Howdy,
First things first: if you haven’t updated to WordPress 7.1.4, do that before reading any further. The October 28 security release fixes more than a dozen issues, including a weakness in the upgrade process that could lead to remote code execution and stored XSS in several blocks and the Interactivity API. The fixes were backported all the way to the 4.7 branch, so don’t forget about those older sites you maintain.
Running a store? WooCommerce had a busy week, too. WooCommerce 11.2.2 is a security release with a database update, and there’s a separate security update for WooPayments with a table of fixed versions for each release line.
As for me, I’m just enjoying the autumn weather. It feels like we’ve finally shed off the days of summer heat in Alabama. And that means it’s fall festival season. I’ll see if I can find one or two to enjoy in the coming weeks.
With that, let’s get down to the latest news.
Your friendly neighborhood developer advocate, 
Justin Tadlock
Developing Gutenberg and WordPress
WordPress 7.2 is one step closer. David Baumwald announced WordPress 7.2 Beta 4 on November 3. Beta 3 shipped inside the 7.1.4 security release. This round continues the work on the Abilities API and DataViews extensibility, and it improves focus visibility in Windows High Contrast mode. Translation updates also show up individually on the Updates screen now, so you can choose which ones to install. Beta 2 laid the groundwork for much of this, adding server-side registration for DataViews and DataForm and moving the admin to SVG icons.
The final release is still set for December 8. Spin up the Beta 4 Playground instance to test, or run wp core update --version=7.2-beta4 on a staging site.
Formatting no longer stops at the edge of a block. In What’s new in Gutenberg 24.3, George Mamadashvili shows how you can now select text across several blocks and format all of it at once. Notes pick up emoji reactions, and the Media inserter moves onto the same DataViews component behind the Site Editor’s lists. Failed saves finally explain themselves, too, with a copy button for sharing the details. The release carries the security fixes from 7.1.4, so update the plugin if you run it. The 24.4 release candidate followed on November 3.
Getting ready for WordPress 7.2
Dashicons are on their way out of the admin bar and menu. In WordPress 7.2, those icons are inline SVGs, and Ashar Fuadi explains what the SVG icon change means for plugins and themes. Most code needs nothing. But admin color schemes and anything that styles or hides icons through ::before will need a small CSS update, and the post has before-and-after rules you can copy. There’s a new API, too: add_menu_page(), register_post_type(), and admin bar nodes now accept a registered icon name like core-admin/pin.
Visit /random/ on a 7.2 site, and you’ll land on a random published post. Aaron Jorbin details the new random content endpoint, which also works for categories, tags, authors, and custom post types. It’s on by default, with a new randomable argument for post types and a wp_enable_random_content_redirect filter to switch it off.
It hasn’t landed quietly. Dozens of comments push back on the on-by-default choice, citing hidden content that could surface (Core still has no noindex option), ORDER BY RAND() load on large sites, and agencies now facing an must-use plugin across hundreds of sites. Matt Mullenweg has since agreed it shouldn’t use the page URL structure, so expect changes before 7.2 ships.
Anne McCarthy pulled several features still in development into one prototype for imagining the near future of collaboration in WordPress. It combines the 7.2 Notes features, suggestion mode, and the Presence API with a small workflow plugin that blocks publishing until every open note and suggestion is resolved. She purposely left real-time collaboration out to show how much works without it. She also shares the full prompt she used. Borrow it and build the demo yourself. Watch for an upcoming call for testing on suggestions.
Feature Notifications get a design, and some pushback
Plugins have spent years shouting over each other with admin notices. Exploring a design for Feature Notifications, from Poli Gilad, proposes a single notification bell on every admin screen, in the editor, and on the front of the site, with plugins sending data rather than layout. Existing admin notices keep working.
That last point drew the most criticism. Matt Mullenweg argued that the proposal does nothing about today’s notice spam and that the fix needs directory guidelines, enforcement, and incentives, not only a new interface. He backed David Perez’s suggestion that plugins declare each notice’s intent (operational, setup, or promotional) as a requirement.
