 

## 2026-10-30 · ai · AI plugin 1.5.0 adds MCP Access and WebMCP experiments

The official AI plugin's new MCP Access experiment installs and activates the MCP Adapter plugin from WordPress.org and adds a `Tools → MCP Access` screen to choose which abilities agents can use. A WebMCP experiment lets an agent browser edit in the block editor through `document.modelContext`. It also adds Mistral and Vercel AI Gateway as featured connectors (`wpai_featured_connectors` filter) and `ai/v1` REST routes to list and run abilities.

What to do: To give agents MCP access on a site, enable MCP Access in the AI plugin instead of bundling the adapter yourself.

Source: https://github.com/WordPress/ai/releases/tag/1.5.0 (AI plugin 1.5.0)

## 2026-10-30 · ai · AI plugin 1.5.0 breaking changes to core abilities

The AI plugin removes the `core/read-settings`, `core/read-users` and `core/read-content` aliases, reshapes inputs to `where` / `fields` / `pagination`, and `core/settings-get` now uses REST names (`title`, not `blogname`).

What to do: Update any agent prompt or code that calls the old `core/read-*` abilities or the old input shape.

Source: https://github.com/WordPress/ai/releases/tag/1.5.0 (AI plugin 1.5.0)

## 2026-10-28 · security · WordPress 7.1.4 security release

Fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, several stored XSS issues (block markup, Interactivity API, Customizer selective refresh, Categories, Playlist, image and comments pagination blocks), leaking of unpublished Customizer changesets, and Notes readable by users who cannot edit the post. Root certificates were updated after the eMudhra revocation.

What to do: Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7.

Source: https://wordpress.org/news/2026/10/wordpress-7-1-4/ (WP 7.1.4)

## 2026-10-28 · editor · Gutenberg 24.3.0 released

Adds rich text formatting across blocks and an Avatar UI component, removes the `@wordpress/lazy-import` package, extracts core actions into `@wordpress/core-actions` script modules, and grows the React 19 list of incompatible plugins.

What to do: Remove any import of `@wordpress/lazy-import` and test your plugin with the Gutenberg React 19 experiment.

Source: https://github.com/WordPress/gutenberg/releases/tag/v24.3.0 (Gutenberg 24.3)

## 2026-10-27 · core · WordPress 7.2 Beta 2: more Abilities API work

Beta 2 continues work on the Abilities API (content querying, capability requirements, schema handling and permissions) and adds server-side registration for DataViews and DataForm. Final 7.2 release is scheduled for December 8, 2026.

What to do: Test plugins on the latest 7.2 pre-release (see `current.nextWordpress`), never on production.

Source: https://wordpress.org/news/2026/10/wordpress-7-2-beta-2/ (WP 7.2 Beta 2)

## 2026-10-22 · mcp · MCP approved as a de facto part of WordPress

Matt Mullenweg approved MCP as a de facto part of the WordPress experience (AI contributor meeting, 21 October), and the AI team aims to propose MCP for core in 7.3.

What to do: Expect MCP support to become standard; build on abilities and the MCP Adapter rather than custom endpoints.

Source: https://make.wordpress.org/ai/2026/10/22/ai-contributor-weekly-summary-21-october-2026/ (WP 7.3 (planned))

## 2026-10-21 · php · Critical PHP security release

The PHP project fixed two critical vulnerabilities that affect any PHP application, not only WordPress. No WordPress update is required. PHP versions before 8.2 no longer receive security updates from the PHP project.

What to do: Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server).

Source: https://wordpress.org/news/2026/10/critical-php-security-release/ (PHP 8.2+)

## 2026-10-20 · core · WordPress 7.2 adds a Secrets API

WordPress 7.2 Beta 1 introduces a Secrets API to store credentials such as API keys and tokens, with encryption at rest, credential rotation and custom storage providers (Trac #66187).

What to do: On 7.2+, plan to store plugin API keys through the Secrets API instead of plain options; the API may still change during beta.

