WordPress

Presence API 0.18.0 shipped with the session hash and core's copy of each API function winning once it exists, following 0.17.0's per-piece opt-out and $args array for presence functions. The feature plugin's merge criteria are tracked on issue #550, with HTML validation and a security audit still unclaimed, and the readiness gate for a core proposal counted from 0.17.0 puts December 3 as the earliest date.

Ticket #66258 proposes making the Toolbar's W always link to the Dashboard and the site name always link to the site, with the same menu everywhere, after the persistent Toolbar in 7.1 made existing inconsistencies more visible. Feedback is due by October 16, ahead of 7.2 Beta 1 on October 20.

Feature Notifications, the unified WordPress notifications project dormant since 0.2.0 in April 2023, has a release plan for 0.3.0 that targets 1 December 2026 alongside the final WordPress 7.2 RC. The MVP requires implementing the persistence and subscription repositories, a PHP API for emitting notifications, REST endpoints with a capability model, polling and persistent dismissal, plus fixes for an open permission check on the subscriptions endpoint, output escaping, URL validation on notification actions, and timezone handling.

wpdb::set_sql_mode() now removes NO_BACKSLASH_ESCAPES from the session SQL modes on connect, adding it to the unsupported list alongside STRICT_ALL_TABLES, TRADITIONAL, and ANSI, so escaped queries no longer fail or return wrong data on servers that enable it. Sites that need the mode can restore it via the incompatible_sql_modes filter in a db.php drop-in.

WordPress replaced the wp_kses() implementation with one built on the HTML API, changing normalization behavior: text nodes and syntax tokens are deterministically re-serialized, tags lowercased and attributes double-quoted, ambiguous ampersands resolved as browsers do, and content previously swallowed by the legacy parser preserved. The legacy implementation remains available for now via the wp_kses_force_legacy_parser filter but will be removed in a future release.

New UI components include Meter, Progress with custom color support, and SearchableSelectControl. The Interactivity API adds a data-wp-html directive and a router with reactive navigation lifecycle, while block library enhancements add shadow, minimum width/height, duotone, and border support across dozens of blocks.

WordPress proposes minor CSS Coding Standards updates needed before Stylelint can be adopted in Core and the Continuous Integration pipeline. Blank line rules are simplified to one blank line between sections and blocks, and new rules discourage the order property and *-reverse values for accessibility reasons.

The next WordPress Developers Chat takes place Wednesday, October 7, 2026 at 15:00 UTC in the #core Slack channel, focused on discussion for upcoming releases with an open floor section. Agenda announcements include the 7.1.3 security release, the WordPress 7.2 release party schedule, Core Trac and GitHub spring cleaning, Presence API updates, and what's new in Gutenberg 24.1.

WordPress 7.1.3 ships 7 security fixes, among them a stored XSS on the Comments administration page exploitable via pending comments, a second-order SQL injection in WXR export, unauthenticated disclosure of comments on private and unpublished posts, and an XSS in Imgur embeds. The release also includes 4 bug fixes and is recommended for immediate update.

Script prefetching was committed in changeset 64120, with the next step being to default script and style concatenation to off outside development environments ahead of removing load-scripts.php and load-styles.php and their concatenation and compression logic. PHPStan 2.3.0 cut a full uncached analysis of WordPress core from 60 seconds to 8 seconds.

WordPress 7.2 is scheduled for release on December 8, 2026, with Beta 1 starting October 20 and three release candidates running through early December. The schedule stays in effect through the RC phase and final release, with parties held in the #core Slack channel and all contributors invited.

Core Component Maintainers and Core Bug Gardeners lists were updated to remove contributors who moved on, stopped contributing regularly to a component, or never connected their GitHub and WordPress.org accounts. New GitHub teams for Gutenberg contributors, core component maintainers, and bug gardeners were added to wordpress-develop with triage-level access.

AI agents editing over REST or MCP now write a presence row in that post's room, expiring about 75 seconds after their last save and shown with an Agent badge. Post locks moved out of post meta into the presence table so refreshing a lock no longer invalidates cached post queries on sites with a persistent object cache.

“What’s new in Gutenberg…” posts (labeled with the #gutenberg-new tag) are posted following every Gutenberg release on a biweekly basis, showcasing new features included in each release. As a reminder, [here’s an…

Changelog

Features

Components

• UI: Add CheckboxGroup form primitive. (82556)
• UI: Add RadioGroup form primitive. (83038)
• UI: Add RadioGroupControl.…

The September 30, 2026 developers chat will discuss the Secrets API and the 2FA integration PR ahead of the 7.2 beta period, plus announcements on Gutenberg's move to Vitest, a Trac MCP server, Contributor Toolkit 1.2, and a new Core release tools repo.

WordPress announced a public MCP server that lets Claude, ChatGPT, and other MCP clients read tickets, changesets, and timeline history from every WordPress.org Trac with no account or API key. It exposes searchTickets, getTicket, getChangeset, getTimeline, and getTracInfo tools, with Core Trac as the default and endpoints for Meta, Themes, Plugins, bbPress, BuddyPress, GlotPress, and GSoC.

WordPress 7.1.1 shipped with 17 Core bug fixes, 19 Block Editor fixes, and 11 security fixes, followed shortly by 7.1.2 fixing one important security issue. The 7.2 cycle is underway with Ipsum as the new default theme and a roadmap published.

WordPress is moving away from in-person live release events to a livestreamed Zoom webinar format that lets more of the release squad participate without travel. The change starts with WordPress 7.2, due early December 2026.