This post gathers each official stream in one place so you can quickly find the right broadcast for each day. Bookmark this page and return throughout the event to watch live.

Day One: The Making of a WordPress Release

Go behind the scenes of a WordPress release in this special Contributor Day live stream from WordCamp Asia 2026. Past release squad members come together to share stories, reflect on their experience, and talk about what it takes to bring a WordPress release to life. The Panel will go live at 4:30 am UTC.

Day Two: Conference Livestreams

Watch the second day of WordCamp Asia 2026 live for a full day of presentations and sessions. beginning at 4:00 am UTC, including a Fireside chat with Mary Hubbard, which will begin at 5:00 am UTC over on the Growth Stream.

Day Three: Conference Livestreams

Watch the third day and final day of WordCamp Asia 2026 live, beginning at 4:00 am UTC for another full day of presentations from across the community. Don’t forget to watch Ma.tt Mullenweg give the final keynote, which will begin on the Growth stream at 10:00 am UTC.

You can also explore the full schedule to see what is coming up across the event and plan your viewing. However you join, we hope you will follow along and be part of WordCamp Asia 2026.

WordCamp Asia 2026 brings the WordPress community to Mumbai, India, from April 9 to 11, with a schedule shaped around artificial intelligence, enterprise WordPress, developer workflows, product strategy, and open source collaboration. For attendees planning their time, the program offers a useful view of the ideas, tools, and practical challenges shaping WordPress today.

Keynotes to Set the Stage

The keynote sessions at WordCamp Asia 2026 help frame some of the biggest conversations at this year’s event.

Together, they offer an early view of the themes and discussions unfolding across WordPress in 2026.

AI, Automation, and the Future of WordPress

Artificial intelligence is one of the clearest threads running through the program. Sessions from Fellyph Cintra, Fumiki Takahashi, and Nirav Mehta examine how AI is already influencing WordPress through Core discussions, testing workflows, plugin development, and day-to-day implementation. That same theme continues in sessions on marketing and content strategy, including Adeline Dahal’s work on structuring WordPress content to make it more machine-readable. 

This cross-section of presentations shows how automation is moving from concept to practice. From autonomous testing with WordPress Playground to AI-supported development workflows, these sessions highlight applicable tools and skills that teams can start using right away, not just concepts. For attendees interested in where WordPress is heading, this is one of the strongest themes across the event.

Enterprise WordPress and Scalability

Enterprise sessions take that discussion further by focusing on scale, architecture, and operational complexity. Rahul Bansal, James Giroux, Anirban Mukherji, and Abid Murshed are among the speakers exploring how WordPress supports larger organizations, more complex commerce systems, and demanding digital environments. Their sessions look at growth, implementation, and the kinds of decisions that matter when WordPress is supporting business-critical work.

Other talks in this track focus on the realities of enterprise operations, including migration risk, observability, and long-term performance. Together, they show how WordPress continues to adapt to larger systems and more complex digital ecosystems without losing the flexibility that makes it widely used in the first place.

Developer Experience and Modern Practices

The developer track stays grounded in both Core tools and everyday engineering practice. Ryan Welcher will cover the Interactivity API, Jonathan Desrosiers will look at automation in open source, and Takayuki Miyoshi will introduce a schema-sharing approach to form management. These sessions point to a broader shift toward building WordPress systems that are more dynamic, maintainable, and easier to scale over time.

These more technical presentations also include sessions on the WordPress HTML API, Content Security Policy, open source data pipelines, and evolving plugin standards. Rather than focusing on a single type of builder, this part of the schedule addresses developers working across infrastructure, security, front-end experiences, and long-term platform health.

Community, Education, and Open Source

The schedule also makes space for the people and ideas that support WordPress beyond engineering alone. A panel featuring Anand Upadhyay and Maciej Pilarski, moderated by Destiny Kanno, looks at education initiatives and student pathways into open source. Kazuko Kaneuchi will reflect on the story of Wapuu and the culture of contribution around WordPress. At the same time, Kotaro Kitamura and Chiharu Nagatomi will share how WordPress and its community shaped their professional journeys.

That wider perspective continues in sessions on product thinking, marketing, career growth, and business strategy. Speakers, including Nabin Jaiswal, Himani Kankaria, Julian Song, Karishma Sundaram, Sandeep Kelvadi, Aviral Mittal, Anh Tran, and Anna Hurko, explore how WordPress works and connects with decision-making, discoverability, professional development, and organizational growth. Taken together, these sessions reflect one of WordPress’s long-standing strengths: its ability to connect software, learning, and community in the same space.

