Make WordPress

Teams

Core

The coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. team makes WordPress. Whether you’re a seasoned PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. https://www.php.net/manual/en/index.php, HTMLHTML HTML is an acronym for Hyper Text Markup Language. It is a markup language that is used in the development of web pages and websites., JavaScriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com or CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. developer or are just learning to code, we’d love to have you on board. You can write code, fix bugs, debate decisions, and help with development.
Design

The design group is focused on the designing and developing the user interface. It’s a home for designers and UXers alike. There are regular discussions about mockups, design, and user testing.
Mobile

The mobile team builds the iOSiOS The operating system used on iPhones and iPads. and Android apps. Lend them your Kotlin, Swift, or ReactReact React is a JavaScript library that makes it easy to reason about, construct, and maintain stateless and stateful user interfaces. https://reactjs.org Native skills. The team also needs designers, UXUX UX is an acronym for User Experience – the way the user uses the UI. Think ‘what they are doing’ and less about how they do it. experts, and testers to give users a smooth experience on every device.
Accessibility

The a11yAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility) group provides accessibilityAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility) expertise across the project. They make sure that WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. and all of WordPress’ resources are accessible.
Polyglots

WordPress is used all over the world in many different languages. If you’re a polyglot, you can help by translating WordPress into your own language or contributing to the GlotPress project, making translations easier and more effective for everyone.
Support

Answering questions in the support forums, IRC, or SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ is one of the easiest ways to start contributing. Everyone knows the answer to something! Since the forums run on bbPress, you can also contribute by helping make the software behind them even better.

Latest activity

See the latest happenings across the entire project.

I am the pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. author for SquidCore – ERP & CRM Platform and Pingo Notify. I’m a native Brazilian Portuguese speaker and I’ve already imported complete pt_BR translations of both plugins for review.

https://wordpress.org/plugins/infixs-squidcore-erp/
https://wordpress.org/plugins/infixs-pingo-notify/

#pt_BR – @infixs

WordPress 7.2 adds the Secrets APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., which stores credentials such as API keys and OAuth client secrets encrypted, with one previous version kept for rotation. The original design is in the proposal and the history is on TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. #66187.

If you tested an earlier WordPress 7.2 betaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. or created a secrets.php drop-in, review the breaking changes since Beta 1 and beta migration instructions before upgrading.

Storing and reading a secret

$result = wp_set_secret( 'my-plugin/api-key', $api_key );

if ( is_wp_error( $result ) ) {
	// Nothing was stored. Keep the existing storage.
}

$secret = wp_get_secret( 'my-plugin/api-key' );

if ( $secret instanceof WP_Secret ) {
	$client->authenticate( $secret->reveal() );
} elseif ( null === $secret ) {
	// Never stored. Ask the user for it.
} else {
	// WP_Error: it exists but can't be read right now. Don't ask for a new one.
}

wp_get_secret() returns null only when the secret was never stored. When it exists but can’t be read, because the key or the database is unavailable, it returns a WP_Error. Keep the two apart: asking for a new credential on an error can replace one that still works.

Names take the form plugin-slug/secret-name, in lowercase letters, digits, hyphens and underscores. A name without a slash works but triggers _doing_it_wrong(). The prefix stops plugins from overwriting each other’s secrets. It isn’t access control, since any code running on the site can read any secret.

A name also cannot start or end with a hyphen or an underscore and only one slash is allowed.

WP_Secret shows [secret:my-plugin/api-key] when it is printed, logged, JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML.-encoded, or passed to var_dump() or var_export(). Serializing or cloning it throws an exception. Only reveal() returns the value, so call it where you use the value, and don’t cache the object.

Writing a new value moves the current one to WP_Secret_Version::PREVIOUS, so you can fall back to it while a rotated credential rolls out. Saving the same value again, as a settings form does, keeps the previous version. wp_retire_secret_version() deletes it when you’re done.

The other functions:

wp_delete_secret().
wp_list_secrets() returns names and metadata, never values.
wp_import_option_as_secret() copies an existing option into a secret. It leaves the option for you to delete and flags the secret for rotation, since the old value has already been through your backups.
wp_set_network_secret() and the other *_network_secret() functions store secrets for a whole networknetwork (versus site, blog) on multisitemultisite Used to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also network, blog, site. The site and network functions never fall back to each other.

The functions don’t check capabilitiescapability A capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability)., because they have to work from cron and REST. Check them wherever a user enters or manages a value. The wp_secret_changed action fires when a secret is created, updated, imported, deleted, or retired. It passes fingerprints, never values.

Checking that the API is available

The API needs WP_SECRETS_KEY, covered in the next section. Before moving an existing credential into it, check:

if ( wp_is_secrets_api_available() ) {
	// Move the credential.
} else {
	// Keep the existing storage.
}

This returns false in three cases:

the secrets.php drop-in failed to load;
WP_SECRETS_KEY is missing or not usable;
the key can’t decrypt the root key that is already stored, which happens when someone changes the key after secrets are stored.

A keyring or provider from a working drop-in counts as available. If its backend fails on a request, that call returns a WP_Error.

wp_secrets_provider_is_writable() returns false for a read-only provider, such as one backed by a secret manager that only the host can write to.

