Plugin Reviews, Developer Updates, Security Patch & WP 7.2 Volunteers | WP More - Issue 52

Hello WordPressers!

Welcome to this week’s WP More roundup. This is WP More newsletter issue 52, where you get curated news about WordPress and the WordPress community all in one place.

WordCamp US 2026 starts August 16 in Phoenix today. Are you joining?

WordPress 7.1 ships August 19 on the event’s final day, so this is a packed week. Plugin transparency issues, developer updates, a fresh security patch, and a call for 7.2 volunteers all landed at once.

• What 3,400 plugin reviews tell you about building products people love

• The hidden WordPress hook any plugin can use to rewrite your Add New screen

• What’s new for developers in August 2026

• WordPress 7.2 is already recruiting volunteers

• A third WordPress security release in four weeks patches an author-level RCE

Matt Cromwell scraped and tagged 3,354 one-star and five-star reviews from the 100 most popular plugins on WordPress.org. Reliability failures drive 42% of one-star reviews, far ahead of missing features, which show up as the primary complaint in just 2.5% of cases.

The second biggest one-star driver is monetization: free tiers that hide their limits until someone has already built on top of them (170 reviews), ahead of nag popups (102 reviews). On the five-star side, ease of use tops the list at 21%, followed by dependability at 20%, and excellent human support at 17%.

Read the full blog on Roots & Fruit →

If you build or sell WordPress plugins, this data is worth reading before you touch the roadmap.

Developer Marcin Dudek noticed his own plugin was not the first result when he searched for it by exact name in Plugins > Add New. That led him to the plugins_api_result filter, a hook that fires before search results reach your screen and lets any installed plugin reorder, add, or delete what you see. He scanned all 63,619 free plugins on WordPress.org and found two vendors using it to remove a competitor from the Featured and Recommended tabs.

Read the full blog on Marcin Dudek →

With plugin transparency on everyone’s mind, the developer update below is worth reading alongside this one.

WordPress 7.1 lands August 19, the final day of WordCamp US in Phoenix. The standout additions are responsive block styles (per-breakpoint styles in theme.json via @mobile and @tablet keys), pseudo-state styling for Button and Navigation Link blocks, and a now-public SVG Icon API for registering custom icon collections. The post editor is always iframed in 7.1, regardless of block API version or theme type. The Abilities API picks up a full execution lifecycle and shared discovery pipeline, making it ready for AI integrations and automation tooling. A new background.gradient block support lets you layer gradients and images in the same block. React 19 is punted again, real-time collaboration didn’t make the cut, and the Classic block stays in the inserter. If you maintain plugins or themes, the Field Guide is your checklist before 7.1 ships.

Read the full blog on WordPress Developer Blog →

Planning for the next major release is already moving, which brings us to 7.2.

The WordPress 7.2 release cycle is open, with a proposed final release date of Wednesday, December 9, 2026. Alpha development began August 10, and the team is recruiting for Release Lead, Release Coordination, Tech Leads, Triage Lead, and Test Lead roles. The squad structure stays lean: Make Team Reps coordinate within their teams rather than routing through a large central group.

Attending State of the Word is not required; all coordination happens in the #core Slack channel. The timeline runs from Beta 1 in late October through three release candidates, with a dry run December 7-9. Whether you’ve led a release before or want to get involved for the first time, comment on the post or reach out in #7-2-release-leads before Friday, August 28.

Read the full blog on Make WordPress Core →

On the security front, 7.2 planning is happening against a backdrop of accelerating vulnerability reports.

WordPress 7.0.4 shipped on August 12, fixing a remote code execution vulnerability found by AI penetration testing firm pwn.ai. A logged-in author could upload a file with a .png extension containing PostScript, which ImageMagick would recognize and pass to Ghostscript for arbitrary code execution. The bypass worked through two paths that skip WordPress’s standard upload checks: XML-RPC’s wp.uploadFile and the MP3 cover-art extraction routine.

The patch adds content inspection before any file reaches Imagick. Author-level access sounds like a high bar, but on membership sites or multi-author publications with open registration, it isn’t. Sites with automatic updates are already patched; backports go back to WordPress 4.7. This is the third core security release since July, following 7.0.2 (a critical pre-auth RCE) and 7.0.3 (12 vulnerabilities). HackerOne bug bounty reports have climbed from a 20-30 monthly baseline to 450.

Read the full report on The Repository →

→ 62% of Our Search Console Impressions Were Bots. Then 17%. (jnkplugins.com)

→ When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE (patchstack.com)

→ WordPress 7.0.4 is now available (wordpress.org)

→ WordPress 7.1 Release Candidate 3 (make.wordpress.org)

→ WordPress 7.2 Planning Kicks Off With December 9 Release Date During State of the Word (therepository.email)

→ Hands-on Activity Kits Now Live on Learn WordPress (make.wordpress.org)

→ WordCamp Switzerland postponed (switzerland.wordcamp.org)

→ Monthly Education Buzz Report – July 2026 (make.wordpress.org)

→ Post list tables row headers changed (make.wordpress.org)

→ Official WordPress Browser Extension Now Available in the Chrome Web Store and Mac App Store (therepository.email)

→ WordPress Credits Team Proposes Graduate Retention Program, Launches Public Dashboard (therepository.email)

→ Matt Mullenweg’s Messages Went Missing Amid a Failed Backup and Two Lost Devices, Court Filing Reveals (therepository.email)

→ Accessibility Team Initiative “Permanently Delayed” as Matt Mullenweg Declares Team Has “Overstepped Its Authority” (therepository.email)

→ Automattic Fires Back at WP Engine’s Sanctions Motion, Says Hosting Company Can’t Identify a Single Missing Message (therepository.email)

→ Announcing WP Future Conclave 2026, Kozhikode! (events.wordpress.org)

→ What 3,400 WordPress Plugin Reviews Say About What Users Actually Care About: Q&A With Matt Cromwell (therepository.email)

Matt Cromwell’s plugin review analysis showed that reliability failures, not missing features, drive 42% of one-star reviews, and that great support is nearly four times more likely to earn a five-star than a one-star. The hidden plugins_api_result filter story showed two vendors with a combined 570,000 installs silently removing a competitor from the WordPress installer. One fixed it within 17.5 hours; the other needed a nudge from WordPress.org. On the security side, HackerOne bug bounty reports have jumped from a 20-30 monthly baseline to 450, with WordPress now on its third core security patch in four weeks. And 7.2 planning is already open, targeting December 9, 2026.

Are you auditing your own plugin’s reviews the way Cromwell’s data suggests you should? If you’ve been thinking about contributing to a WordPress release, August 28 is the deadline to raise your hand for 7.2.

Reply to share what caught your attention this week, or forward this to a WordPress friend who should be reading it.

— Nishat, WP More

Follow → X.com | LinkedIn | BlueSky | Facebook

Join Our Community → Sub-Reddit | X Community