Hands-on Workshops

Hands-on workshops round out the schedule, offering practical sessions for attendees who want to move from ideas to implementation. They include:

• From On-Demand to Cloud: Automate WordPress Installations Like a Pro
• AI + MCP to build, manage, and automate WordPress end-to-end
• Building AI Agents with self-editing memory
• Building Better WordPress Experiences with AI-Driven Development Workflows

Explore the full schedule to plan your sessions, and get your event pass to join WordCamp Asia 2026 in Mumbai.

Mumbai is calling. See you at WordCamp Asia 2026! 

Note: Much of the credit belongs to @webtechpooja (Pooja Derashri) for help in writing this piece.

This version of the WordPress software is under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended that you evaluate RC2 on a test server and site.

Reaching this phase of the release cycle is an important milestone. While release candidates are considered ready for release, testing remains crucial to ensure that everything in WordPress 7.0 is the best it can be.

You can test WordPress 7.0 RC2 in four ways:

The scheduled final release date for WordPress 7.0 is April 9, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who helps with testing!

Please continue checking the Make WordPress Core blog for 7.0-related posts in the coming weeks for more information.

What’s in WordPress 7.0 RC2?

What’s new in WordPress 7.0? Check out the Beta 1 announcement and 7.0 Developer Notes for details and highlights. For technical information related to issues addressed since RC1, you can browse the following links:

• GitHub commits since March 24, 2026
• Closed Trac tickets since March 24, 2026

How you can contribute

WordPress is open source software made possible by a passionate community of people collaborating on and contributing to its development. The resources below outline various ways you can help the world’s most popular open source web platform, regardless of your technical expertise.

Get involved in testing

Testing for issues is crucial to the development of any software. It’s also a meaningful way for anyone to contribute. 

Your help testing the WordPress 7.0 RC1 version is key to ensuring that the final release is the best it can be. While testing the upgrade process is essential, trying out new features is equally important. This detailed guide will walk you through testing features in WordPress 7.0. For those new to testing, follow this general testing guide for more details on getting set up.

What else to test:

• Real Time Collaboration
• Pattern Editing and content-only Interactivity

If you encounter an issue, please report it to the Alpha/Beta area of the support forums or directly to WordPress Trac if you are comfortable writing a reproducible bug report.  You can also check your issue against a list of known bugs. 

Curious about testing releases in general?  Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

Test on your hosting platforms

Web hosts provide vital infrastructure for supporting WordPress and its users. Testing on hosting systems helps inform the development process while ensuring that WordPress and hosting platforms are fully compatible, free of errors, optimized for the best possible user experience, and that updates roll out to customer sites without issue.

Want to test WordPress on your hosting system? Get started with configuring distributed hosting tests here.

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 7.0 beta releases. If you haven’t yet, make sure to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 7.0.

If you find compatibility issues, please post detailed information to the support forum.

Help translate WordPress

Do you speak a language other than English? ¿Español? Français? Русский? 日本語? हिन्दी? বাংলা? मराठी? ಕನ್ನಡ?  You can help translate WordPress into more than 100 languages. This release milestone (RC2) also marks the hard string freeze point of the 7.0 release cycle.

An RC2 haiku

At first just a dream,

RC2 flows like a stream

with seven-oh gleam.

Props to @amykamala @annezazu for proofreading and review.

Built by Ben Words from Roots, the team behind Bedrock, Sage, and Trellis, WP Packages is a new open source Composer repository for WordPress plugins and themes. Composer is PHP’s dependency manager, and it is how many professional WordPress developers install and update plugins and themes in their projects. Every free plugin and theme in the WordPress.org directory is available through WP Packages. Migrating from WPackagist can be done via a single script or a few terminal commands.

What Happened and Why It Matters

WPackagist was created in 2013 by Outlandish, a UK-based digital cooperative, and it served the WordPress Composer ecosystem for over a decade. In its later years the project suffered from deferred maintenance, slow update cycles, and little to no community input. When WP Engine announced the acquisition, developers raised immediate concerns about a private-equity-backed corporation controlling infrastructure this foundational to the WordPress developer workflow. WP Engine immediately updated the Composer info field to display a “WPackagist is now maintained by WP Engine” notice in every developer’s terminal. A small thing, but telling. That’s how corporate ownership changes the relationship between a tool and its users.