Setting `WP_SECRETS_KEY`

Secrets are encrypted with libsodium (XChaCha20-Poly1305) and stored in the options tables. Their keys are derived from a random root key, which is stored encrypted with WP_SECRETS_KEY from wp-config.php.

Without a usable WP_SECRETS_KEY, the API stores nothing, and every write, and every read of a stored secret, returns a secret_key_unavailable error. An empty key, the wp-config-sample.php placeholder, or a value copied from one of the authentication keys or salts doesn’t count.

New installs get a key: the installer fills it in along with the salts. Existing sites need one added. Site Health generates a line to copy into wp-config.php, below the salts:

define( 'WP_SECRETS_KEY', '…a base64-encoded random 32-byte key…' );

You can also make one with php -r 'echo base64_encode( random_bytes( 32 ) ), "\n";'. Hosts and tools that write wp-config.php should add the key when they add the salts. WP-CLIWP-CLI WP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/ https://make.wordpress.org/cli/’s wp config create is being updated to do the same.

Don’t treat the key like the salts. Once secrets are stored, changing or removing it makes all of them unreadable until the old value comes back. To replace it, follow the steps in the last section.

Replacing the keyring, store or provider

A host can replace part of the API with a wp-content/secrets.php drop-in, which loads like db.php:

WP_Secrets_Keyring: keep the key that encrypts the root key in a KMS or HSM.
WP_Secrets_Store: keep the encrypted records outside the options tables.
WP_Secrets_Provider: hand the whole API to an external secret manager.

<?php
// wp-content/secrets.php

class My_Host_Keyring extends WP_Secrets_Keyring {
	public function wrap( #[\SensitiveParameter] string $key_material ) { /* … */ }
	public function unwrap( string $wrapped ) { /* … */ }
	public function get_key_source(): string { return 'My Host KMS'; }
}

$wp_secrets_keyring = new My_Host_Keyring();

The drop-in sets $wp_secrets_keyring, $wp_secrets_store or $wp_secrets_provider. If it fails to load, or sets one to the wrong type, every call returns an error and Site Health reports it. The API never falls back to the defaults, because a misconfigured backend shouldn’t look like an empty one.

PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher doesn’t inherit attributes, so add #[\SensitiveParameter] yourself to any parameter that receives a key or a value. Conformance tests for keyrings and providers are in wordpress-develop under tests/phpunit/includes/secrets/.

Site Health

Three tests appear under Security:

Secrets API key source is recommended when the key is missing or not usable, and critical when it can’t decrypt the stored root key.
Secrets API: undecryptable secrets is critical when any stored secret can’t be decrypted.
Secrets API: credentials pending rotation is recommended when secrets are flagged, as imported ones are.

The Info tab has a Secrets API section with the provider, keyring, key source and the number of secrets.

In code, the tests are methods of WP_Site_Health, and the Info section is WP_Debug_Data::get_wp_secrets_api(), under the key wp-secrets-api (r65394). The wp_secrets_site_health_*() functions and the secrets-api key from the betas are gone.

Breaking changes since Beta 1

The following changes affect developers who tested earlier WordPress 7.2 betas or implemented custom drop-ins.

WP_SECRETS_KEY is required (r65385, r65389). In earlier betas, a site without it used a key derived from LOGGED_IN_KEY and LOGGED_IN_SALT, so rotating the salts made every secret unreadable. That fallback is gone. Secrets stored under it can be kept; see the next section.

The keyring, store and provider are abstract classes (r65390). They were interfaces, and an interface can’t gain a method without breaking every class that implements it. The method signatures are unchanged. Change implements to extends in your drop-in, and deployDeploy Launching code from a local development environment to the production web server, so that it’s available to visitors. it together with 7.2. A drop-in that still says implements is a fatal error on every request, and the API can’t catch it.

Smaller changes during the beta:

Drop-ins can set the overrides as plain variables, not only through $GLOBALS (r65378).
secrets.php is listed with the other drop-ins on the Plugins screen and in Site Health (r65374).
Names with a trailing newline are rejected (r65375).
A failed database read no longer replaces the root key (r65373).

If you stored secrets during the beta

Secrets stored on a beta without WP_SECRETS_KEY are encrypted under the old fallback. After updating, Site Health reports that they can’t be decrypted. They’re still there. Leave the salts alone until you’ve finished these steps, because the old key comes from them.

Generate a key with php -r 'echo base64_encode( random_bytes( 32 ) ), "\n";'. Add it and the old key to wp-config.php, below the salts:
define( 'WP_SECRETS_KEY', '...your new key...' );
define( 'WP_SECRETS_KEY_PREVIOUS', LOGGED_IN_KEY . LOGGED_IN_SALT );
Re-encrypt the root key with the new key: wp eval '$r = ( new WP_Secrets_Key_Manager() )->rotate_site_key( new WP_Secrets_Config_Key_Provider( true ), new WP_Secrets_Config_Key_Provider() ); echo is_wp_error( $r ) ? $r->get_error_message() : "Done.";'
Remove the WP_SECRETS_KEY_PREVIOUS line.

No stored secret is rewritten, and on multisite one run covers the network. If you already added WP_SECRETS_KEY, keep it and add only the second line. The same steps replace any key: put the old value in WP_SECRETS_KEY_PREVIOUS.

Props to @whyisjake for technical review and @jeffpaul for copy review.

