In 2026, WordPress learned to talk to AI. Core now ships an AI Client, agents can publish to WordPress.com sites, and your SEO plugin can take instructions from an AI assistant. Most of it is plumbing, a fair amount is labelled experimental, and some of the AI plugins around it have shipped serious security flaws. This guide answers three questions for a marketing team running WordPress: what to adopt now, what to wait on, and what to lock down before an agent gets anywhere near production.

I’m not neutral here: we build, run and migrate WordPress sites for clients. I have every reason to tell you all of this is ready.

Some of it isn’t.

The Timeline, in One Place

Most of what matters came out of a handful of releases and announcements. Dates first, decisions after.

Core WordPress Has an AI Layer Now, but It Does Nothing on Its Own

“WordPress 7.0 adds AI” is a true headline that gives the wrong impression.

What 7.0 added is plumbing. The AI Client gives plugins one shared way to send prompts to a model, instead of every plugin shipping its own OpenAI or Anthropic integration. The Connectors screen, under Settings > Connectors, is where an admin stores the keys for those providers, with Anthropic, Google and OpenAI listed by default. The Abilities API gained a JavaScript counterpart, per the 7.0 field guide.

The sentence that matters most, if you’re worried about AI creeping into your site, is in the AI Client announcement: “WordPress Core does not bundle any AI providers directly.” Nothing calls a model until a plugin does, with a key someone entered.

The release post calls 7.0 “the start of a new era, laying the foundation for AI across the WordPress experience.” Foundation is the right word. WordPress 7.1 added validation and discovery features to the Abilities API, and its release post says nothing about the AI Client.

The decision: you don’t need to do anything about the AI layer to stay current. Update for security, not for AI. If you want AI features inside WP Admin, the reference point is the project’s own AI plugin: alt text, excerpts, titles, meta descriptions, translation and comment moderation. It needs WordPress 7.0.3 or later, a provider connector and your own API key, and it describes itself as “an experimental plugin.” Try it on staging.

Letting Agents Act on Your Site Depends on Where It’s Hosted

This is where the marketing is loudest and the gap between platforms is widest.

On WordPress.com, agent access is a product. A read-only Claude Connector arrived on February 5, 2026. On March 20, WordPress.com added 19 write operations, with specific safeguards: you switch each operation on individually, the agent asks before acting, new posts default to drafts, deleted items sit in the trash for 30 days, every action lands in the Activity Log, and WordPress roles still apply. By October 6, ChatGPT, Claude and Cursor could all connect, agents could install and activate plugins with approval, and MCP was included from the Personal plan up.

WordPress.com also has its own agent. WordPress Agent builds sites, edits content and manages plugins from chat, Slack, Telegram or email. WordPress.com says “most sites are ready in under four minutes.” Its support page doesn’t say whether it asks for approval before changing things, or which model powers it. Ask before you rely on it.

On self-hosted WordPress, agent access is a kit. The official route is the MCP Adapter, which turns a site’s Abilities into tools an agent can call. Its October announcement is plain: “MCP Adapter is still experimental.” Its release history shows breaking changes across several recent versions, and since version 0.6.0, abilities that plugins mark as public are exposed by default unless the plugin also opts them out of MCP. A contributor noted in an October comment on the AI team’s blog that the adapter has no OAuth support of its own. (OAuth is the sign-in handshake apps use to get limited, revocable access without your password.)

Vendor agents sit in between. Elementor’s Angie works on any WordPress site and lists 100,000+ active installs. It plans before acting and previews generated code before it reaches the live site, but its opt-in Super Admin Mode gives it read-write access to the file system, database and PHP layer.

Route Status, October 2026 What stops a bad action
WordPress.com MCP (Claude, ChatGPT, Cursor) Available on paid plans Per-operation toggles, approval prompts, drafts by default, Activity Log, roles
WordPress Agent (WordPress.com) Available on paid plans Not described on its support page
MCP Adapter (self-hosted) Experimental, v0.7.1 The WordPress user it signs in as, and which abilities plugins mark public
Angie (Elementor) Live, 100,000+ installs Plan and confirm, code preview; Super Admin Mode can execute PHP
WooCommerce MCP Developer preview since 10.3 REST API key permissions; staging recommended
Yoast SEO Abilities Live WordPress capability checks, a short list of writable fields

The decision: on WordPress.com, pilot it. Start with read-only operations, then drafts, then publishing. Self-hosted, wait on production write access through the MCP Adapter until it reaches the stable 1.0 the team is working toward, or scope it hard using the next section.

