Who Will Fund WordPress Security?

Nick d

Welcome to WPfavs. This is the roundup for October 12 to 15, 2026, and the lead story is about money. Mary Hubbard, the WordPress Executive Director, has formally asked more than 30 of the ecosystem's largest commercial companies to help fund the WordPress Security Program. Rae Morey at The Repository reported it. On the hosting side, the list includes GoDaddy, Newfold Digital, and Hostinger. On the product side, Elementor, Awesome Motive, Incsub from WPMU DEV, Rocketgenius, the Gravity Forms company, Rank Math, Brainstorm Force, and Extendify.

Ido

Quick disclosure, I work at Elementor, so I'm on the inside of one name on that list. What I find interesting is the timing. This comes right after the emergency WordPress 7.1.3 release, which patched seven security vulnerabilities. The ask lands while everyone is still thinking about patching.

Ben cohen

And the data explains why the ask is aimed at commercial companies. Patchstack's 2026 report says 11,334 vulnerabilities were recorded in 2025, up 42% year on year. Around 91 to 92% of them sit in plugins, and core had only two. The median time from disclosure to mass exploitation was five hours. That's Patchstack's number. My reading is that core isn't where the risk lives, so a security program funded by the plugin and hosting businesses at least points at the right place.

Nick d

I'm encouraged, but I'm also practical about it. The open gaps matter. We don't know what financial structure these contributions would have, we don't know whether contributing companies get any governance influence, and we don't know how many will actually commit. Until those answers exist, it's a request, not a funded program.

Ido

Right, and the governance question is the one people will argue about. If you pay, do you get a say? Nobody has said. I'd rather hear that answer early than discover it later.

Ben cohen

Now the volume problem, which makes the security story harder. Jean Galea counted 14,608 new plugins listed on WordPress.org since January 2026. That's more than 2024 and 2025 combined, from 10,532 distinct authors. And eight in ten have fewer than ten active installs. The source describes that as a flood of unverified AI generated micro utilities. Patchstack's report had already flagged vibe coding as a trend, so the pieces fit together, but the link is an interpretation.

Nick d

The Rivale Diff September report adds a twist. Of the top 12,500 plugins, 4,575 haven't shipped an update since September 2025. Yet 3,928 of those untouched plugins saw their daily download rate go up in September compared to August. So downloads are not a health signal. When it comes to vetting plugins, check the last update date, not the install graph. Meanwhile 110 of that top group now carry the AI tag, update far more often, and declare WordPress 7.1.x compatibility.

Ido

One more data point for agencies. NorthDuty audited 100 live WooCommerce stores showcased in agency portfolios. Five had reproducible public Store API or TLS defects, and ten more had dead navigation, footer, cart, or product links on production client sites. Those are the sites agencies show off. I'd run a link check before I'd run a pitch.

Ido

Now the AI side, and this is a direct follow up to our earlier episode, the one where we debated isolated core APIs against deep server agents like Novamira. This week the WordPress Core AI team officially released the MCP Adapter as a canonical plugin in the WordPress.org directory. It sets the default Model Context Protocol server architecture for WordPress sites, so developers can build standardized MCP servers for plugins and core data. That's the standardized path, instead of everyone shipping their own fragment.

Ben cohen

And for my corner, AI Plugin 1.4.0 introduced an experimental Markdown Feeds feature. It serves clean Markdown copies of your content alongside the usual HTML and RSS, so language models can read it easily. The word to underline is experimental, but the direction is clear. Sites are starting to publish for machines on purpose.

Nick d

Two more launches worth knowing. Matt Mullenweg and Automattic soft launched Spacefast, billed as a home for what your agent makes, on WP dot cloud. It handles database, auth, uploads, email, and spam protection, without making people think in WordPress terms. And Riad Benguella at Automattic released Liberate dot sh, a tool that converts Wix, Squarespace, Shopify, and Webflow sites into WordPress using local AI agents.

Ido

On business, Andrew Allemann reported that Automattic applied for 16 top level domains, including dot matt, dot woo, dot make, and dot wordpress. Former ICANN and trademark attorney Kellie Peterson noted the friction. The WordPress Foundation, not Automattic, owns the registered WordPress trademark, which raises governance questions for a brand domain.

Nick d

Community notes. Awesome Motive has taken over maintenance of WP Crontrol, a utility many of us rely on. Themeum sunset Qubely in October 2023 with a three year maintenance commitment that expires this month, and Tiger12 LLC released Roobely, a maintained GPL fork with 29 free blocks. And WordPress 7.2 is slated for December 8, 2026, with the NO_BACKSLASH_ESCAPES SQL mode disabled by default, Dennis Snell's progress on rebuilding wp kses, and a proposed Secrets API.

Ben cohen

For the underrated tools segment, three. Ozan Dikici's Sitelemetry Audit plugin runs hosted site audits from the WordPress admin, covering security, technical SEO, AI visibility, accessibility, and performance. The TBC Community App from Two Birds Code wraps FluentCommunity into native iOS and Android apps under your own store accounts. And FlyWP can generate static HTML mirrors and deploy them to a remote CDN straight from WordPress.

Nick d

My pick is Sitelemetry, because one audit in one place saves a lot of tab switching. In just a few clicks you see where to start.

Ido

Prediction for next week, and this is a guess, not reporting. With 30 companies asked and the detail still thin, I think we'll see at least a few publicly say they're in, and the governance questions get louder right after.