Source: https://wordpress.org/news/2026/10/wordpress-7-2-beta-1-is-ready-for-download-and-testing/ (WP 7.2 Beta 1)

## 2026-10-20 · performance · 7.2 stops concatenating admin scripts and styles

WordPress 7.2 loads admin scripts and stylesheets individually instead of combining them into large files, for better browser caching, and prefetches resources for the admin screen the user is likely to visit next (Trac #57548).

What to do: Don't rely on admin asset concatenation when debugging or ordering admin assets on 7.2; declare dependencies properly.

Source: https://wordpress.org/news/2026/10/wordpress-7-2-beta-1-is-ready-for-download-and-testing/ (WP 7.2 Beta 1)

## 2026-10-20 · editor · 7.2: text shadows, wider responsive styles, new admin icons

WordPress 7.2 adds text shadow controls with presets in theme.json, extends viewport-specific styling to more design tools and blocks, and replaces legacy Dashicons in the admin bar and sidebar with icons from the WordPress icon library.

What to do: Define text shadow presets in theme.json instead of custom CSS, and don't assume core admin menu icons are Dashicons.

Source: https://wordpress.org/news/2026/10/wordpress-7-2-beta-1-is-ready-for-download-and-testing/ (WP 7.2 Beta 1)

## 2026-10-16 · mcp · How the MCP Adapter exposes abilities

The MCP Adapter (official WordPress plugin, not part of core) turns abilities into MCP tools, resources and prompts. Abilities are private by default: set `meta.public` or `meta.mcp.public` to `true` (an explicit `meta.mcp.public => false` overrides `meta.public => true`). The default server offers three meta-tools (`mcp-adapter/discover-abilities`, `mcp-adapter/get-ability-info`, `mcp-adapter/execute-ability`) at `/wp-json/mcp/mcp-adapter-default-server`, or over STDIO with `wp mcp-adapter serve --server=<id> --user=<user>`.

What to do: Register an ability with `meta.public => true` and install the MCP Adapter plugin. Always pass `--user` to `wp mcp-adapter serve`: without it, STDIO runs unauthenticated.

Source: https://github.com/WordPress/mcp-adapter (MCP Adapter 0.7)

## 2026-10-16 · mcp · MCP Adapter 0.7.1 and 0.6.2 security fixes

Session initialization data is now limited to 4 KiB to prevent oversized data from causing repeated database failures; affected clients must reconnect once. In 0.7.1, an ability not exposed through MCP returns `ability_not_found` instead of `ability_not_public_mcp`.

What to do: Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on `ability_not_public_mcp`.

Source: https://github.com/WordPress/mcp-adapter/releases/tag/v0.7.1 (MCP Adapter 0.7.1, 0.6.2)

## 2026-10-09 · core · NO_BACKSLASH_ESCAPES SQL mode turned off in 7.2

`wpdb::set_sql_mode()` now removes `NO_BACKSLASH_ESCAPES` from the session SQL modes, like it already did for `STRICT_ALL_TABLES`, `TRADITIONAL` and `ANSI`. It only affects the WordPress connection, not the server's global settings.

What to do: If you truly need this mode, remove it from the `incompatible_sql_modes` filter in a `db.php` drop-in (plugins load too late).

Source: https://make.wordpress.org/core/2026/10/09/no_backslash_escapes-sql-mode-is-now-turned-off-by-default-in-wordpress-7-2/ (WP 7.2)

## 2026-10-07 · mcp · The MCP Adapter plugin is on WordPress.org

The official MCP Adapter is now installable from the WordPress.org plugin directory instead of only as a Composer package or GitHub download.

What to do: Install the MCP Adapter from Plugins → Add New instead of bundling it in your plugin.

Source: https://make.wordpress.org/ai/2026/10/07/the-mcp-adapter-plugin-is-now-available-on-wordpress-org/ (MCP Adapter 0.7)

## 2026-10-06 · security · WordPress 7.1.3 security and maintenance release

Seven security fixes, including a stored XSS on the Comments admin page, a DoS in `WP_Http::make_absolute_url()`, a second-order SQL injection in WXR export, Author users able to sticky posts, unauthenticated disclosure of comments on private posts, and forgeable parameters to the `{status}_{type}` hook.