Your SEO Plugin Is Becoming an Agent Tool

This is where I’d actually start, because the work is dull, repetitive and easy to check.

Yoast now registers Abilities. Since its September 29 release, an AI tool can read a post’s title, meta description, robots settings, canonical, schema type and scores, and change a short list of fields: canonical, robots, cornerstone and schema type. The focus keyphrase stays read-only. Yoast SEO 28.7 on October 13 extended this to titles, meta descriptions and social previews. Permissions follow WordPress’s own capability checks. One caveat from Yoast itself: a change can only be rolled back while the AI tool still holds the old values, so have it read before it writes, and review in the same session.

Rank Math’s changelog shows MCP tools for 404 logs and sitemap status on September 23, and a new AI agent replacing its Content AI chat on August 27.

WooCommerce’s MCP has been a developer preview since version 10.3, covering nine product and order abilities. WooCommerce’s own advice is to use a staging site.

The decision: an agent that checks the SEO fields on every post and proposes fixes for a person to approve is useful today and low-risk. Pilot that. Keep agents away from store orders for now.

What to Guard Against: Keys, Auth and Exposure

Three things to lock down before any of the above touches production.

Your AI provider keys sit unencrypted in the database

The Connectors API announcement is candid: “API keys stored in the database are not encrypted but are masked in the user interface.” A key pasted into Settings > Connectors is stored as a site setting, which the post’s author says means “every plugin can access it.” Encryption is being explored, and the AI team is pushing a Secrets API for WordPress 7.2. Until then:

  • Set keys as environment variables or PHP constants. WordPress checks those before the database, using names like ANTHROPIC_API_KEY. That keeps the key out of database exports, backups and every staging copy made from them.
  • Know the limit. A constant or environment variable is still readable by code running on the site. Moving keys protects the copies, not the running site.
  • Give each site its own key with the lowest spending limit your provider allows, so a leak has a ceiling.

MCP is where AI plugin security keeps breaking

The AI Engine plugin, which WordPress.org lists at 90,000+ active installs, shows the pattern:

  • CVE-2025-5071, published June 19, 2025: a missing permission check let Subscriber-level users (the lowest logged-in role) run MCP commands, including creating users and changing options.
  • CVE-2025-11749, November 5, 2025: with the plugin’s “No-Auth URL” option on, its bearer token (the password-like string agents connect with) was exposed through a REST endpoint, letting unauthenticated attackers create an administrator. Rated 9.8 out of 10.
  • CVE-2026-8719, May 17, 2026: any valid OAuth token got MCP access without an administrator check, so a Subscriber could make themselves an Administrator.

Two of the three are the same mistake: the MCP layer checked that a caller was connected, not what that caller was allowed to do.

It isn’t one plugin’s problem. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins. Any AI plugin that can write to your site is a privileged account with a plugin’s security record.

  • If your site lets the public register, treat “Subscriber-level” flaws as open to strangers. Two of those three needed nothing more, and the third needed no account at all.
  • Switch off MCP and agent features in plugins you aren’t using.
  • Update AI plugins promptly. The WordPress AI plugin’s own 1.4.0 notes ask sites to “update promptly.”

Connect agents as a person you’d trust with the job

  • Give each agent its own WordPress user with the lowest role that does the work. The MCP Adapter’s permission checks “still run against the current user before anything executes,” so that role is your real boundary.
  • Issue a separate Application Password per agent. These are WordPress’s per-app passwords, and the adapter’s changelog points site owners to a guide on them. One per agent means you can revoke one without the rest.
  • Check what your plugins register before you connect a client. The AI plugin includes an Abilities Explorer for exactly that.
  • Treat everything an agent reads as untrusted. Comments, form entries and imported pages can carry instructions. Common Crawl found genuine prompt-injection attempts even inside llms.txt files.