#7-2, #dev-notes, #dev-notes-7-2

David Anderson / Team Updraft Yesterday at 10:12 pm

Will this be made available as a plugin for older WP versions? Otherwise, potential consumers are likely to delay starting to use it.

Eric Mann Yesterday at 10:15 pm

Absolutely. It’s been live at https://github.com/ericmann/secrets-api as a feature plugin (with docs at https://secretsapi.dev) since the original proposal.

This week’s meeting focused on WordPress 7.2 release readiness, including testing the Secrets APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., reviewing Abilities APIAbilities API A core WordPress API (introduced in 6.9) that creates a central registry of capabilities, making WordPress functions discoverable and accessible to AI agents, automation tools, and developers. Transforms WordPress from isolated functions into a unified system. changes, and preparing developer documentation ahead of Release CandidateRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge. 1. Contributors also agreed to move shared WordPress abilities into a dedicated Composer package under the WordPress GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ organization, discussed plans for AI pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. 1.6.0 and its evolving AI workspace experience, and reviewed PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. https://www.php.net/manual/en/index.php AI Client dependencies, documentation improvements, and plugin discovery on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/.

WordPress 7.2 Release Readiness

@jeffpaul encouraged contributors to continue testing the Secrets API ahead of WordPress 7.2, particularly on multisiteMultisite Multisite is a WordPress feature which allows users to create a network of sites on a single WordPress installation. Available since WordPress version 3.0, Multisite is a continuation of WPMU or WordPress Multiuser project. WordPress MultiUser project was discontinued and its features were included into WordPress core. Advanced Administration Handbook -> Create A Network. installations where testing coverage can be limited. The API provides an important foundation for additional capabilities planned for WordPress 7.3.

With WordPress 7.2 Release Candidate 1 approaching, the team also discussed preparing developer notes for the Abilities API functionality included in the release. @jeffpaul will coordinate with @jorgefilipecosta or @gziolo to ensure documentation is drafted, ideally in time for the release candidate and accompanying field guide.

@justlevine requested additional feedback on a TracTrac Trac is the place where contributors create issues for bugs or feature requests much like GitHub.https://core.trac.wordpress.org/. ticket proposing changes to how abilityAbility A registered, self-documenting unit of WordPress functionality that can be discovered and invoked through multiple contexts (REST API, Command Palette, MCP). Includes authorization and input/output specifications. permissions are defined. The underlying concern is allowing permissions to be enumerated without executing permission callbacks. Without sufficient feedback before the release, @justlevine suggested reverting the proposed change to allow more time to consider the public API.

The team also noted that previous input coercion changes have been reverted in favor of a new input preparation function. Follow-up pull requests are being prepared in the AI plugin and MCP AdapterMCP Adapter Translates WordPress abilities into Model Context Protocol format, allowing AI assistants like Claude and ChatGPT to discover and invoke WordPress capabilities as tools, resources, and prompts. to align with the updated implementation once the coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. changes land.

Shared WordPress Abilities Package

@nikskyverge shared progress on the proposed shared WordPress Abilities package, including proof-of-concept integrations for both the AI plugin and MCP Adapter.

The package would centralize the development and maintenance of reusable abilities, allowing multiple projects to consume them as a Composer dependency rather than maintaining separate implementations. This approach would also enable projects such as WooCommerce to use shared abilities without requiring the entire AI plugin.

Following discussions in previous meetings and the absence of objections to the overall approach, contributors agreed to proceed with moving the package into the WordPress GitHub organization. The final repository name and several implementation details remain to be determined.

The team also discussed several considerations for the package’s longer-term development:

Ability lifecycle: Establishing how abilities move from experimental implementations to stable functionality and potentially into WordPress core.
Development workflows: Supporting experimentation without creating unnecessary dependencies or blocking progress in consuming plugins.
Naming and compatibility: Avoiding the core/ prefix for abilities developed within the AI plugin to prevent conflicts with existing or future core abilities.
Maintenance: Establishing clear ownership for reviewing contributions, managing releases, and maintaining the shared package.

@nikskyverge volunteered to coordinate the initial migrationMigration Moving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies. and maintainership, with @justlevine offering additional support. Contributors emphasized the need to broaden maintainership over time to avoid creating a single point of failure.

@jeffpaul will coordinate with the WordPress systems and MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. teams to facilitate the repository transfer. Existing abilities pull requests can then be migrated or consolidated into the shared package as appropriate.

AI Plugin 1.6.0 and AI Workspace

@jeffpaul outlined priorities for AI plugin 1.6.0, currently targeted for the end of November and expected to be the last regularly scheduled major plugin release before WordPress 7.2. A primary focus is the evolving AI Workspace concept, which brings together ongoing site agent and Command Palette work into a more unified experience within WordPress.

The initial implementation would provide a chat-based agent experience directly inside WordPress, using models available through configured AI connectors. Unlike the broader WordPress 7.3 vision of connecting external agents and tools through MCP, this first version would focus on interactions that operate within WordPress itself.

The team also hopes to incorporate the shared abilities package as a Composer dependency in 1.6.0. @dkotter noted that approximately a dozen abilities pull requests are currently open and could be migrated to the new package rather than blocking the release. Additional abilities can continue to be developed and released independently as the package and its integration workflows mature.

