Hi there,

It was another busy release week: the WordPress 7.0.3 security update, WordPress 7.1 RC 1, and Gutenberg 23.7 all landed. More on each below — but before you keep reading, update all your sites to 7.0.3 now. This newsletter can wait…

If you are traveling to Phoenix: safe travels, and pack a sweater — the AC will be cranked up high in every building! This year, I will see you on the WCUS Livestream.

Have a great weekend!

Yours,
Birgit

Developing Gutenberg and WordPress

WordPress 7.0.3 shipped as a security release fixing twelve vulnerabilities, so update your sites right away if automatic background updates aren’t already handling it for you. Release lead John Blackbourn lists the fixes, including a pre-auth XSS on the login screen that could lead to PHP code execution, several contributor-level stored XSS issues, and a multisite privilege escalation. Backports reach all supported branches down to 4.7, and 7.1 RC2 carries the fixes too.

To appreciate the huge effort by the security team to get this release out, consider the numbers: until earlier this year, there were 20 to 30 reports per month; now that number has jumped to 450 per month. Both security updates, 7.0.2 and 7.0.3, were backported not only to the two officially supported versions, 6.9 and 7.0, but all the way back to version 4.7. That’s two dozen major versions that needed updating. See also Rae Morey’s story in The Repository: WordPress 7.0.3 Patches 12 Vulnerabilities as Bug Bounty Reports Climb to 450 a Month.

August 19 is the scheduled final release date, and Benjamin Zekavica announces WordPress 7.1 Release Candidate 1 ready for your test sites. Since Beta 4, more than 145 updates landed — 57 in the Editor, 88 in Core — plus new features like the Icons API, shareable revision links, and email notifications for @mentions in Notes. Plugin and theme authors: wrap up testing and bump your “Tested up to” to 7.1. WordPress Playground lets you try it straight in the browser.

Milana Cap counts more than 310 Core Trac tickets, twenty new hooks, and roughly 600 Gutenberg enhancements in the WordPress 7.1 Field Guide, your linked index of every dev note for the August 19 release. Highlights range from client-side media processing and the always-iframed post editor to the SVG Icon API, responsive block styles, and the persistent admin bar. A candid closing section covers what didn’t make it, from the Classic block’s reprieve to real-time collaboration and React 19.

The post editor is always iframed in WordPress 7.1, and the escape hatch that let one apiVersion 2 block pull a whole post out of the iframe disappears. That’s the compatibility risk topping the developer’s audit list for WordPress 7.1 by release coordinator Benjamin Zekavica. He sorts each section by risk level, walks through the SVG Icon API’s strict sanitizer, responsive block styles, and the new DataViews filters, and closes with a checklist for your August 19 release.

The latest episode is Gutenberg Changelog #133 – Gutenberg 23.6 Release and WordPress 7.1

The Gallery block’s ambiguous “Convert to images” button becomes “Detach,” complete with a modal explaining what happens — one of many refinements Jonathan Bossenger walks through in what’s new in Gutenberg 23.7. You’ll also find the Global Styles inheritance UI now opt-in via the Experiments page, LaTeX errors in the Math block waiting until you leave the field, and fixes for floated blocks overlapping sticky ones and Pullquote line heights in the editor.

Plugins and Tools for #nocode site builders

Variable product pages load roughly 9 to 12 percent faster and large stores get snappier Order screens, Brent MacKinnon reports in what’s new in WooCommerce 11.0. Analytics also grows more trustworthy: refunds now count in the period they happened, session counts exclude bots, and you can rerun incomplete historical imports. Guest customers can claim past orders when they create an account, and a Checkout Recovery beta lets you test messaging before a full rollout.

Getting Site Editor changes out of the database and into version control has frustrated agency developers for years, and Brian Coords argues agents make it urgent again. His experimental agent-first approach to Create Block Theme, wp-theme-control, wraps the upcoming WP-CLI 3.0 wp block commands in bash scripts and an agent skill: a plan command lists database changes, then you dry-run, export them into your theme, and optionally clear the database copies. He’s collecting feedback ahead of his WordCamp US talk.

Clients pinning comments straight onto your live pages — no logins, no email chains, no PDF round-trips — is the pitch of Ben Elwood‘s Reviso client feedback and approvals plugin. Among other page builders it’s native to the block editor, with threaded replies, status tracking, and review links that work even in maintenance mode. Version 1.5.2 switches on Suggest mode by default, so reviewers propose wording changes like tracked changes and your team applies them with one click.