Ben had already started building a WPackagist replacement last August, long before the acquisition made headlines. When WP Engine’s deal landed, he accelerated the launch, going live on March 16 with a fully open source repository on GitHub.

Open source repo ≠ transparent system. WP Packages makes everything public, including infrastructure and build process. – Ben Word on X

It’s also just a better tool. WP Packages supports Composer v2’s metadata-url protocol, which lets Composer fetch metadata only for the packages a project actually needs. WPackagist still relies on the older provider-includes approach, forcing Composer to download large index files before resolving dependencies. Cold dependency resolves on WP Packages are roughly 17x faster: 0.7 seconds for 10 plugins compared to 12.3 seconds on WPackagist.

WP Packages also uses CDN caching with public cache headers and serves immutable, content-addressed per-package files. Package naming is cleaner (wp-plugin/ and wp-theme/ instead of wpackagist-plugin/ and wpackagist-theme/), metadata includes plugin and theme authors, descriptions, and homepage URLs that WPackagist has been missing for years, and updates sync every five minutes rather than WPackagist’s roughly 90-minute cycle.

How to Switch

Switching from WPackagist to WP Packages requires just a few terminal commands.

1. Remove your existing WPackagist packages:

composer remove wpackagist-theme/twentytwentyfive

2. Remove the WPackagist repository and add WP Packages:

composer config --unset repositories.wpackagist && composer config repositories.wp-composer composer https://repo.wp-packages.org

3. Require packages with the new naming:

composer require wp-theme/twentytwentyfive

Alternatively, use the migration script to automatically update your composer.json:

curl -sO https://raw.githubusercontent.com/roots/wp-packages/main/scripts/migrate-from-wpackagist.sh && bash migrate-from-wpackagist.sh

Roots also provides a WP Packages Changelog Action for GitHub workflows that tracks dependency updates using the new naming format. Projects using Bedrock already ship with WP Packages configured out of the box.

Open Source Wins

The entire WP Packages project is public. The application code, documentation, and even the full Ansible deployment configuration are available on GitHub. Anyone can fork the repository and run their own WordPress Composer registry. Ben has also committed publicly that WP Packages will never use the Composer info field to push messages, ads, or upsells into developer terminals. That kind of restraint is easier to promise when a project answers to its community rather than to a corporate parent.

WP Packages is funded through GitHub Sponsors. Current sponsors include Carrot, Kinsta, WordPress.com, and Itineris. The WordPress ecosystem has always been at its strongest when the community builds the tools it needs in the open. Ben saw a gap forming months before anyone else was paying attention, built something better than what existed, and released it for everyone. No acquisition required. No boardroom decisions about availability or pricing. Just developers solving a problem for other developers and sharing the result. Open source wins.

This version of the WordPress software is still under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended to evaluate RC1 on a test server and site.

WordPress 7.0 RC1 can be tested using any of the following methods:

The scheduled final release date for WordPress 7.0 is April 9, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who helps with testing!

Please continue checking the Make WordPress Core blog for 7.0-related posts in the coming weeks for more information.

What’s in WordPress 7.0 RC1?

What’s new in WordPress 7.0? Check out the Beta 1 announcement and WordPress 7.0 Developer Notes for details and highlights.

RC1 contains more than 134 updates and fixes since the Beta 5 release. You can browse the technical details for all issues addressed since Beta 5 using these links:

• GitHub commits since March 12, 2026
• Closed Trac tickets since March 12, 2026

New Features since Beta 1

The release squad in conjunction with project leadership identified additional features that were not ready for beta 1 but are included in RC1 as supporting requirements for flagship features of the release.

• AI Connectors Screen – A new admin screen for connecting AI providers to your site and an API for registering additional ones.
• The Command Palette is now available via a ⌘K or Ctrl+K shortcut in the admin bar.

Want to look deeper into the details and technical notes for this release? These tickets and pull requests are just some of the latest updates:

• #GB-76700: Client Side Media as plugin only
• #GB-76722: Add support for non-AI providers on Connector’s Screen
• #GB-76736: New activation hook to enable RTC by default
• #64904: WP_ALLOW_COLLABORATION constant for RTC
• #GB-76704: Increased polling intervals for RTC
• #GB-76643: Real Time Collaboration is opt-in by default
• #GB-76460: Toggle to turn RTC session notifications on/off
• #62046: Update PHP AI Client package to 1.3.1
• #GB-76550: Revisions: Show changed block attributes in sidebar
• #62067: Single config option to disable all LLM related features
• #63697: OPCache added to Site Health > Info > Server

The final release is on track for April 9, 2026. As always, a successful release depends on your confirmation during testing. So please download and test!