PHP AI Client Dependencies and Security

@justlevine raised questions about whether the PHP AI Client requires dependency updates ahead of the WordPress 7.2 release, particularly where upstream libraries may have received security improvements.

During the discussion, contributors clarified that Guzzle is currently a development dependency rather than a production dependency. However, other dependencies used in production, including PSR-related packages, may still warrant review.

Because another PHP AI Client release was not already planned, the team agreed to first establish whether any updates would affect the code shipped with WordPress 7.2 before allocating additional resources.

@justlevine will investigate the production dependency footprint and coordinate with @jason_the_adams if a release or additional review is warranted.

Documentation and Contributor Experience

Contributors revisited the question of how documentation for the AI plugin and MCP Adapter should be published and maintained. Although both projects include Markdown documentation within their repositories, there is not yet an established approach for presenting that documentation through a more accessible, user-facing interface. The discussion also highlighted the importance of making documentation contributions easier for non-developers, particularly contributors participating in WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They’re one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. Learn more. Contributor Days.

Potential approaches include GitHub Pages or similar publishing workflows, although no specific solution was selected.

@justlevine also encouraged contributors to help improve existing MCP Adapter documentation, including reviewing and refining content that originated from AI-generated drafts.

Discoverability of AI Capabilities on WordPress.org

@nikskyverge provided an update on work to make AI-related plugin capabilities more discoverable within the WordPress.org Plugin Directory. An ability scanner developed following WordCamp Contributor DayContributor Day Contributor Days are standalone days, frequently held before or after WordCamps but they can also happen at any time. They are events where people get together to work on various areas of https://make.wordpress.org/ There are many teams that people can participate in, each with a different focus. https://make.wordpress.org/support/handbook/getting-started/getting-started-at-a-contributor-day/ discussions can identify registered abilities and store that information as plugin metadata. The implementation has received an initial review from the Meta team and requires additional cleanup before progressing.

@nikskyverge also shared that a related Trac ticket has been opened to explore identifying plugins that consume the PHP AI Client. This could help users discover plugins that support AI connectors or provide AI-powered functionality, making it easier to understand which WordPress plugins can participate in broader AI workflows.

Next Steps

WordPress 7.2 testing: Contributors are encouraged to test the Secrets API, particularly on multisite installations, and provide feedback on the outstanding Abilities API permissions proposal.
Developer documentation: @jeffpaul will coordinate with @jorgefilipecosta or @gziolo to prepare Abilities API developer notes ahead of Release Candidate 1.
Shared abilities package: @nikskyverge and @jeffpaul will coordinate moving the repository into the WordPress GitHub organization, then continue refining integration workflows and migrating relevant abilities.
Package maintainership: @nikskyverge and @justlevine will provide initial maintenance support while identifying additional contributors.
AI plugin 1.6.0: Continue development of the AI workspace experience and prepare the shared abilities package integration for the targeted end-of-month release.
PHP AI Client: @justlevine will review production dependencies and consult @jason_the_adams if updates are needed before WordPress 7.2.
Documentation: Contributors are encouraged to submit improvements to MCP Adapter documentation and explore more accessible publishing and contribution workflows.
Plugin discoverability: Continue refining the abilities scanner and related WordPress.org Meta work to improve visibility into plugins supporting abilities and the PHP AI Client.

Upcoming Meetings

Contributors are welcome to join the weekly AI contributor call. All team meeting schedules are published on the WordPress Meeting Calendar.
AI Team Office Hours: Thursday, November 12, 2026 at 17:00 UTC.

Props to @gajendrasingh for pre-publish review.

#core-ai, #summary

🎧 Huddle Notes: 11/5/26 in #core-test.
AI took notes for this huddle from 1:01:34 AM – 1:49:43 AM GMT+10. Test Team discussed workflow failures, badge criteria proposals, documentation PRs, and new automation tooling; addressed stalled contributions requiring team takeover.

Attendees

@r1k0, @huzaifaalmesbah, @jns141191, @ozgursar and @noruzzaman.

Summary

Weekly Testing Digest Workflow Failure

@huzaifaalmesbah identified TracTrac Trac is the place where contributors create issues for bugs or feature requests much like GitHub.https://core.trac.wordpress.org/. scrape timeout issue blocking the digest workflow. [5:59]

@ozgursar noted contributor Rajoul is blocked; team discussed testing approach using feature repo with real SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ webhook. [7:41] [7:58]

@huzaifaalmesbah proposed MCP (Model Context Protocol) as best solution to bypass verification; already tested locally on separate branch. [10:46] [12:37]

@r1k0 assigned @huzaifaalmesbah to guide PR author on implementing MCP fix. [14:04]

Release Squad Test Leads Badge Criteria

@jns141191 agreed badges should be awarded after release completion per handbook rules. [15:48]

@ozgursar clarified process: volunteer call precedes release, CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. Team selects leads, then Test Team awards badges post-release. [16:12]

@jns141191 confirmed badges require continuous contribution; inactivity over three months may trigger removal, but emeritus badges available for long-term members.