What to do: Update to WordPress 7.1.3 or later (7.1.4 is current).

Source: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ (WP 7.1.3)

## 2026-10-02 · mcp · MCP Adapter 0.7.0: new MCP spec, now a WordPress.org plugin

Adds MCP revision `2026-07-28` (older clients are served through `2025-11-25`) and is the first release in the WordPress.org plugin directory. Breaking: the generated DTO classes, `McpToolValidator`, `McpResourceValidator`, `McpPromptValidator` and the `mcp_adapter_validation_enabled` filter were removed, and custom transports must delegate to `HttpRequestHandler` or `McpWireOrchestrator`.

What to do: Install MCP Adapter as a plugin; bundling it as a Composer library is deprecated. Read the v0.7.0 migration guide before upgrading extensions.

Source: https://github.com/WordPress/mcp-adapter/releases/tag/v0.7.0 (MCP Adapter 0.7.0)

## 2026-09-22 · security · WordPress 7.1.2 fixes a critical RCE

An unauthenticated attacker could, under certain conditions, make page template resolution include a readable local PHP file outside the active theme, which can lead to remote code execution (CVE-2026-87902).

What to do: Update to WordPress 7.1.2 or later immediately.

Source: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ (WP 7.1.2)

## 2026-09-18 · ai · MCP stays a plugin in 7.2; MCP in core proposed for 7.3

The 7.2 roadmap requires AI features to prove adoption in the AI plugin first, so MCP, WebMCP, embeddings and streaming are developed there with no 7.2 guarantee. 7.2 does add three read-only core abilities (`core/content-query`, `core/users-query`, `core/settings-get`). The AI team aims to propose MCP for core in 7.3, merged or bundled.

What to do: Don't assume core includes an MCP server before 7.3: use the MCP Adapter plugin (or the AI plugin's MCP Access).

Source: https://make.wordpress.org/core/2026/09/18/roadmap-to-7-2/ (WP 7.2)

## 2026-09-17 · security · WordPress 7.1.1 fixes 11 security issues

Fixes include stored XSS in `wpautop()`, an HTML API `set_modifiable_text()` comment breakout, authenticated path traversal in the REST Templates controller, Contributor+ arbitrary post overwrite, and comments (including notes) that any logged-in user could reparent.

What to do: Update to the latest 7.1.x release.

Source: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/ (WP 7.1.1)

## 2026-08-19 · core · WordPress 7.1 "Mary Lou" released

7.1 adds Playlist and Tabs blocks, an API to register your own icons, a persistent admin bar across admin and editors, responsive styling for blocks, a new media editor, and Notes with rich text and @mentions.

What to do: Target WordPress 7.1 APIs (abilities filters, icon API, responsive styles) when writing code for current sites.

Source: https://wordpress.org/news/2026/08/mary-lou/ (WP 7.1)

## 2026-08-12 · security · WordPress 7.0.4 fixes Author+ RCE via uploads

Authenticated Author+ users could achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript (CVE-2026-65640).

What to do: Update to the latest 7.0.x or 7.1.x release, especially on servers with Imagick and Ghostscript.

Source: https://wordpress.org/news/2026/08/wordpress-7-0-4-release/ (WP 7.0.4)

## 2026-08-05 · ai · `wp_get_abilities()` now filters by category, namespace and meta

`wp_get_abilities( $args )` accepts `category`, `namespace`, `meta` (strict, nested), `item_include_callback` and `result_callback`, combined with AND logic. New filters `wp_get_abilities_item_include` and `wp_get_abilities_result` apply site-wide. The REST list endpoint filters by category, namespace and meta (see `rest_abilities_collection_params`).

What to do: Use `wp_get_abilities( array( 'namespace' => 'my-plugin' ) )` instead of filtering the full registry by hand; filtering is not authorization.

