This week in WordPress, security takes center stage with multiple supply-chain incidents shaking the ecosystem. Alongside the latest WordPress 7.0 and WooCommerce updates, WordPress.org introduces new plugin review measures, while fresh data highlights why keeping your site updated has never been more important.
Kinsta – The AI & Bot Traffic Reality Check
Smart WordPress pros are already blocking this. Are you still letting it in?
AI bot traffic grew 300% in a single year. By late 2025, one in every 31 web requests came from an AI crawler. Scrapers, broken automation loops, and aggressive crawlers are quietly draining your server resources, skewing your analytics, and slowing your site.
Kinsta analysed more than 10 billion requests to expose exactly what’s happening and what site owners who act now can do about it.
Peak Performance WordPress Hosting, No Compromises
Leave single-server hosting in 2015. Choose autoscaling Managed WordPress Hosting built for traffic surges, complex sites & demanding PHP workloads, all without missing a beat.
↑ Brought to you with support from these partners
🏷️ SureContact Early Bird Deal Closing Soon
Still paying monthly for your marketing CRM? Lock this in for life instead. SureContact is offering a rare Early Bird Lifetime Deal for businesses that want a powerful CRM built for serious marketing, automation, and conversions, without recurring fees.
This is a premium, performance-focused platform, and the window is closing fast. Only 144 of the 500 exclusive lifetime spots remain. When they’re gone, this offer is gone for good. If you’ve been waiting for the right moment to upgrade your marketing stack, this is it.
What You Get with SureContact Lifetime
• Manage up to 100,000 contacts
• Send unlimited emails
• Use your own sending infrastructure like Amazon SES to keep ongoing costs near zero
💡 WordPress Spotlight
1.2 Million Sites Hit in OptinMonster CDN Hack: Attackers compromised Awesome Motive’s CDN infrastructure and slipped malicious JavaScript into OptinMonster, TrustPulse, and PushEngage, creating rogue admin accounts and installing a shape-shifting backdoor plugin across 1.2M+ sites. Check your users list for unfamiliar “developer_api1” accounts and rotate credentials now. (Source)
Even Licensed Updates Were Poisoned in ShapedPlugin Attack: A max-severity CVE (10.0) hit ShapedPlugins Pro releases after attackers compromised the build pipeline itself, meaning legitimately licensed updates delivered malware that stole 2FA codes and wp-config.php secrets. If you run their Product Slider or Testimonials plugins, patch immediately. (Source)
78,000 Plugins Now Get a Wapuu Named Gandalf as Bodyguard: Mullenweg’s “Protect the Shire” initiative puts every WordPress.org plugin and theme through mandatory AI-powered review with a 24-hour cooldown before reaching sites via auto-update. It’s WordPress’s biggest supply-chain security move yet, timed to land alongside WordCamp Europe. (Source)
24-Hour Delay Also Blocks Manual Updates, Developers Discover: What Mullenweg’s announcement framed as an auto-update-only delay turns out to hold back one-click dashboard updates too, leaving admins unable to install patches they can already see in the changelog. Elementor and other major plugin makers are now warning this creates a dangerous window where security fixes are public but not installable. (Source)
WordPress 7.0 Ships With AI Baked Into Core: The field guide confirms native AI Connectors for OpenAI, Google, and Anthropic, a redesigned “Modern” admin theme, visual revision comparisons, and a new Breadcrumbs block. It’s the clearest signal yet that WordPress core is betting big on AI-assisted publishing. (Source)
One Fatal Error, One Quiet Fix in WooCommerce 10.9.3: This dot release patches a fatal error in WC_Email::send_notification() triggered when a filtered mail callback returns a non-bool value. Small fix, but if you’re running 10.9.x with custom email filters, worth grabbing right away. (Source)
86% of WordPress Sites Are Running Outdated Software: Censys scanned the visible web and found only 14% of sites run the latest WordPress version, with many still on end-of-life PHP. A defacement campaign has already hit 900+ sites in June alone, proving attackers are automating the hunt for stragglers. (Source)
Elementor Cuts 100 Jobs as AI Reshapes Website Building: The platform behind 25 million sites is laying off roughly 30% of its workforce, calling it a “reset” for an era where AI agents not just humans, are becoming key builders and navigators of the web. Founders say the company remains profitable but is restructuring into a leaner, flatter team focused squarely on its core product. (Source)
WordPress 7.0.1 RC1 Lands Ahead of July 9 Release: This bug-fix-only maintenance release cleans up over a dozen issues from the 7.0 cycle, including a broken network credit.php header logo, misaligned Media Library spinners, and a CSS bug that corrupted valid background-image declarations. Final release is locked for Thursday, July 9 test now via the Beta Tester plugin before then. (Source)
WP Credits Hits 2026 Goal at the Halfway Mark: The program bringing students into WordPress contribution work has already signed 20+ school partnerships meeting its yearly target six months early and is now shifting focus from growth to quality, with a public impact dashboard and formal alumni retention path planned before pushing toward 35 partnerships by year-end. (Source)
🏷️ Exclusive LIFETIME Deals Digest
Stop paying monthly for your favorite tools. We’ve curated an elite collection of Lifetime Deals that allow you to invest once and profit forever. Grab these high-end, premium WordPress solutions at a massive discount today and enjoy professional-grade performance without the recurring fees.