@r1k0 noted removal is discretionary and requires extended inactivity (year+), not just three months. [20:54]

Contributor Toolkit Documentation PR Review

@ozgursar tested desktop application; it auto-builds environment but lacks documentation of test steps; platform variations (Mac/Linux) untested. [26:58] [28:01]

@ozgursar suggested pinging Ryan (maintainer) for review; team can pre-review using existing handbook contributor toolkit documentation. [29:24] [30:38]

Team agreed to review PR and provide feedback before Ryan’s final approval. [31:31]

New Trac Need-Testing Announcer

Merged PR #8157 adds automatic Slack announcer for tickets marked “needs-testing,” mirroring GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ announcer functionality.

Manuel pioneered and implemented the announcer; @huzaifaalmesbah credited Manuel’s behind-scenes contributions to Test Team. [35:37] [36:24]

@ozgursar clarified: announcer automatically surfaces tickets to Slack without manual action once keyword applied. [37:34]

Team to report any announcer issues to Manuel via Slack mention for fixes. [38:07]

Open Floor

Stalled Contributor PRs Requiring Takeover

Two PRs opened by inactive contributor: “Update Contributor DayContributor Day Contributor Days are standalone days, frequently held before or after WordCamps but they can also happen at any time. They are events where people get together to work on various areas of https://make.wordpress.org/ There are many teams that people can participate in, each with a different focus. https://make.wordpress.org/support/handbook/getting-started/getting-started-at-a-contributor-day/ getting started guide” and “Fix typos in Test Handbook documentation.”

@huzaifaalmesbah noted both are minor manual changes suitable for team takeover and merge. [41:12] [41:52]

@ozgursar volunteered to review and apply changes to both PRs. [42:20]

Personal announcement

@noruzzaman announced birth of child; apologized for unavailability on 7.2 personal channel due to hospital time. [33:19] [33:53]

@r1k0 offered to cover @noruzzaman‘s pending work; @noruzzaman can contribute when time permits. [34:10]

Action items

@huzaifaalmesbah guide PR author on implementing MCP fix for Trac scrape timeout. [14:04]

@ozgursar review and apply changes to both stalled contributor PRs for merge. [42:20]

Team to comment approval on Release Squad badge proposal issue by end of November. [22:28]

Team members review Contributor Toolkit PR and leave feedback before Ryan’s final review. [31:31]

Files and media

Test Team Chat Agenda: 5th November, 2026

#test-chat-summary

This week’s meeting focused on the approach for developing and distributing WordPress abilities across coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress., the AI pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party., and MCP AdapterMCP Adapter Translates WordPress abilities into Model Context Protocol format, allowing AI assistants like Claude and ChatGPT to discover and invoke WordPress capabilities as tools, resources, and prompts., including compatibility considerations and the roadmap for WordPress 7.3. Contributors also discussed OAuth authentication, the role of retrieval-augmented generation (RAG) in WordPress, and coordinating work across the AI team. The team identified follow-up work to confirm the shared abilities approach, communicate proposed changes more broadly, and clarify the recurring meeting schedule.

WordPress Abilities and MCP Adapter Integration

The team continued discussing how abilities should be developed and shared between WordPress core, the AI plugin, and MCP Adapter. @jorgefilipecosta outlined an approach where WordPress core trunk would become the source of truth for abilities once development reopens, with updates synchronized back to MCP Adapter. This would allow contributors to deliver new capabilities through the adapter ahead of their inclusion in a WordPress release.

@justlevine questioned whether abilities needed to be prioritized for WordPress 7.3 if they could already be made available through MCP Adapter. The discussion highlighted the importance of supporting multiple transport mechanisms, including REST and MCP, while avoiding unnecessary duplication and maintenance overhead.

Contributors also revisited the proposed shared abilities package discussed during the previous meeting. Before proceeding with implementation, the team needs to confirm the package approach, determine where abilities should be maintained, and establish how updates should flow between WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ repositories and the AI and MCP Adapter plugins.

Compatibility was another important consideration. Unlike abilities included in WordPress core, which must maintain backward compatibility, abilities exposed through MCP Adapter primarily serve AI models and agents that consume dynamically provided schemas. Contributors generally agreed that adapter-specific schemas could evolve more freely, although the implications for developers building programmatic integrations require consideration.

Rather than immediately proceeding with the proposed synchronization strategy, contributors agreed to document the approach in a GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https://github.com/ issue and allow additional time for feedback from stakeholders who could not attend the meeting.

OAuth Authentication and WordPress 7.3

The team discussed ongoing OAuth development and its potential inclusion in WordPress 7.3. @ovidiu-galatan shared that an initial prototype implementing a minimal subset of OAuth functionality had been developed, while noting that the full protocol includes significant complexity and requires a clearly defined scope.

Contributors discussed continuing experimentation in a separate MCP Adapter development branch before pursuing core integration. The broader goal is to provide reusable authentication capabilities that can support MCP connections, REST APIREST API The REST API is an acronym for the RESTful Application Program Interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data. It is how the front end of an application (think “phone app” or “website”) can communicate with the data store (think “database” or “file system”) https://developer.wordpress.org/rest-api/ integrations, and other external applications.

The group supported pursuing OAuth in WordPress core independently of whether MCP Adapter itself is integrated into core. However, the proposed scope and implementation still require broader review and agreement.

@jason_the_adams will help coordinate a formal proposal on the AI team blog, cross-post it to the Core team, and bring the discussion to upcoming Core meetings. Contributors emphasized the importance of making this work visible early so interested developers can participate before architectural decisions are finalized.