How you can contribute

WordPress is open source software made possible by a passionate community of people collaborating on and contributing to its development. The resources below outline various ways you can help the world’s most popular open source web platform, regardless of your technical expertise.

Help test this release

Testing for issues is crucial to the development of any software. It’s also a meaningful way for anyone to contribute. Your help testing the WordPress 7.0 RC1 version is key to ensuring that the final release is the best it can be. While testing the upgrade process is essential, trying out new features is equally important. This detailed guide will walk you through testing features in WordPress 7.0.

What to test:

• Real Time Collaboration
• Pattern Editing and content-only Interactivity

If you encounter an issue, please report it to the Alpha/Beta area of the support forums or directly to Trac if you are comfortable writing a reproducible bug report. You can also check your issue against a list of known bugs.

Test on your hosting platforms

Hosting systems provide vital infrastructure for supporting WordPress and its users. Testing on hosting infrastructure ensures that WordPress and hosting systems are fully compatible, free of errors, optimized for the best possible user experience, and that updates roll out to customer sites without issue. Thank you to all web hosts who test WordPress!

Want to set up testing on your hosting system? Get started with configuring distributed hosting tests here.

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 7.0 beta releases. With RC1, you’ll want to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 7.0. If you find compatibility issues, please post detailed information to the support forum.

Curious about testing releases in general? Follow along with the testing initiatives and join the #core-test channel on Making WordPress Slack.

Help translate WordPress

Do you speak a language other than English? ¿Español? Français? Русский? 日本語? हिन्दी? বাংলা? मराठी? ಕನ್ನಡ?  You can help translate WordPress into more than 100 languages. This release milestone (RC1) marks the hard string freeze point of the 7.0 release cycle. However, strings will not be available for translation until RC2 later this week.

An RC1 haiku

RC1 arrives

with momentum, sped up time

and jazz on the mind.

Props to @4thhubbard, @desrosj, @jeffpaul, @chaion07, @audrasjb, @jorbin for collaboration and review.

This version of the WordPress software is still under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended to test Beta 5 on a test server and site.WordPress 7.0 Beta 5 can be tested using any of the following methods:

The scheduled final release date for WordPress 7.0 is still April 9, 2026.  The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who helps with testing!

Please continue checking the Make WordPress Core blog for 7.0-related posts in the coming weeks for more information. What’s new in WordPress 7.0? Check out the Beta 1, Beta 2, Beta 3 and Beta 4 announcements for details and highlights.

How to test this release

Your help testing the WordPress 7.0 Beta 5 version is key to ensuring everything in the release is the best it can be. While testing the upgrade process is essential, trying out new features is equally important. This detailed guide will walk you through testing features in WordPress 7.0.

If you encounter an issue, please report it to the Alpha/Beta area of the support forums or directly to WordPress Trac if you are comfortable writing a reproducible bug report. You can also check your issue against a list of known bugs.Curious about testing releases in general? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

Beta 5 updates and highlights

WordPress 7.0 Beta 5 contains more than 101 updates and fixes since the Beta 3 release.

Each beta cycle focuses on bug fixes, and more are on the way with your help through testing. You can browse the technical details for all issues addressed since Beta 3 using these links:

• GitHub commits since March 5, 2026
• Closed Trac tickets since March 5, 2026

Issues addressed since Beta 4:

• GitHub commits since March 10, 2026
• Closed Trac tickets since March 10, 2026

WordPress 7.0 Beta 5 contains a new feature!

Instantly access all the tools you need with a single click using the new Command Palette shortcut in the Omnibar! In 7.0 Beta 5, logged-in editors will see a field with a ⌘K or Ctrl+K symbol in the upper admin bar that unfurls the command palette when clicked. The new command palette entry point streamlines navigation and customization, giving you full control from anywhere on your site – whether you’re editing, designing or just browsing plugins.

A Beta 5 haiku

A smooth melody

Beta 5 plays on its strings.

Seven brings good things.

Props to @amykamala, @annezazu and @4thhubbard for proofreading and review.

