WordPress’s AI Era: New Agents, Bigger Security Risks

Ido

Here's the question for today: is WordPress formally entering its AI era? Not the era of bolting a chatbot onto a plugin. I mean AI in the foundation. And one number made me sit up. Roughly 30 percent of active WordPress sites now run at least one AI powered plugin. Two years ago that was under 8 percent.

Nick d

That's a steep climb, and it's a good start, but the bigger story is what happened in core. WordPress 7.0, Armstrong, shipped in May with the Abilities API, an AI Services Registry, a WordPress AI Client, and the AI Connectors screen. It had over 4.6 million downloads and 875 plus contributors. So when it comes to building on AI, the plumbing now lives in WordPress itself.

Ben cohen

And that plumbing matters more than any single feature. Think about the old way. Every plugin builds its own AI box, its own settings, its own keys. With the Abilities API, a plugin declares what it can do, and an agent can query that registry and run those tasks. WordPress 7.1 was timed for August 19, alongside WordCamp US in Phoenix. By September, major plugins were connecting to assistants like Claude and ChatGPT in a serious way. That's the moment AI stopped being an add on and started being an expectation.

Ido

There's a pressure behind this, too. WordPress is still around 42 percent of all websites, and close to 60 percent of sites with a detectable CMS. But it slipped from a mid 2025 peak near 43.6 percent to about 41.9. Wix grew over 30 percent year over year to 4.3 percent CMS share, and standalone AI site generators arrived. The ecosystem is still valued around 596.7 billion dollars, but nobody gets to stand still.

Nick d

My read, and that's interpretation, not data, is that AI in core is partly a response to that. If someone can describe a site to a generator in one prompt, WordPress needs to meet them with something just as fast, plus the control WordPress is known for.

Ben cohen

What fascinates me is that two very different interfaces are emerging. The first is dashboard native, with zero middleware. Benjamin Intal, founder of Stackable and WP Interactions, previewed Ahentic AI. It understands the whole site, helps launch it, and installs plugins, with no external servers, no outside services, no MCP, just WordPress and its new APIs. WPadmin.AI takes a similar route, handling bulk edits, migrations, and troubleshooting inside the dashboard.

Ido

The second path goes the other direction, into the terminal. Novamira CLI connects coding agents like Claude Code, Codex CLI, and Gemini CLI straight to a WordPress site, with PHP execution, database queries, and file operations. And Elementor's Angie added Super Admin Mode, which can read and write the file system, query the database, execute PHP, and do what used to need WP CLI or server access. The agent isn't clicking around the interface anymore. It's working underneath it.

Nick d

And the unglamorous updates are what make it usable. Novamira 1.5.0 added native Gutenberg support, so agents can create and edit posts with core and third party blocks, valid from the first save. No more broken block recovery prompts. Novamira Pro 1.1.0 added abilities for ACF, JetEngine, Meta Box, Pods, and more. That's the kind of detail that turns a demo into a workflow.

Ben cohen

But we have to talk about the cost, because the speed here has a dark side. Patchstack's State of WordPress Security 2026 recorded 11,334 new vulnerabilities in 2025, up 42 percent year over year. Highly exploitable ones jumped 113 percent. And Patchstack specifically called out vibe coding, where developers ship plugin code an LLM wrote and they can't audit. When the person shipping can't review it, flaws go live silently.

Nick d

The timing is the scary part. Patchstack says the weighted median time from public disclosure to mass exploitation was five hours. And 46 percent of disclosed vulnerabilities had no patch at disclosure, because 52 percent of plugin developers hadn't patched before it went public. So the advice to just keep plugins updated doesn't cover you when there's no update yet.

Ido

And hosting doesn't save you either. According to that same data, 87.8 percent of WordPress specific exploits bypass standard hosting firewalls, which block only about 26 percent. Network firewalls can't read what a plugin flaw means. GuardingWP's report adds that 52.8 percent of sites run at least one plugin with a known vulnerability, 55.9 percent leak their WordPress version, and 93.2 percent miss modern security headers.

Ben cohen

Now put that next to an agent with file system and database access. That's my interpretation, but it makes permissions the whole conversation. The same power that makes Angie or Novamira useful is exactly what you'd worry about if something goes wrong.

Nick d

So here's the practical part for developers. First, learn to define schemas and abilities cleanly, because that's how agents will see your plugin. Second, learn granular agent permissions and keep a human in the loop for anything that writes. Third, add application layer virtual patching, since your host probably won't catch it. And fourth, review every piece of AI generated code before it ships. As you embark on this journey, treat auditing as a core skill, not an afterthought.

Ido

There's a business shift, too. Envato moved to a flat 50 percent author fee, and developers like Vova and Xaver are saying going independent is inevitable. Meanwhile GoDaddy launched Airo for WordPress in general availability, Vercel released an AI Gateway plugin with 40 plus providers behind one key, and Jetpack added AI Answers with cited summaries. AI is landing at the hosting, marketplace, and search layers all at once.

Ben cohen

So is this the AI era? I think yes. The foundation is in core, plugins are connecting, and agents are choosing between dashboard and terminal. Industry projections say over 40 percent of sites will run an AI plugin by late 2026, and more than 50 percent by 2027. But those are projections. What's already real is the question that matters most: who holds the keys, and who checks the work?