Retrieval-Augmented Generation and Embeddings

An earlier discussion addressed community interest in retrieval-augmented generation (RAG) within WordPress. @gajendrasingh shared feedback from WordCampWordCamp WordCamps are casual, locally-organized conferences covering everything related to WordPress. They’re one of the places where the WordPress community comes together to teach one another what they’ve learned throughout the year and share the joy. Learn more. Rajasthan, where contributors asked about using RAG to search, filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output., and retrieve WordPress content for AI applications.

@justlevine explained that vectorization and embeddings provide the foundational capabilities for these use cases. Embeddings are part of the WordPress 7.2 work, while the AI plugin is also exploring experimental support for adding embeddings to post types.

The discussion explored whether RAG itself belongs in WordPress core or is better supported through plugins and external services. While there was no formal decision, the distinction between providing foundational capabilities in core and leaving specialized implementations to plugins was an important consideration.

@gajendrasingh will continue researching potential RAG implementations and share the findings with other contributors. @justlevine will also share information about the existing embeddings experiment in the AI plugin. See PRs on semantic search experiment and adding an “embeddings” mode to Content Classification within the AI plugin.

AI Connectors and User Experience

Contributors briefly discussed the challenges of maintaining integrations with external AI providers, particularly as providerProvider An AI service offering models for generation, embeddings, or other capabilities (e.g., Anthropic, Google, OpenAI). APIs and policies continue to evolve.

@jason_the_adams emphasized the importance of working toward a consistent user experience rather than focusing exclusively on individual provider integrations. The broader vision remains enabling users to connect AI assistants and agents to WordPress sites and manage site functionality through those interactions.

This work connects directly to the ongoing abilities, MCP Adapter, and OAuth efforts, which together provide the underlying functionality, communication, and authentication needed to support those experiences.

Meeting Schedule and Coordination

The meeting also highlighted confusion caused by daylight saving time changes across contributor time zones. Some participants joined at the previously expected local time, resulting in separate discussions before the main meeting began.

@jeffpaul will confirm the recurring meeting time, update the calendar invitation to remain fixed at 17:00 UTC, and adjust the published meeting information as needed. This should provide a consistent reference for contributors regardless of local daylight saving time changes.

Next Steps

Abilities integration: @jorgefilipecosta will document the proposed development and synchronization strategy in an MCP Adapter GitHub issue, allowing contributors to review and provide feedback before implementation.
Shared abilities package: Confirm the package approach, then coordinate any necessary changes to WordPress.org repositories and update the AI and MCP Adapter plugins accordingly.
Contributor review: @justlevine will help bring additional contributors into the abilities discussion, including @apeatling and @nikskyverge. Contributors will have time to review the proposed approach asynchronously.
OAuth proposal: @jason_the_adams will coordinate a proposal for broader Core team review, while contributors working on OAuth continue refining its scope and implementation.
RAG research: @gajendrasingh will document findings from the community discussion, and @justlevine will share the AI plugin embeddings experiment.
Core release review: @jason_the_adams will review the TracTrac Trac is the place where contributors create issues for bugs or feature requests much like GitHub.https://core.trac.wordpress.org/. ticket raised by @justlevine ahead of WordPress 7.2 Release CandidateRelease Candidate A beta version of software with the potential to be a final product, which is ready to release unless significant bugs emerge. 1.
Meeting schedule: @jeffpaul will confirm the recurring meeting time and update the calendar invitation and meetings page as needed.

Upcoming Meetings

Contributors are welcome to join the weekly AI contributor call. All team meeting schedules are published on the WordPress Meeting Calendar.
AI Team Office Hours: Thursday, November 12, 2026 at 17:00 UTC.

Props to @gajendrasingh for pre-publish review.

#core-ai, #summary

A WordPress Playground link can do more than prepare a WordPress installation. It can also choose how the interface appears and help visitors get started.

Whether you’re creating an interactive tutorial, running a workshop, or sharing a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. demo, three URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org parameters let you shape that initial experience:

CategoryCategory The ‘category’ taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging.	Parameter	What it controls
Overall presentation	`mode`	Whether the surrounding Playground interface is visible
Dock appearance	`dock`	How the Dock initially appears
Starting destination	`overlay`	Whether the New Playground pane opens on arrival

You can use these options individually or combine them with site-setup parameters such as plugin, theme, and url.

Choose the overall presentation with `mode`

The mode parameter determines how WordPress is displayed within Playground.

Keep the Playground interface available

The default value, browser-full-screen, includes Playground’s browser interface and Dock:

https://playground.wordpress.net/?mode=browser-full-screen

Use this presentation when visitors should be able to explore Playground, adjust site settings, or access its development tools. You can omit the parameter to use this default.

Create a seamless experience

Use mode=seamless to remove Playground’s browser chrome and Dock, allowing WordPress to fill the available space:

Try seamless mode.

https://playground.wordpress.net/?mode=seamless

This is useful for embedding interactive examples in documentation or presenting a focused WordPress demo.

For example, this link installs GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/ and opens the WordPress post editor:

Try the seamless Gutenberg editor.

https://playground.wordpress.net/?plugin=gutenberg&url=/wp-admin/post-new.php&mode=seamless

Seamless mode also suppresses Playground’s automatic browser-saving offers. Because the Dock is hidden, Dock appearance settings and requests to open its panes have no visible effect in this mode.