WordPress 6.9.2 and WordPress 6.9.3 were released yesterday, addressing 10 security issues and a bug that affected template file loading on a limited number of sites.

The WordPress Security Team has discovered that not all of the security fixes were fully applied, therefore 6.9.4 has been released containing the necessary additional fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 6.9.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

For more information on WordPress 6.9.4, please visit the version page on the HelpHub site.

Security updates included in this release

The security team would like to thank the contributors who reported and investigated this issue, in particular Thomas Kräftner for his responsible disclosure. The security issues that are resolved in 6.9.4 are:

• A PclZip path traversal issue reported independently by Francesco Carlucci and kaminuma
• An authorization bypass on the Notes feature reported by kaminuma
• An XXE in the external getID3 library reported by Youssef Achtatal

With my.WordPress.net, WordPress runs entirely and persistently in your browser. There’s no sign-up, no hosting plan, and no domain decision standing between you and getting started. Built on WordPress Playground, my.WordPress.net takes the same technology that powers instant WordPress demos and turns it into something permanent and personal. This isn’t a temporary environment meant to be discarded. It’s a WordPress that stays with you.

New Ways to WordPress

When you open my.WordPress.net, you’re placed directly into a complete WordPress environment that runs entirely in your browser. What makes this approach meaningful is not just where WordPress runs, but how it changes the relationship between people and the software itself. By removing the need to sign up or make early decisions about hosting and visibility, my.WordPress.net reframes WordPress as a space you can enter and work within, rather than a service you have to configure before you begin.

“This takes WordPress from being framed as something that is democratizing publishing to democratizing digital sovereignty.” – Alex Kirk

Seen through that lens, my.WordPress.net is not just about convenience. As you don’t need to choose a hosting provider, your WordPress belongs entirely to you. In a publishing environment, you’d briefly interact with WordPress as you prepare your next post. In a personal setting, it becomes a place you shape and return to. That change unlocks new ways of thinking about what WordPress can be.

Permanently and Privately Yours

Because sites on my.WordPress.net are private by default and not accessible from the public internet, they don’t behave like traditional websites. They aren’t optimized for traffic, discovery, or presentation, and they don’t need to be. Instead, WordPress becomes a personal environment where ideas can exist before they are ready to be shared, or where they may never be shared at all.

This changes how WordPress can be used day to day. It becomes a place to think, to draft, to organize, and to experiment without pressure, whether that means writing privately, collecting research, or building small tools for personal use. Learning also fits naturally into this model, since people can explore plugins, themes, and features inside a real WordPress environment where mistakes are expected and recoverable.

This turns WordPress into a personal workspace. It becomes a place for thinking, learning, prototyping, and tinkering, where exploration matters more than outcomes. In that role, WordPress shifts from being something you prepare for others to visit into something you actively work inside, adapting to how you want to create and learn over time.

Sparking Creativity with Apps

To make these ideas concrete, my.WordPress.net includes an App Catalog with pre-configured experiences designed specifically for personal use, built with WordPress plugins. These examples highlight how WordPress can function when it’s private, persistent, and easy to experiment with. Each app installs with a single click and configures itself automatically.

Personal CRM

A private relationship manager designed to help you stay in touch with people who matter to you. Contacts can be grouped, enriched with personal details, and paired with reminders to reconnect. In the demo, this extends to analyzing communication patterns using imported chat data, all stored locally inside WordPress.

Personal RSS Reader

Using the Friends plugin, WordPress becomes a quiet, personal feed reader. Instead of relying on external platforms, you can follow sites and creators inside your own WordPress and read at your own pace, free from algorithms or engagement pressure.

AI Workspace and Knowledge Base

Because my.WordPress.net is powered by WordPress Playground, an AI assistant can safely modify it, empowering you to customize beyond what you’re used to. Ask it to modify a plugin to your liking, or create an entirely new one, featuring your desired block. Ask it about the data you have stored in your WordPress. The assistant remembers what it touches and makes it easy to share your changes with others. Over time, WordPress itself can become your personal knowledge base that the AI understands and works with.

Zero Barriers

my.WordPress.net lowers the barrier to getting started with WordPress to almost nothing. It offers a fast, commitment-free way to explore, learn, and build, whether the result is a long-term personal project or something that eventually moves elsewhere. In that sense, it updates the spirit of the five-minute install for a browser-first web.