Source: https://make.wordpress.org/core/2026/08/05/filtering-registered-abilities-with-wp_get_abilities-in-wordpress-7-1/ (WP 7.1)

## 2026-08-05 · core · `notify_post_author` filter now has the final say

`wp_new_comment_notify_postauthor()` checks approval before applying `notify_post_author`. The default is `false` for unapproved comments, it is always a strict boolean, and returning `true` now sends a notification even for held, spam or trashed comments.

What to do: If you force notifications with `__return_true`, check `comment_approved` first or authors will get emails for spam.

Source: https://make.wordpress.org/core/2026/08/05/the-notify_post_author-filter-now-has-the-final-say-on-post-author-notifications/ (WP 7.1)

## 2026-08-04 · ai · Abilities get a unified `meta.public` exposure flag

Abilities can set `meta.public => true` to signal they are meant for external clients (REST, MCP, agents). REST exposure resolves as `show_in_rest ?? public ?? false`, so a channel-specific flag still wins. Exposure is not authorization: `permission_callback` still applies.

What to do: Use `'meta' => array( 'public' => true )` instead of setting `show_in_rest` and MCP flags separately.

Source: https://make.wordpress.org/core/2026/08/04/a-unified-public-exposure-flag-for-abilities-in-wordpress-7-1/ (WP 7.1)

## 2026-08-04 · editor · 7.1 deprecates experimental block helpers and legacy packages

`__experimentalCloneSanitizedBlock` and `__experimentalSanitizeBlockAttributes` now log deprecations in favor of `cloneSanitizedBlock` and `sanitizeBlockAttributes`. `@wordpress/nux` is a no-op package and `@wordpress/reusable-blocks` public APIs log deprecation warnings.

What to do: Switch to the stable `cloneSanitizedBlock`/`sanitizeBlockAttributes`, use the `Guide` component instead of NUX, and core entity methods for synced patterns.

Source: https://make.wordpress.org/core/2026/08/04/miscellaneous-block-editor-changes-in-wordpress-7-1/ (WP 7.1)

## 2026-08-04 · editor · `getEntityRecords()` returns all records for non-paginated entities

Core Data no longer slices non-paginated entities (like post types) to 10 records client-side; slicing only happens for entities that declare `supportsPagination: true`.

What to do: Drop the `per_page: -1` workaround where it was only a fix for this, and declare `supportsPagination: false` on custom non-paginated entities.

Source: https://make.wordpress.org/core/2026/08/04/miscellaneous-block-editor-changes-in-wordpress-7-1/ (WP 7.1)

## 2026-08-03 · editor · The post editor is always iframed in 7.1

Starting with 7.1, the post editor is iframed regardless of theme type or block API versions, including when legacy meta boxes are registered. In 7.0 it was only iframed when every inserted block used block API version 3+.

What to do: Get the canvas document via `ownerDocument`/`defaultView` instead of global `document`/`window`, and use `useRefEffect` for listeners.

Source: https://make.wordpress.org/core/2026/08/03/iframed-editor-changes-in-wordpress-7-1/ (WP 7.1)

## 2026-07-31 · ai · Abilities API: custom validation, invocation hook, typed REST input

New filters `wp_ability_validate_input` and `wp_ability_validate_output` supplement JSON Schema validation, and the `wp_ability_invoked` action fires on every call. REST-style `validate_callback`/`sanitize_callback` schema keywords are not run by abilities. REST GET/DELETE run input is now coerced to schema types.

What to do: Put custom ability validation in `wp_ability_validate_input`, not in schema callbacks, and expect typed values in callbacks on 7.1+.

Source: https://make.wordpress.org/core/2026/07/31/abilities-api-improvements-in-wordpress-7-1/ (WP 7.1)

## 2026-07-31 · ai · `wp_prepare_json_schema_for_client()` for MCP and AI tool schemas

New `wp_prepare_json_schema_for_client( $schema, $profile = 'draft-04' )` converts WordPress-style schemas to portable Draft 4 (moves property-level `required` into a `required` array, strips server-only keywords). Core applies it automatically to ability schemas in REST and AI Client function declarations.