On the code side, Jonathan Bossenger’s weekly update for October 30 reports that the notification repository is now scoped per user, laying the groundwork for the REST API. Prefer to watch the work happen? His Friday live stream includes testing the plugin in Studio and the AI-assisted workflow he uses for reviewing PRs. He also holds office hours in the Feature Notifications Slack channel on Thursdays at 10:00 UTC.
Prototypes from Dave on WP
The block toolbar has picked up a lot of buttons over the years. Dave Smith asks whether this is the end of the block toolbar and demos a consolidated version inside his Create Not Learn prototype editor. In about eight minutes, you’ll see how grouping those controls could make everyday formatting quicker and more consistent without giving up any of the editor’s power. The video description has a Playground link, so you can click around it yourself.
He also took a first look at drag-and-drop grid building, pulling Andrei Draganescu’s work-in-progress free-form grid into the same prototype. You can drag, resize, snap, and rotate blocks on a grid, and that demo has its own Playground link.
Release roadmap posts have kept roughly the same shape for three years. Anne McCarthy wants to know whether they still work, and she’s asking everyone from Core committers and extenders to hosts and everyday users to help shape future release roadmaps by November 16.
Plugins, Themes, and Tools for #nocode site builders and owners
WordPress Studio is now built around a conversation. Rich Tabor introduced a new workspace for building with WordPress, where you describe the site you want and an AI agent builds a first version next to a live preview. It offers four looks, then four layouts, and saves your choices to a DESIGN.md file so later chats keep the same design. You can pin notes on the preview with Annotate, bring your own Anthropic API key, or connect Claude Code, Codex, or Cursor over MCP. It’s a free desktop app for macOS, Windows, and Linux.
For a hands-on take, Elliott Richmond writes up what’s changed since his first look, along with one fair caution: the agent can now edit your live site directly, so building locally first is still the safer habit. Rich also shared why he rebuilt Studio on his own blog, and Nick Diego recorded a quick video overview of the new design and agentic features.
Stores running WooCommerce’s Purple theme are about to get more design control. In the WooCommerce 11.3 pre-release post, Brian Coords highlights color, spacing, and border controls curated for each block, including Product, Featured Product, Featured Category, and Product Categories List. The On-Sale Badge block can show the discount as an amount, a percentage, or custom text, and Product Gallery swiping on mobile now follows your finger naturally. The beta is out now, with the final release scheduled for the week of November 9.
Two new short tutorials from WordPress.com cover blocks you’ll use on nearly every site. The Columns block walkthrough builds grids, feature sections, and pricing tables, including column widths and stacking on mobile.
The Query Loop block video shows how to choose which posts appear, then sort and filter them, in about two minutes. Bookmark both for the next time a client asks how it’s done.
Theme Development for Full Site Editing and Blocks
Ipsum, the default theme shipping with WordPress 7.2, is easy to mistake for a simple theme. Carlo Daniele’s dive into the Ipsum theme and how to extend it for Kinsta shows what’s underneath. Templates hand their layouts to hidden patterns, around 60 patterns ship with it, and the default text colors reach a WCAG AAA contrast ratio.
My favorite detail is its use of the Block Bindings API: a comments call to action changes its text depending on whether the post already has comments.
|
||||
Building Blocks and Tools for the Block editor.
PHPStan can’t check a call to a class it has never seen, so code that integrates with other WooCommerce extensions usually gets skipped or baselined. Ján Mikláš introduces automated PHP stubs for Woo extensions, a woocommerce/php-stubs package generated from extensions on the WooCommerce Marketplace and WordPress.org. The stubs are public on GitHub and Packagist. If your plugin or theme talks to other Woo extensions, you can check those calls without installing every extension in your analysis environment.