Choose the Dock’s initial appearance with `dock`

The Dock provides access to Playground’s settings and tools. The dock parameter lets you choose how those controls appear when the page opens.

Value	Initial appearance
`minimized`	A corner launcher that restores the Dock when clicked
`collapsed`	A floating Dock showing the address and save status
`expanded`	A floating Dock with tools visible
`full-width`	A full-width bottom bar with tools visible
`full-width-collapsed`	A full-width bottom bar showing the address and save status

Give a demo more space

A minimized Dock keeps the WordPress site in focus while leaving Playground’s controls accessible through a corner launcher:

Try a minimized Dock.

https://playground.wordpress.net/?dock=minimized

Unlike seamless mode, this lets visitors restore the Dock whenever they need its tools.

Make tools accessible during a workshop

A full-width Dock is useful when participants will regularly switch between settings and development tools:

Try a full-width Dock.

https://playground.wordpress.net/?dock=full-width

Keep the controls compact

A collapsed Dock keeps the address and save status visible while hiding the tools row:

Try a collapsed Dock.

https://playground.wordpress.net/?dock=collapsed

For the same compact presentation across the bottom of the window, use dock=full-width-collapsed.

These options set the initial appearance. Visitors can still expand, collapse, or otherwise interact with the Dock afterward.

Open New Playground with `overlay`

The overlay parameter opens the New Playground or the Playgrounds pane when someone follows your link.

Open the New Playground pane.

https://playground.wordpress.net/?overlay=new

The documented values are:

new: Opens the New Playground pane
playgrounds: Opens your Playgrounds pane

Explore more configuration options in the WordPress Playground Query API reference.

WordPress 7.2 updates two menus in the editor headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes., Options (the “⋮” button) and View, to use the new Menu component from @wordpress/ui. The change applies to both the post and site editors.

The new menus have better keyboard navigation, proper checkbox and link items, and the same look as other components in the WordPress Design System.

For most plugins, things just work. You can keep using PluginMoreMenuItem, PluginSidebarMoreMenuItem, and PluginPreviewMenuItem. For action and link items, pass the label as children and use props such as icon, onClick, href, and disabled. For PluginSidebarMoreMenuItem, pass target to identify the sidebarSidebar A sidebar in WordPress is referred to a widget-ready area used by WordPress themes to display information that is not a part of the main content. It is not always a vertical column on the side. It can be a horizontal rectangle below or above the content area, footer, header, or any where in the theme., with icon and children as needed. The editor supplies the underlying menu item component.

import { registerPlugin } from '@wordpress/plugins';
import { PluginMoreMenuItem } from '@wordpress/editor';
import { external } from '@wordpress/icons';

function openMyTool() {
	// Handle menu item click.
}

function MyMenuItem() {
	return (
		<PluginMoreMenuItem icon={ external } onClick={ openMyTool }>
			Open my tool
		</PluginMoreMenuItem>
	);
}

registerPlugin( 'my-plugin', { render: MyMenuItem } );

There are a few changes worth knowing about:

PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. items in the Options menu now live in a new Panels submenu instead of a separate “Plugins” group (#82976).
The menu markup has changed. Styles or tests that target @wordpress/components class names, like .components-menu-item__button, won’t match anymore. In end-to-end tests, select items by role and name. Plugin items now sit in the Panels submenu, so tests must open Options, then Panels, before finding the item.

For example, after opening Options:

await page.getByRole( 'menuitem', { name: 'Panels', exact: true } ).click();
await page.getByRole( 'menuitemcheckbox', { name: 'Open my tool', exact: true } ).click();

Deprecated: `as` prop for plugin menu items

The as prop was never documented for these components. It worked only because they passed any extra props to the underlying ActionItem, which let plugins replace the menu item with their own component.

This no longer works with the new menu. @wordpress/ui is bundled into each package rather than shared, so each bundle has its own ReactReact React is a JavaScript library that makes it easy to reason about, construct, and maintain stateless and stateful user interfaces. https://reactjs.org context. A plugin’s separately bundled Menu.Item can’t join the editor’s Menu.Root, so importing the new menu item directly isn’t a migrationMigration Moving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies. path. That’s why the editor now renders every item itself.

Starting with WordPress 7.2, PluginMoreMenuItem, PluginSidebarMoreMenuItem, and PluginPreviewMenuItem will ignore the as prop and display a deprecation warning:

The as prop of wp.editor.PluginMoreMenuItem is deprecated since version 7.2. Note: The menu renders the item itself. The prop is ignored.

The fix is to remove as and use the documented props instead.

// Before.
<PluginMoreMenuItem as={ MyCustomMenuItem } icon={ external } onClick={ openMyTool }>
	Open my tool
</PluginMoreMenuItem>

// After.
<PluginMoreMenuItem icon={ external } onClick={ openMyTool }>
	Open my tool
</PluginMoreMenuItem>

If the documented props don’t cover your use case, please open an issue and let us know what you need.

Direct users of ActionItem from @wordpress/interface can still supply as. In the editor’s Options and View menus, the compatibility adapter integrates that component with the new menu. The custom component must forward the supplied props and ref to its underlying DOM element. It retains its own markup and may need styling updates. Prefer PluginMoreMenuItem or PluginPreviewMenuItem where they cover the use case.

