WordPress 7.1 Architecture, Abandoned Plugins, and AI Tooling

Ido

Welcome to Wpfavs, your favourite WordPress news. This is the autumn roundup, and the big one first. WordPress 7.1 shipped on August 19th, timed with WordCamp US in Phoenix. Beta 4 had already closed more than 114 updates and fixes, 51 in the Editor and 63 in Core. But the headline for builders is architectural.

Nick d

Right, and it's the iframe. The post editor canvas is now fully isolated in an iframe. When it comes to building blocks, that's a real shift. If your block leans on global scripts, or on CSS inheriting from the admin, you'll want to test it before you update client sites. That's the practical takeaway. Staging first, then check every custom block.

Ido

What I like is the direction. The editor gets more predictable, and the styling engine gets more granular. Before, applying a local style change globally was all or nothing. Now you can pick it property by property. Add the persistent top toolbar for navigation, plus JSON Schema preparation so outside clients can talk to WordPress more reliably. It feels like the platform is preparing for non human users.

Ben cohen

And that's exactly what WordCamp US leaned into. They ran a Core AI Prompt Bar, an in person space for contributors building AI tooling into core. Think about it. WordPress 7.0 was described as laying the foundation for AI across the experience, and 7.1 is where the plumbing gets tidier. This is moving fast.

Nick d

Now the less glamorous news, but I think it matters more. Chris Morris pointed to a report from WP Goldmine, The State of WordPress Plugin Opportunities 2026. They analyzed 57,383 plugins in the directory to see how many have gone stale.

Ben cohen

And the number is ugly. In the band with 10,000 to 100,000 active installs, 24% haven't been updated in over two years. That's 1,209 plugins with real user bases and no maintainer. In the 100,000 to 1 million band, it's 10.2%.

Nick d

The examples hurt. Limit Login Attempts, Layout Grid Block, and WP Downgrade are among the most installed abandoned plugins. We're also seeing veterans step back. Ajay D'Souza is retiring Popular Authors, and 1.5.0 is the final release. WP Plugin Info Card is open for a developer takeover. My advice for agencies: audit your stack for last updated dates. That's a quick check, and it catches a lot.

Ido

I'd add a thought. If a quarter of those popular plugins are orphaned, that's also an opportunity. Somebody could adopt them. The report is literally framed as plugin opportunities. The risk for site owners is the flip side of the same coin.

Ben cohen

Which brings us to security, because the risk is not theoretical.

Ben cohen

GuardingWP published its first State of WordPress Security 2026 report. Their scans found 52.8% of sites running at least one plugin with a known vulnerability. 55.9% leak their WordPress version through the generator meta tag. And 93.2% are missing one or more modern security headers, like HSTS, CSP, and X Frame Options. Their line was that defaults from the 2015 web are still the defaults in 2026.

Nick d

Those headers are a streamlined fix, honestly. Many hosts let you add them in a few clicks. And on core, update if you haven't. WordPress 7.0.2 was a security release. Adam Kues at Assetnote and Searchlight Cyber reported a REST API batch route confusion and SQL injection issue that could lead to remote code execution. Separately, TF1T, dtro, and haongo reported a facilitated SQL injection issue.

Ido

And here's the part that surprised me. Wordfence PRISM, an autonomous AI vulnerability intelligence agent, caught a critical authentication bypass backdoor in the Advanced Responsive Video Embedder plugin, which has roughly 20,000 active installs. It flagged it within two hours after the malicious code was introduced.

Ben cohen

Two hours. Compare that to a site owner who checks plugins once a quarter. I'd call that a signal. Attackers are going to use agents too, so defense has to be machine speed. I'd say watch this space closely.

Nick d

Now the business side. Envato moved to a flat 50% author fee from July 1st, ending the exclusive author model where some authors paid the platform a lower fee. Vova, who just launched VovaBlocks, said going independent is inevitable. Xaver said the marketplace model feels dated. Lawrence Ladomery asked whether it's time to sell direct.

Ido

And consolidation continues. StellarWP no longer exists as a brand. Its products now sit under Liquid Web. Some keep their names, some are rebranded, and some features are merged into other plugins. That sparked a lot of community reaction, and I understand why. If your site depends on one of those plugins, check the roadmap.

Ben cohen

Now the AI tooling, and there's a real fork. Benjamin Intal, founder of Stackable and WP Interactions, shared an experiment called Ahentic AI workspace. In the preview, it understands the whole site, helps launch it, and helps install plugins, with no external servers, services, or MCPs. Just WordPress and its new APIs.

Ido

The opposite philosophy is Novamira CLI. It lets terminal agents, Claude Code, Codex CLI, Gemini CLI, or anything that can run shell commands, connect to a site running Novamira. And Novamira's pitch includes PHP execution, database queries, and file operations. That's a lot of power.

Nick d

Power is great, but I'd say scope it carefully. Native APIs give you guardrails. Raw shell access gives you speed and risk. Pick per project, and never on a production client site without a backup.

Ben cohen

Two more AI items. AttribuLead recognizes referrals from ChatGPT, Claude, Perplexity, and Gemini as their own channel. If you care about AI visibility, you finally get a way to see it. And Vercel released an AI Gateway plugin, 40 plus providers through a single API key. WP Rocket also shipped an MCP server, so AI clients can see your real performance data.

Nick d

Finally, three underrated tools. Dynamic OSM Maps gives you a Gutenberg map block on OpenStreetMap and Leaflet, with no Google API keys or recurring fees. Reviso lets clients pin feedback on live pages, with no logins, inside Gutenberg, Bricks, and Elementor. And the official WordPress Browser Extension for Chrome and Safari moves the admin bar out of the front end, so it stops affecting layouts.

Ido

That's the roundup. Update, audit your plugins, and test your blocks in the iframe. See you next week.