Critical Security Update Requires Immediate Action

WordPress 7.0.4 has been released as a security update to address a critical vulnerability. Site owners should update immediately to protect their installations from an authenticated remote code execution exploit via malicious file uploads. The vulnerability affects sites running Imagick with Ghostscript and was responsibly reported by the team at pwn.ai.

Release lead John Blackbourn confirmed that the security fix is being backported to the 4.7 branch and incorporated into the WordPress 7.1 release candidate. Sites that don’t update automatically should navigate to Dashboard → Updates and click Update Now to apply the patch immediately.

WordPress 7.1 Development Progress Continues

Despite the security update, WordPress 7.1 development remains on track for its scheduled December 9th, 2026 release. Justin Tadlock published a comprehensive August roundup highlighting key features developers should test during the final weeks before release.

The upcoming version introduces responsive block styles with theme-configurable breakpoints, pseudo-states for Buttons and Navigation Links, and a now-public SVG Icon API. However, developers should note that React 19 has been postponed again, and the post list table row headers have moved—a change likely to affect some existing implementations.

Accessibility Improvements Lead the Way

Joe Dolson reported 88 accessibility enhancements and bug fixes coming in WordPress 7.1, split between 45 in core and 43 in the editor. Notable improvements include a new accessible tooltips API, redesigned post list tables that identify rows by title instead of checkbox, and a decorative toggle for the Image block.

Therefore, focus indicators have been strengthened throughout the interface. However, Dolson acknowledges one known regression: the Media Library’s infinite scroll pattern remains inaccessible. He provides three methods to disable this feature for users who need alternative navigation options.

New Tools Simplify WordPress Contribution

JuanMa Garrido released version 1.0 of the WordPress Contributor Toolkit just in time for WordCamp US Contributor Day. This desktop application eliminates the technical barriers that previously complicated first-time contributions to WordPress core.

New contributors no longer need to install Git, Node.js, and Docker manually. The toolkit handles setup automatically through a wizard interface. Additionally, contributors can link Trac tickets, apply and test patches on running sites, then open pull requests or attach patches—all without extensive technical knowledge.

Block Editor Paper Cuts Initiative Launched

Ella van Durpe opened a new round of Block Editor Paper Cuts targeting the WordPress 7.2 cycle. The initiative addresses 48 small annoyances that accumulate over time, including improvements to appenders and inserters, writing-flow enhancements, and long-standing bugs.

Nine items are already completed, and several more have pull requests in progress. Consequently, users experiencing issues with pasting from Excel, Safari selection quirks, or multi-block selection on iOS should test the proposed fixes and provide feedback.

What WordPress 7.1 Means for Site Builders

Elliott Richmond tested fourteen WordPress 7.1 features hands-on against the release candidate, providing practical insights beyond release notes. His video demonstration covers responsive styling controls, custom breakpoints in theme.json, and hover, focus, and active states.

The review also examines new Icon, Tabs, and Playlist blocks, along with the media editor modal and mark-as-decorative accessibility option. Thirteen features received positive evaluations, with only one requiring users to adjust their workflow slightly.

Client-Side Media Processing Transforms Image Handling

Carlo Daniele explained how WordPress 7.1 shifts image processing from servers to browsers. The implementation uses libvips compiled to WebAssembly, producing images approximately 15% smaller while reducing server CPU and RAM usage.

Furthermore, the update includes rich-text Notes with @mentions, the Playlist and Tabs blocks, and four new Abilities API lifecycle filters. Design tokens enable plugin developers to style admin screens consistently with the WordPress interface.

Impact on Custom Field Builders and Plugins

Lua Nguyen addressed concerns about WordPress 7.1’s compatibility with custom field builders. Meta Box users can upgrade without modifications because Meta Box blocks already run on Block API v3 with modal-based editing.

Client-side media processing automatically covers Image fields. Moreover, editable blocks inside Custom HTML give developers finer control over what clients may modify, enhancing security and workflow management.

WooCommerce 11.0.1 Security Update

Brian Coords detailed WooCommerce 11.0.1’s security and compatibility improvements. The update implements stronger, salted hashing for guest session cookies and sanitizes notices in Cart and Checkout blocks.

Additionally, capability checks now protect image matching, onboarding, and Marketplace endpoints. Faster logging reduces checkout latency for stores with large log backlogs. The update also prepares the Orders list for WordPress 7.1’s changed list-table markup, making it essential to update before August 19.

Theme Development and Block Visibility Features

Eric Karkovack demonstrated how to hide WordPress blocks based on device size without plugins or custom CSS. His tutorial shows how to create two versions of a hero section, then use WordPress 7.0’s Block Visibility controls to display the appropriate version for each screen size.

This approach complements the responsive block styles arriving in WordPress 7.1. Gina Lucia clarified the distinction between WordPress patterns and reusable blocks, explaining how synced patterns maintain connections while regular patterns become independent copies once inserted.

Building Custom Gutenberg Blocks

Emre Ekener published a six-step tutorial for building custom Gutenberg blocks from scratch. The guide walks developers through scaffolding a complete plugin with one npx command, then building an editable call-to-action block with heading, description, and button elements.

The tutorial covers essential concepts including attributes in block.json, the separation between edit.js and save.js, RichText for inline editing, and InspectorControls for sidebar settings. As Ekener notes, complexity scales with requirements, but the fundamental structure remains consistent.

AI Integration and WordPress Development

The WPShout team published a developer guide to AI connectors and wp_ai_client_prompt(). The system allows site administrators to configure an AI provider once, enabling all plugins to access it without storing keys in individual plugin settings.

However, developers should note that WordPress core doesn’t include spending limits by default. Therefore, every AI feature should verify support before executing requests. The guide includes a complete post-summarizing plugin example where actual AI work requires only five lines of code.

Abilities API Expands in WordPress 7.1

Greg Ziółkowski outlined the Abilities API enhancements coming in WordPress 7.1. The release introduces an execution lifecycle observable through actions and controllable via filters, plus a shared preparation layer that converts canonical schemas into portable Draft 4 copies for REST and AI clients.

Discovery filtering in wp_get_abilities() now supports category, namespace, and metadata parameters. Each extension point includes working code examples and trade-off considerations to help developers choose appropriate implementation strategies.

Original Source: gutenbergtimes.com