This week in WordPress

12 Sep 2026 Safer plugin updates, a strange week at Automattic and an Events Calendar fix Plugin vulnerabilities WordPress.org now blocks risky plugin updates before they reach your site Automattic's board put Matt Mullenweg on leave. He was back 33 hours later WooCommerce plans to need PHP 8.1 or newer from January 2027 5 Sep 2026 Elementor Pro under attack, WooCommerce 11.1 lands and a Gravity Forms fix Active attacks Nearly one in five WordPress sites are still running PHP 7.4 WooCommerce 11.1 arrived two days late, with free variation image galleries Elementor Pro is under attack. Make sure you are on 4.2.2 or later 29 Aug 2026 AI bug hunters, a WordPress security push and a ManageWP login bypass Plugin and theme fixes AI tools are finding WordPress security bugs faster than ever WordPress may finally get a safe place to keep API keys WooCommerce 11.1 is due on Tuesday 1 September