✨ Fresh Features Rollout
Studio’s CLI Just Became a Full Workflow Companion: New commands let you log into WordPress.com, manage Preview Sites, and enable SSL for custom domains all from the terminal. Local WordPress development keeps inching closer to a production-like experience. (Source)
Rank Math Hands Its SEO Data to AI Agents: New MCP tools let AI assistants pull link reports, post-level SEO meta, and schema markup directly from your site, while the PRO tier adds AI Visibility to track your brand’s presence across ChatGPT and other AI platforms. (Source)
WooCommerce’s Dev Blog Is Building for an AI-Automated Future: Between the new canonical abilities API, experimental GraphQL infrastructure, and three dot-releases shipped in two weeks, Woo is clearly racing to make its core AI-and-agent-ready. (Source)
Wishlist Plugins May Finally Be Obsolete: WooCommerce’s new Shopper Lists call for testing brings native Save-for-Later and Wishlists into core as opt-in experimental features, ending the era of stitching together third-party wishlist plugins with incompatible data models. (Source)
Gutenberg Times Covers Playground’s Shareable Theme Demos: The AI Experiments plugin now ships a new Abilities Explorer screen, and theme builders can share links that launch complete working demos entirely in-browser with no local server needed. (Source)
Tutor LMS 4.0 Drops in 24 Hours With a Complete Overhaul: The release brings a fully revamped learning experience with an app-like mobile interface, new interactive quiz types, and a dedicated Kids Mode for younger learners. It also ships full GDPR compliance and a redesigned dashboard for every user role, one of Tutor LMS’s biggest updates yet. (Source)
🆕 Fresh Releases
Post Status Keeps the Community Pulse Live: Your always-on feed for WordPress business shifts, ecosystem drama, and community news as it breaks. (Source)
GravityView 3.0 Ships Its Biggest Update in Years: A five-day feature reveal delivered built-in modern View themes, native page builder support for Divi/Beaver/Elementor, front-end bulk actions, and an opt-in AI connector that lets Claude or any MCP-compatible assistant build and edit Views in plain English. It’s a free update for active license holders, fully backward-compatible with existing Views. (Source)
wpDataTables Rolls to Version 7.5.1: The tables-and-charts plugin picked up its latest update on June 28, continuing its steady cadence of stability improvements for sites building responsive data tables, dynamic charts, and WooCommerce-synced product tables from Excel, CSV, JSON, and SQL sources. (Source)
WPBakery 9.0 Beta Opens for Its Largest Testing Program Ever: Nearly a year in the making, this release overhauls CSS loading with smart asset splitting, refreshes the editing UI, and adds new developer attributes for custom elements all aimed at the 6+ million sites running WPBakery. Beta is live now for direct license holders (staging only, please) ahead of a late-July launch. (Source)
SearchWP 4.6.0 Finally Makes Faceted Search Behave: Previously, bolting a filter plugin onto search results scrambled SearchWP’s relevance ranking. This release integrates natively with WPFilters so filtering happens before ranking, plus ships two new sidebar widget areas for building two- or three-column filtered results layouts no page reload required. (Source)
🗓️ Mark Your Calendar
If you’re looking for opportunities to network and learn, check out these upcoming WordPress events and meetups:
Flagship WordCamps
August 16 – 19, 2026: WordCamp US 2026, Phoenix, Arizona.
April 09 – 11, 2027: WordCamp Asia 2027, Penang, Malaysia.
Offline Events for WordPress
September 23, 2026: LoopConf 2026, event for WP developers & engineers.
October 16, 2026: WP Suomi 2026, for Nordic WP enthusiasts, Oulu, Finland.
Upcoming WordCamps
September 11, 2026: WordCamp Switzerland 2026, Fribourg, Switzerland.
September 18, 2026: WordCamp Bretagne 2026, Rennes, Brittany, France.
October 03, 2026: WordCamp Rajasthan 2026, Jaipur, Rajasthan, India.
November 05, 2026: WordCamp Canada 2026, Vancouver, Canada.
November 12, 2026: WordCamp Netherlands 2026, Netherlands.
November 13, 2026: WordCamp Pisa 2026, Pisa, Italy.
Wrap-Up
That’s a wrap for this week’s WPDigest! Stay tuned for more exciting WordPress updates next week.
Want to feature your WordPress product, service, or update news? Submit it for free using our form, helping spread the goodness of WordPress!
📩 Enjoyed this digest? Share it with your network!