WooCommerce 11.3 fixes a confusing count for stores that sell bundles. When an extension adds a product to the cart as part of a bundle, the Product Button says “1 in cart” even though the shopper never added it on its own. Luis Herranz explains declaring parent-child cart item relationships through a new woocommerce_store_api_cart_item_parent_item_key filter and a parent_item_key field in the Store API. WooCommerce never marks items as children by itself, so it’s up to your extension to declare them. Today only the button count uses it, but the Cart and Mini-Cart blocks could someday nest child items under their parents.
What’s new in Playground?
You can now test changes on a copy of your real site without a local server. Fellyph Cintra details how to clone your WordPress site in Playground with Reprint. Install the Reprint plugin on your live site, authorize Playground with a migration key, and you’ll have an editable copy in your browser. Nothing you change there gets published to your live site. It’s handy for trying a design change, checking a plugin update, or tracking down a bug. Not ready to connect your own site? The post links to a public demo you can clone first.
Playground’s building blocks aren’t only for WordPress anymore. In Joomla Playground: shared PHP tools beyond WordPress, Fellyph Cintra looks at Herman Peeren’s community project, which runs Joomla in a browser tab on the same @php-wasm packages and mysql-on-sqlite library. The interesting part is what comes back to WordPress. A different CMS sends different queries and workloads through those shared tools, surfacing compatibility and performance issues both projects can fix.
AI in WordPress
Imagine telling your AI agent, “Help me with my example.com site,” and it recognizes WordPress, asks you to authorize it, and gets to work. That’s the experience behind WordPress for the Agentic Web, the AI team’s plan from Jason Adams. It lays out four areas of work: a more reliable MCP Adapter that could move into Core, a baseline set of Abilities for common site tasks, OAuth so you don’t have to paste Application Passwords into an agent, and an end-to-end user experience tying them together.
The 7.2 cycle lays the foundation, and 7.3 is the target. Each area still needs a lead, so now’s the time to raise your hand. Not everyone in the comments is sold on MCP-first, though. Adrian Mörchen argued that most agents already work fine over the REST API and that filling its gaps should come first, and Jason replied that Abilities serve both routes. The October 28 contributor summary covers the first discussion, with Tammie Lister volunteering to lead UX, and The Repository has its own take on the plan.
Six new experiments landed in AI 1.5.0, the canonical AI plugin, and Jeffrey Paul breaks down each one. Text to Speech generates an audio version of a post, and Content Verification detects C2PA Content Credentials in uploaded images. MCP Access installs the MCP Adapter and adds a Tools → MCP Access screen where you decide which Abilities agents can see. The other three are WebMCP, Revision Change Summary, and Block Container Label Generation. If you’re following the Agentic Web work, MCP Access is the one to try first.
Through the end of November, free WordPress.com sites can connect to ChatGPT or Claude at no cost. Full access normally comes with a paid plan. Alexa Peduzzi notes that both connections run on MCP, so after a one-time setup you can ask your AI to save a draft, clear out comments, or suggest what to fix this week. The post includes ready-made prompts that open in either tool. Not interested? Connecting is entirely optional, and a WordPress.com reply in the comments points to the separate Prevent third-party sharing setting for anyone worried about AI training on their content.
AI prototypes that ignore the design system keep landing on designers’ desks. In working towards higher-quality agentic experiences, @leilabyron shares the 13 best practices Automattic Design wrote for agentic interfaces, grouped under capturing intent, showing the work, and building trust. The guidance doesn’t stop at a list: an agentic-design-brief skill picks the practices that matter for a feature, and an AGENTS.md file gives coding agents explicit rules. One rule worth stealing: ask when the request is genuinely ambiguous, and don’t ask when the answer is already clear.
What happens when an AI feature gives a wrong answer or lets a prompt injection slip through? At WordPress Day for AI Faro 2026, Ivelina Dimova shared how to use guardrails and evals for AI features in WordPress to test quality before anything reaches production. Anyone adding AI features to client sites should pair it with the Automattic Design post above. The slides are linked from the video page.
|
|||||
Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.
For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com