Please refer to the original pull requests for more details: #81564, #82321, and #82319.

Co-authored by @mamaduka and @mciampini

#7-2, #dev-notes, #dev-notes-7-2, #editor

This meeting will be held by text chat at Wednesday, November 11, 2026, 7:00 GMT in the #polyglots channel in the Making WordPress SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/.

Welcome
Weekly LocaleLocale Locale = language version, often a combination of a language code and a region code, for instance es_MX denotes Spanish as it’s used in Mexico. A list of all locales supported by WordPress in https://make.wordpress.org/polyglots/teams/ Stats
Release
- WordPress 7.2 Beta 5
Help & Feedback Wanted
FYI
- WordPress Credits Welcomes More Than 50 Institutions
Open floor / Achievement

If you have any additions to the agenda, please share them in the comments.

#meeting-agenda, #polyglots, #polyglots-meeting, #weekly-meetings

Next Meeting

The next meetings will be in the #hosting SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ channel on Wednesday, November 11, 2026 at 0900 UTC and Wednesday, November 11, 2026 at 1800 UTC. Hope to see you there!

Agenda

7.2 Beta 5 released November 10, 2026
7.2 RC1 scheduled for November 17th
Tickets/PRs

Anything else? Please leave a comment with any additions or suggestions for the meeting.

Props to @jazzs3quence for the pre-publish review!

#agenda, #hosting-community, #meetings, #weekly-hosting-chat

The next WordPress Developers Chat will take place on Wednesday, November 11, 2026, at 15:00 UTC in the core channel on Make WordPress Slack.

The live meeting focuses on upcoming releases and CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development, with time for discussions and open floor.

If you have requests for help with a ticketticket Created for both bug reports and feature development on the bug tracker. or another discussion topic, please post details in the comments section at the end of this agenda, or bring it up in Dev Chat during open floor.

Announcements 📢

WordPress 7.2

7.2 Beta 5 released November 10, 2026
7.2 RC1 scheduled for release November 17th
Editor components updates in WordPress 7.2
SVG icons in the admin bar and menu in WordPress 7.2
New Block Support in WordPress 7.2: Text Shadow (textShadow)
Your Content Is Going To Get More Random! – New redirect for viewing random posts

General

WordPress Credits welcomes 50+ Institutions
Conservative in What We Accept – Review and tighten up CRUDCRUD Create, read, update and delete, the four basic functions of storing data. (More on Wikipedia.) operations and emails

Discussions 💬

The discussion section of the agenda is for discussing important topics affecting the upcoming release or larger initiatives that impact the Core Team. To nominate a topic for discussion, please leave a comment on this agenda with a summary of the topic, any relevant links that will help people get context for the discussion, and what kind of feedback you are looking for from others participating in the discussion.

Open floor 🎙️

Any topic can be raised for discussion in the comments, as well as requests for assistance on tickets. Tickets in the milestone for the next major or maintenance release will be prioritized.

Please include details of tickets / PRs and the links in the comments, and indicate whether you intend to be available during the meeting for discussion or will be async.

Props to @kirasong for review.

#7-2, #agenda, #core, #dev-chat

leemon Yesterday at 9:56 am

Could someone please take a look at this issue when you have a moment?

Allow Submenus in Navigation Overlay to respect “Toggle on Click” – #44346

Thanks

vladte4 Yesterday at 11:12 pm

Read the 90% of negative comments and think about whether you really need this specific feature – Your Content Is Going To Get More Random!

Make WordPress

Teams

Latest activity

Storing and reading a secret

Checking that the API is available

Setting WP_SECRETS_KEY

Replacing the keyring, store or provider

Site Health

Breaking changes since Beta 1

If you stored secrets during the beta

WordPress 7.2 Release Readiness

Shared WordPress Abilities Package

AI Plugin 1.6.0 and AI Workspace

PHP AI Client Dependencies and Security

Documentation and Contributor Experience

Discoverability of AI Capabilities on WordPress.org

Next Steps

Upcoming Meetings

Attendees

Summary

Weekly Testing Digest Workflow Failure

Release Squad Test Leads Badge Criteria

Contributor Toolkit Documentation PR Review

New Trac Need-Testing Announcer

Open Floor

Stalled Contributor PRs Requiring Takeover

Personal announcement

Action items

Files and media

WordPress Abilities and MCP Adapter Integration

OAuth Authentication and WordPress 7.3

Retrieval-Augmented Generation and Embeddings

AI Connectors and User Experience

Meeting Schedule and Coordination

Next Steps

Upcoming Meetings

Choose the overall presentation with mode

Keep the Playground interface available

Create a seamless experience

Choose the Dock’s initial appearance with dock

Give a demo more space

Make tools accessible during a workshop

Keep the controls compact

Open New Playground with overlay

Deprecated: as prop for plugin menu items

Next Meeting

Agenda

Announcements 📢

WordPress 7.2

General

Discussions 💬

Open floor 🎙️

Not sure which team to contribute to?

Shape the future of WordPress

Setting `WP_SECRETS_KEY`

Choose the overall presentation with `mode`

Choose the Dock’s initial appearance with `dock`

Open New Playground with `overlay`

Deprecated: `as` prop for plugin menu items