core Archives - WP Gazette

Home core

Developer's desk at night with monitors showing code, illustrating the WordPress 7.1.1 release candidate test window

September 14, 2026

WordPress 7.1.1 RC Is Out: 16 Core Fixes, 22 Gutenberg PRs

WordPress 7.1.1 Release Candidate 1 is out, with the final bug-fix-only release set for 17 September. It covers 16 Core tickets and 22 Gutenberg pull requests, and it lands after Contributor Day surfaced a performance regression in 7.1.

Core & Releases

A small team plans a release timeline on a whiteboard, illustrating the WordPress 7.2 release squad at work

ByWP Gazette

September 7, 2026

WordPress 7.2 Release Squad: Mullenweg Back as Lead

Jeffrey Paul announced a 12-person WordPress 7.2 release squad on Make WordPress Core, with Matt Mullenweg back as release lead and the Twenty Twenty-Seven theme leads on board. Final release is pencilled in for 8-10 December, alongside State of the Word.

Industry & Business

A dimly lit server room with one glowing rack, illustrating the WordPress Core Security Initiative and its vulnerability backlog

ByWP Gazette

August 28, 2026

WordPress Core Security Initiative Promises Zero Backlog

WordPress has committed to clearing its security backlog to zero and scaling triage against an AI-driven surge of vulnerability reports. Plugin and theme authors should expect a compressed CVE lifecycle.

Devs & AI Tooling

Open server rack at night with a glowing encrypted key module, illustrating where the WordPress Secrets API would store credentials

ByWP Gazette

August 26, 2026

WordPress Secrets API Lands as a 7.2 Proposal: Four Functions, No Off Switch

Eric Mann's proposal for a WordPress Secrets API would give core a first-class place to store credentials, with encryption that cannot be switched off. It ships as a feature plugin first, and it has known limits.

Devs & AI Tooling

Laptop showing the WordPress 7.1 block editor preview during a conference closing keynote, with a printed schedule beside it

ByWP Gazette

August 19, 2026

WordPress 7.1 “Mary Lou” Ships From WordCamp US

WordPress 7.1 "Mary Lou" closed out WordCamp US on 19 August 2026, merging ten Gutenberg releases into Core. Responsive styling and a new media editor lead the changelog.

Core & Releases

Server rack at night with a red status light and a laptop running a terminal, illustrating the WordPress 7.0.4 security release.

ByWP Gazette

August 12, 2026

WordPress 7.0.4 Patches an Imagick RCE Six Days After 7.0.3

WordPress 7.0.4 is a security-only release that patches CVE-2026-65640, an authenticated remote code execution flaw in installs using Imagick with Ghostscript. It lands six days after 7.0.3 and is backported to every branch back to 4.7.

Security

A dim server-room corridor with a glowing login terminal beside a partly open door, illustrating the WordPress 7.0.3 security release

ByWP Gazette

August 6, 2026

WordPress 7.0.3 Patches Pre-Auth Login XSS and 11 More

WordPress 7.0.3 shipped on 6 August 2026 with fixes for 12 security issues in Core. The headline is an unauthenticated reflected XSS on the login screen that can, in specific conditions, reach PHP execution.

Security

Developer desk at night with monitors showing code, illustrating WordPress 7.1 RC1 testing before the final release

ByWP Gazette

August 5, 2026

WordPress 7.1 RC1 Ships With 145 Fixes and an SVG Icon API

WordPress 7.1 Release Candidate 1 shipped with more than 145 updates, a new SVG Icon API and the Field Guide. The final release lands 19 August, the closing day of WordCamp US.

Core & Releases

Developer's desk at night with a release checklist and a circled date, illustrating the WordPress 7.1 Beta 4 timeline

ByWP Gazette

July 30, 2026

WordPress 7.1 Beta 4: Classic Block Stays, React 19 Slips

Beta 4 of WordPress 7.1 keeps the Classic block in the inserter, drops Unicode email address support six weeks after it merged, and confirms React 19 will not ship in this cycle.

Core & Releases

Laptop in a dark server room showing update logs during the WordPress 7.0.2 security release

ByWP Gazette

July 17, 2026

WordPress 7.0.2 Security Release Forces Updates Tonight

WordPress 7.0.2 shipped on 17 July 2026 to patch a broken access control flaw and an SQL injection that chain into unauthenticated remote code execution. WordPress.org has turned on forced updates, but you still need to verify every site yourself.

Security