What you should know

• Storage starts at roughly 100 MB
• The first launch takes a little longer while WordPress downloads and initializes
• All data stays in your browser and is not uploaded anywhere
• Each device has its own separate installation
• Backups should be downloaded regularly

Create and explore

WordPress has always grown through experimentation. People trying things, breaking things, and discovering new ways to use the platform have shaped what WordPress is today.

my.WordPress.net continues that tradition by making experimentation easier and more personal. It’s an invitation to create without pressure, to explore ideas that may never be published, and to use WordPress in ways that fit your life.

my.WordPress.net is built on WordPress Playground technology. Learn more at WordPress.org/playground or join the conversation in the #meta-playground channel on WordPress Slack.

A few users have subsequently reported an issue where the front end of their site was appearing blank after updating to 6.9.2. The issue has been narrowed down to some themes using an unusual approach to loading template files via “stringable objects” instead of primitive strings for file paths.

Although this is is not an officially supported approach to loading template files in WordPress (the template_include filter only accepts a string), it nevertheless caused some sites to break. As a result, the Security Team has decided to address this in a fast follow 6.9.3 release.

As always, it is recommended that you update your sites to the latest version of WordPress immediately. This ensures your site is protected by all available security fixes in 6.9.2 and that you will not be affected by the bug fixed in 6.9.3.

Many thanks to those who reported the issue, assisted in narrowing down the problem, and helped with the fix, in particular Jos Klever who assisted throughout the process.

You can download WordPress 6.9.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin shortly. You don’t have to do a thing!

For more information on WordPress 6.9.3, please visit the version page on the HelpHub site.

WordPress 7.0 beta 4

The next major release of WordPress will be version 7.0, which is planned for April 9, 2026. The Security Team has decided to package a new beta release (7.0 beta 4) to keep everyone protected from the patched vulnerabilities, including the dedicated members of the community focusing their time and effort on testing the upcoming release.

This will be an additional beta release in the 7.0 release cycle. The schedule will remain the same going forward, but with five total beta releases instead of the previously planned four. The next 7.0 beta release is still scheduled for Thursday, March 12th.

This beta version of the WordPress software is still under development. Please do not install, run, or test WordPress 7.0 beta versions on production or mission-critical websites. Instead, you should evaluate Beta 4 on a test server and site.

Beta 4 updates and highlights

WordPress 7.0 Beta 4 contains the ten security patches shipped in WordPress 6.9.2, and more than 49 updates and fixes since the Beta 3 release, including 14 in the Editor and 35 in Core. 

Each beta cycle focuses on bug fixes. More are on the way, thanks to your help with testing. You can browse the technical details for all issues addressed since Beta 3 at these links:

• GitHub commits for 7.0  since March 5, 2026
• Closed Trac tickets for 7.0 since March 5, 2026

As always, a successful release depends on your confirmation during testing. So please download and test!

Props @peterwilson, @desrosj, @marybaum, @amykamala for peer reviewing.

This is a security release that features several fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 6.9.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

For more information on WordPress 6.9.2, please visit the version page on the HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A Blind SSRF issue reported by sibwtf, and subsequently by several other researchers while the fix was being worked on
• A PoP-chain weakness in the HTML API and Block Registry reported by Phat RiO
• A regex DoS weakness in numeric character references reported by Dennis Snell of the WordPress Security Team
• A stored XSS in nav menus reported by Phill Savage
• An AJAX query-attachments authorization bypass reported by Vitaly Simonovich
• A stored XSS via the data-wp-bind directive reported by kaminuma
• An XSS that allows overridding client-side templates in the admin area reported by Asaf Mozes
• A PclZip path traversal issue reported independently by Francesco Carlucci and kaminuma
• An authorization bypass on the Notes feature reported by kaminuma
• An XXE in the external getID3 library reported by Youssef Achtatal

The WordPress security team have worked with the maintainer of the external getID3 library, James Heinrich, to coordinate a fix to getID3. A new version of getID3 is available here.

As a courtesy, these fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

Thank you to these WordPress contributors

This release was led by John Blackbourn. In addition to the security researchers mentioned above, WordPress 6.9.2 would not have been possible without the contributions of the following people: Dennis Snell, Alex Concha, Jon Surrell, Isabel Brison, Peter Wilson, Jonathan Desrosiers, Jb Audras, Luis Herranz, Aaron Jorbin, Weston Ruter, and Dominik Schilling.