What to do: Call it on a copy of your schema when exposing it in a custom REST endpoint, JS config, MCP tool or AI function declaration.

Source: https://make.wordpress.org/core/2026/07/31/json-schema-preparation-for-client-compatibility-in-wordpress-7-1/ (WP 7.1)

## 2026-07-29 · ai · New execution lifecycle filters for abilities

`WP_Ability::execute()` now runs `wp_pre_execute_ability` (short-circuit), `wp_ability_normalize_input`, `wp_ability_permission_result` and `wp_ability_execute_result`, around the existing `wp_before_execute_ability` and `wp_after_execute_ability` actions.

What to do: Use `wp_pre_execute_ability` for caching, rate limiting or maintenance mode, and `wp_ability_permission_result` for extra authorization.

Source: https://make.wordpress.org/core/2026/07/29/new-execution-lifecycle-filters-for-the-abilities-api-in-wordpress-7-1/ (WP 7.1)

## 2026-07-29 · core · jQuery UI updated to 1.14.2

WordPress 7.1 bundles jQuery UI 1.14.2 (was 1.13.3), drops IE support, and removes `$.fn._form`, `$.ui.ie`, `$.ui.safeActiveElement` and `$.ui.safeBlur`. `jQuery.uiBackCompat` is set to `true`.

What to do: Remove any use of the removed jQuery UI helpers and retest jQuery UI widgets on 7.1.

Source: https://make.wordpress.org/core/2026/07/29/jquery-ui-updated-to-1-14-2-in-wordpress-7-1/ (WP 7.1)

## 2026-07-24 · editor · React 19 is not in WordPress 7.1

WordPress 7.1 still ships React 18.3. The React 19 upgrade was reverted and is now an opt-in experiment in the Gutenberg plugin (since 23.4). The main breakage comes from plugins bundling `react/jsx-runtime` and from APIs removed in React 19 (string refs, default props on function components, legacy context).

What to do: Externalize `react-jsx-runtime` instead of bundling it, and test with the Gutenberg React 19 experiment.

Source: https://make.wordpress.org/core/2026/07/24/react-19-punted-beyond-wordpress-7-1-experiment-in-gutenberg/ (WP 7.1, Gutenberg 23.4+)

## 2026-07-24 · core · SVG Icon API: `wp_register_icon()` and `wp_get_icon()`

WordPress 7.1 adds `wp_register_icon_collection()`, `wp_unregister_icon_collection()`, `wp_register_icon()` (inline `content` or `file_path`, names like `collection/icon-name`) and `wp_get_icon()` to render icons in PHP. Registered icons also show in the Icon block.

What to do: Register custom icons on `init` with this API instead of shipping your own SVG sprite logic.

Source: https://make.wordpress.org/core/2026/07/24/registering-and-rendering-svg-icons-in-wordpress-7-1/ (WP 7.1)

## 2026-07-23 · editor · Components: 40px default height, Navigation component removed

`@wordpress/components` form controls are always 40px tall; `__next40pxDefaultSize` has no effect and `false` no longer opts out. The deprecated `Navigation` component and `__experimentalApplyValueToSides` were removed.

What to do: Stop passing `__next40pxDefaultSize`, and use `Navigator` instead of `Navigation`.

Source: https://make.wordpress.org/core/2026/07/23/editor-components-updates-in-wordpress-7-1/ (WP 7.1)

## 2026-07-22 · performance · Client-side media processing in the block editor

Images uploaded in the editor are resized and encoded in the browser with wasm-vips, then uploaded; `wp_generate_attachment_metadata` still fires. Server hooks `wp_image_editors`, `image_memory_limit` and `image_make_intermediate_size` do not fire for these uploads. Editor screens send `Document-Isolation-Policy` on Chromium 137+.

What to do: Disable it with `add_filter( 'wp_client_side_media_processing_enabled', '__return_false' )` if your plugin depends on server-side image editors.