Bas Buis released Dynamic OSM Maps, a plugin that adds interactive maps without Google API keys or recurring fees. The lightweight block runs on OpenStreetMap and Leaflet: in the free version you enter addresses manually, while Pro connects your custom fields — coordinates, addresses, or repeaters — for unlimited markers and popups. That opens the door for directory and listing sites to render stored location data straight onto the map.

Emily Rapport opens with Dutch tulip mania to frame the rush of llms.txt files and AI-visibility subscriptions, then does something rarer: shares a year of her own content work with real Search Console data. Her rewritten maintenance page climbed from position 50 to 13 and collected exactly five clicks — yet three inquiries arrived saying “I asked ChatGPT.” Her takeaway: publishing consistently across real topics beats chasing one niche, and you still can’t reliably trace an AI recommendation to a page.

Building Blocks and Tools

The WooCommerce Developer Blog follows up its All Products proof of concept with the why behind it. Veronica Fasulo and co-authors lay out the value of DataViews and who it’s for: you describe a field once and it powers the list column, Quick Edit, bulk edit, and forms, instead of four hand-wired implementations. Merchants get switchable views without page reloads, extension developers get registration instead of DOM patching — and the team openly asks whether DataViews is even the right foundation.

What’s new in Playground?

A customizable Dock, auto-save, and live visual previews of your saved instances headline the new WordPress Playground UI, which Fellyph Cintra demos on WordPress.tv. The video walks through importing projects from GitHub or Zip files, previewing Core and Gutenberg pull requests, and the built-in file editor, database manager, and error logs — plus switching WordPress versions all the way back to 0.7. Feedback goes to the Make Playground blog or the #playground Slack channel.

AI in WordPress

Vercel, a major platform shipped the Vercel AI Gateway Provider plugin, by former Core AI team rep Felix Arntz. One API key unlocks hundreds of models from over 40 providers. Any AI Client plugin on your site can route text, image, and video generation through the Gateway — including the Photo to Post demo from Jonathan Bossenger’s tutorial. Automatic fallbacks kick in during provider outages, and you pay provider rates without platform fees.

Your AI agent designs a beautiful page, and Gutenberg freezes it into one uneditable Custom HTML blob. Human Made’s answer is Block Runner, now open-sourced on GitHub: a deterministic Node CLI that converts generated HTML into properly nested native blocks — wp:cover, wp:columns, wp:buttons — with real attachment IDs, and validates every result against headless Gutenberg. In the team’s benchmark, raw models writing block markup score 35 to 73; paired with Block Runner, the same models hit 93 to 99.

Readers may remember Chris Huber’s Block Format Bridge from a few months back — it tackles the same gap from inside WordPress, converting Markdown and HTML server-side at insert time, while Block Runner works the pipeline side with its validation gate and CI hooks. Two open-source answers to the same question is a good sign the agentic content problem is getting real attention.

A third piece of the puzzle: the official WordPress agent-skills repository takes the prevention route, teaching AI coding assistants to write valid block markup in the first place. For a lighter-weight approach, you can also point your AI agent straight at the updated Core Blocks Reference, where each block’s page now documents its markup, attributes, supports, and allowed nesting.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.

Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.

For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com

WordPress 7.0.3 is now available

WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.

You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support automatic background updates will begin updating shortly.

For more information, please visit the WordPress 7.0.3 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities and allowing them to be fixed in this release:

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai.
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by N05ec@LZU
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by Omar Hasan
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

Backports

As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

WordPress 7.1 RC2 has also been released, containing all applicable fixes.

CVE and GHSA references

Details of the login screen XSS vulnerability can be found in the advisory: CVE-2026-64638 / GHSA-52p2-r8wf-jcrf.

Thank you to these WordPress contributors

This release was led by John Blackbourn. In addition to the security researchers mentioned above, WordPress 7.0.3 and its backports would not have been possible without the significant contributions of the following people:
Aaron D. Campbell, Aaron Jorbin, Adam Silverstein, adrianmoldovanwp, Aki Hamano, Alex Concha, Andrew Duthie, Andrew Serong, annezazu, Barry, Bernie Reiter, Daniel, Daniel Richards, David Biňovec, Dennis Snell, Ehtisham Siddiqui, Erwan Le Rousseau, Fabian Kaegy, fiocavallari, George Mamadashvili, gubser, Isabel Brison, Jarda Snajdr, Jb Audras, Jeremy Felt, Joe Dolson, Joe Hoyle, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Khokan Sardar, Lance Willett, lucasbustamante, lucatume, Marco Ciampini, Marin Atanasov, Mohammad Jangda, Mukesh Panchal, Paul Kevan, Peter Wilson, ramonopoly, SergeyBiryukov, vortfu, Weston Ruter