WordPress spent the week walking back one editor change, shipping a maintenance release, and locking down API keys in its AI plugin. Underneath it, the numbers told a rougher story: plugin sales cooling off and the foundation that funds WordCamps running a deficit tied to Automattic’s legal fight with WP Engine. Here’s what happened and what to do about it.
Block Editor: A reversal, a preview, and a peek at the future admin
WordPress reversed course on hiding the Classic block. Two weeks after announcing a plan to remove it from the inserter in version 7.1, core committer Marin Atanasov scrapped the change entirely, saying the block should become “obsolete by choice, not by force.” If you never touch the Classic block, nothing changes for you. If you installed the Enable Classic Block plugin to prepare for the old plan, you can safely remove it, since WordPress has closed it in the plugin directory.
A more welcome change is in testing now. WordPress 7.1 will let you style blocks differently per device directly in the editor, no custom CSS required. Turn on “Responsive editing,” switch the canvas to tablet or mobile, and adjust font size, spacing, or color for just that screen. It builds on the show/hide-per-device feature from WordPress 7.0. You can try it now on WordPress Playground with no setup; Beta 1 lands July 15.
Further out, Automattic developer Andrew Duthie has proposed design system theming for 7.1, a shared set of design tokens for color, typography, and spacing across wp-admin. It won’t change how your dashboard looks yet, but it’s the groundwork for a long-promised admin redesign, including an eventual dark mode. The last redesign attempt shipped as just a CSS refresh in 7.0, which even Matt Mullenweg called a letdown; this is the infrastructure meant to make the next attempt stick.
Security: 7.0.1 shuts down a registration-page spam trick
WordPress 7.0.1 is out, fixing 31 bugs across Core, the admin UI, and media handling. Sites with automatic background updates already have it; everyone else should update from the dashboard at the next maintenance window.
The fix worth knowing about didn’t make most headlines: the account registration page could be abused to fire off spammy “login details” emails from your site’s own address, damaging your domain’s reputation in the process. WordPress closed that hole in 7.0.1, alongside a wp_kses() bug that was corrupting valid CSS background-image styles. No CVE was flagged, but if your site allows open registration, this release is worth prioritizing over a routine bug-fix update.
AI: Encrypting the keys you already handed over
WordPress’s official AI plugin shipped version 1.1.0, and the headline feature is overdue. Key Encryption scrambles the API keys you enter for providers like ChatGPT, Claude, or Gemini before storing them in your database; until now they sat in plain text, readable by anyone with access to a backup or export. It’s opt-in, but if you use the plugin, turning it on is a five-minute fix for a real exposure.
The same release adds Type-ahead Text, ghost-text writing suggestions in the block editor, and a core/read-settings ability that’s part of the broader Abilities API push letting AI agents read site data through permission-checked channels.
Business: Slower sales, and a foundation feeling the squeeze
The chatter about declining plugin sales has data behind it now. A survey of 33 plugin companies by Katie Keith found roughly 80% reported flat or lower new sales in 2025 versus 2024, and several shops have shut down or sold this year. It’s not universal: shops with heavier marketing or a differentiated product, like website management platform WP Umbrella, posted double-digit growth in the same window. The split suggests utility plugins in crowded categories are feeling AI-shifted search and buyer fatigue more than the market as a whole.
The WordPress Foundation is feeling its own squeeze. WordPress Community Support, the subsidiary that funds WordCamps and meetups, posted a $372,000 operating deficit for 2025, a $722,000 swing from the year before, even as event attendance grew 27% to nearly 27,600 people. Sponsorship and ticket revenue fell while event costs rose. The Foundation’s financials page also says WP Engine’s ongoing legal action threatens funding for scholarships and community programs. That dispute moved into trademark proceedings this week, with WP Engine filing a US opposition to “Managed WordPress”, a US opposition to “Hosted WordPress”, a Canadian opposition to “Managed WordPress”, and a Canadian opposition to “Hosted WordPress”.
Against that backdrop, Automattic released Code for the People, a 20-minute documentary making the case for open source and the open web. It’s a message-heavy move at a complicated moment, one the company has repeatedly tied to its framing of the WP Engine dispute as a fight to defend open source itself.
End of article