Source: https://make.wordpress.org/core/2026/07/22/client-side-media-processing-in-wordpress-7-1/ (WP 7.1)

## 2026-07-17 · security · WordPress 7.0.2 fixes critical SQL injection and RCE

Fixes a facilitated SQL injection and a REST API batch-route confusion with SQL injection leading to remote code execution. Forced auto-updates were enabled. Fixed versions also include 6.9.5 and 6.8.6.

What to do: Make sure no site runs 7.0.0 or 7.0.1, or a 6.9/6.8 release older than 6.9.5/6.8.6.

Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ (WP 7.0.2, 6.9.5, 6.8.6)

## 2026-07-02 · ai · WordPress 7.2 adds three read-only core abilities

7.2 registers `core/content-query`, `core/users-query` and `core/settings-get` in core (`src/wp-includes/abilities/`), all read only.

What to do: Use these core abilities instead of registering your own for listing content, users or settings on 7.2+.

Source: https://make.wordpress.org/core/2026/07/02/merge-proposal-expanding-wordpress-core-abilities/ (WP 7.2)

## 2026-05-14 · core · Admin and Editor removed from the default role picker

In 7.0, Administrator and Editor can no longer be chosen as the new user default role under Settings → General. Site Health warns if one was set before. A `default_role_dropdown_excluded_roles` filter controls the excluded roles.

What to do: Don't tell users to set Administrator or Editor as the default role; use the filter if a plugin truly needs it.

Source: https://make.wordpress.org/core/2026/05/14/wordpress-7-0-field-guide/ (WP 7.0)

## 2026-05-14 · editor · contentOnly editing now applies more broadly to patterns

In 7.0, contentOnly mode is the default for patterns that relied on unrestricted inner block editing. Opt out for unsynced patterns with the `disableContentOnlyForUnsyncedPatterns` setting (via `block_editor_settings_all`). A `listView` block support adds a List View tab to the inspector.

What to do: Add `"role": "content"` to content attributes in block.json so your blocks stay editable inside contentOnly patterns.

Source: https://make.wordpress.org/core/2026/05/14/wordpress-7-0-field-guide/ (WP 7.0)

## 2026-05-14 · core · Author link functions drop title attributes

`get_the_author_link()` and `the_author_link()` take a new `$use_title_attr` parameter (pass `false` to drop the tooltip), and the "Posts by Author" title attribute is removed from the author posts link by default.

What to do: Don't rely on the author posts link having a `title` attribute; the text is still available in the `the_author_posts_link` hook.

Source: https://make.wordpress.org/core/2026/05/14/removing-title-attributes-in-author-link-functions/ (WP 7.0)

## 2026-03-24 · ai · AI Client in core: `wp_ai_client_prompt()`

WordPress 7.0 ships a provider-agnostic AI Client. `wp_ai_client_prompt( 'text' )` returns a `WP_AI_Client_Prompt_Builder` with methods like `using_system_instruction()`, `using_temperature()`, `using_model_preference()`, `as_json_response( $schema )`, then `generate_text()`, `generate_image()` or `generate_text_result()`. Failures return `WP_Error`. Core bundles no providers: official Anthropic, Google and OpenAI provider plugins add them.

What to do: Check `is_supported_for_text_generation()` before showing AI UI, and handle `WP_Error`; never assume a provider is configured.

Source: https://make.wordpress.org/core/2026/03/24/introducing-the-ai-client-in-wordpress-7-0/ (WP 7.0)

## 2026-03-24 · ai · Migrating from php-ai-client and wp-ai-client packages

On 7.0+, core loads `wordpress/php-ai-client`, so loading it again via Composer causes duplicate class conflicts. `AI_Client::prompt()` is replaced by `wp_ai_client_prompt()`. The `wp_ai_client_prevent_prompt` filter can block prompts. The client-side JS prompt API is not in core and needs an admin-level capability.

What to do: Require WP 7.0 and drop the Composer dependency, or only load your Composer autoloader when `wp_get_wp_version()` is below 7.0.

Source: https://make.wordpress.org/core/2026/03/24/introducing-the-ai-client-in-wordpress-7-0/ (WP 7.0)

## 2026-03-24 · ai · Client-side Abilities API (`@wordpress/abilities`)

7.0 adds a JavaScript Abilities API in two script modules: `@wordpress/abilities` (store, `registerAbility`, `registerAbilityCategory`, `getAbilities`, `executeAbility`) and `@wordpress/core-abilities`, which loads server abilities from `/wp-abilities/v1/`.

What to do: Call `wp_enqueue_script_module( '@wordpress/core-abilities' )` and import from `@wordpress/abilities` dynamically.

Source: https://make.wordpress.org/core/2026/03/24/client-side-abilities-api-in-wordpress-7-0/ (WP 7.0)

## 2026-03-18 · ai · Connectors API and the Settings → Connectors screen

7.0 adds a registry for external service connections, starting with AI providers (Anthropic, Google and OpenAI are featured connectors; the providers themselves are separate plugins). Query it with `wp_is_connector_registered()`, `wp_get_connector()` and `wp_get_connectors()`, and modify it on `wp_connectors_init`. API keys come from an env var, then a PHP constant (e.g. `ANTHROPIC_API_KEY`), then the database (stored unencrypted, masked in UI).

What to do: Don't build your own AI key settings page: AI provider plugins registered with the AI Client get a connector automatically.

Source: https://make.wordpress.org/core/2026/03/18/introducing-the-connectors-api-in-wordpress-7-0/ (WP 7.0)

## 2026-03-03 · editor · PHP-only block registration with `autoRegister`

Blocks can be registered entirely in PHP: call `register_block_type()` with `'supports' => array( 'autoRegister' => true )` and a `render_callback`. The editor shows the block without any JavaScript and generates inspector controls from the attributes.

What to do: For simple server-rendered blocks, use `autoRegister` instead of writing a JS edit component.

Source: https://make.wordpress.org/core/2026/03/03/php-only-block-registration/ (WP 7.0)

## 2026-02-23 · editor · Interactivity API: `watch()`, `state.navigation` deprecated

7.0 adds `watch()` to `@wordpress/interactivity` to rerun a callback when signals change. Accessing `state.navigation` in the `core/router` store is deprecated, and `state.url` is now populated on the server.

What to do: Use `watch()` with `state.url` to track client-side navigations instead of reading `state.navigation`.

Source: https://make.wordpress.org/core/2026/02/23/changes-to-the-interactivity-api-in-wordpress-7-0/ (WP 7.0)

## 2026-01-09 · php · WordPress 7.0 requires PHP 7.4

WordPress 7.0 dropped PHP 7.2 and 7.3; the minimum is now PHP 7.4.0 and the recommended version stays 8.3. Sites on PHP 7.2/7.3 stay on the 6.9 branch. Core is fully compatible with PHP 8.0 to 8.3 and has beta support for 8.4 and 8.5. The Gutenberg plugin also requires PHP 7.4.

What to do: Set `Requires PHP: 7.4` or higher for code that targets WordPress 7.0+, and test on PHP 8.4 and 8.5.

Source: https://make.wordpress.org/core/2026/01/09/dropping-support-for-php-7-2-and-7-3/ (WP 7.0)

## 2025-11-10 · ai · Abilities API in core: `wp_register_ability()`

Since 6.9, register abilities with `wp_register_ability( 'namespace/name', $args )` on the `wp_abilities_api_init` action (with `label`, `description`, `category`, `input_schema`, `output_schema`, `execute_callback`, `permission_callback`). Categories must be registered first with `wp_register_ability_category()` on `wp_abilities_api_categories_init`. Run one with `wp_get_ability( $name )->execute( $input )`.

What to do: Register abilities only inside `wp_abilities_api_init` (elsewhere it fails with `_doing_it_wrong()`). REST (`/wp-json/wp-abilities/v1/`) only lists abilities with `meta.show_in_rest => true` (on 7.1+, `meta.public` also works).

Source: https://make.wordpress.org/core/2025/11/10/abilities-api-in-wordpress-6-9/ (WP 6.9)