AI Crawlers: The Controls That Work Sit at the Edge

A separate question, same sites: who gets to read your content, and for what.

If your site sits behind Cloudflare, its changes matter most. On July 1, 2025, it launched pay per crawl in private beta, letting publishers allow, charge or block individual AI crawlers. On September 24, 2025, its Content Signals Policy added three robots.txt preferences: search, ai-input (using your content to answer a question) and ai-train. Cloudflare is clear these are preferences, not technical countermeasures. And from September 15, 2026, new domains onboarding to Cloudflare block Training and Agent crawlers by default on pages that display ads. Search-only crawlers stay allowed, but Cloudflare says crawlers that also train, including Googlebot, Bingbot and Applebot, are blocked wherever Training is blocked.

llms.txt, a proposed file that summarizes a site for language models, is the other thing the major SEO plugins now offer. Google’s documentation says “You don’t need to create new machine readable files, AI text files, or markup to appear in these features.” Common Crawl’s analysis of its July 2026 crawl found 69.8% of the llms.txt addresses it requested returned 404, about half of the files that did exist followed the proposed structure, and llms.txt “is not an access-control mechanism.”

The decision: set crawler policy by category, at your CDN (the network layer in front of your site, like Cloudflare) and in robots.txt, on purpose, and check what your defaults are today. Publish llms.txt if your SEO plugin makes it one click. Don’t expect it to change anything.

What Didn’t Ship, and What to Watch

Plan around what shipped, not what was demoed.

  • Real-time collaboration, Google Docs-style co-editing, was pulled from 7.0 because Matt Mullenweg “is not confident the current approach is robust enough.” It isn’t in 7.1 either, and an October 14 post is still choosing the sync engine underneath it.
  • Embeddings, the basis of AI search by meaning rather than keywords, missed 7.1. The AI team is aiming at 7.2.
  • The Secrets API for safer key storage is a 7.2 proposal, not a feature.

The calendar is steadier than it was. The project proposed three major releases for 2026, aiming “to return to 3 major releases” after only two in 2025. 7.0 slipped six weeks, 7.1 landed on its proposed date, and 7.2 is scheduled for December 8. Mullenweg, quoted by Search Engine Journal from the project’s Slack, called for “an aim for 4-a-year in 2027.” Treat that as an aim.

Capacity is thinner. In September the AI team asked for “additional maintainers for the PHP AI Client, WordPress AI Client, and the three core connector plugins.” The code your AI features will lean on needs more hands.

The WP Engine lawsuit is still running. On September 24, 2026, the judge let WP Engine’s amended antitrust claims proceed against Automattic and Matt Mullenweg, a year after dismissing an earlier version but letting WP Engine refile, while the defendants’ counterclaims also survive at least in part. Nothing in it changes how your site runs today. It is a reason to keep your hosting and update path in your own hands.

And the market share number has moved. W3Techs puts WordPress on 39.6% of websites on October 19, 2026, down from 43.0% on January 1. Over the same months, sites with no CMS W3Techs can detect rose from 28.6% to 32.1%. That shows where share moved, not why. WordPress is still on 58.4% of sites whose CMS is known.

Adopt Now, Pilot, or Wait

Item Call Why
WordPress 7.1.3 Adopt now The October 6 maintenance and security release
AI provider keys in environment variables or constants Adopt now Keys saved on the Connectors screen are stored unencrypted
Crawler policy at your CDN and in robots.txt Adopt now Cloudflare’s defaults for new domains changed on September 15
Read-only SEO audits through plugin Abilities Pilot Permission-checked, narrow write scope
WordPress.com agent write access Pilot Toggles, approvals, drafts, logs
The WordPress AI plugin Pilot on staging Self-described as experimental
llms.txt Optional Google says it isn’t needed
MCP Adapter with write access on production Wait Experimental, no OAuth of its own
WooCommerce MCP Wait Developer preview
Angie Super Admin Mode Wait Can execute PHP on the live site
Real-time collaboration, embeddings Wait Not shipped

This Quarter’s Checklist

  • Update to WordPress 7.1.3.
  • Move AI provider keys off the Connectors screen and into environment variables or constants.
  • List every AI plugin, switch off the MCP features you don’t use, and update the rest.
  • Check your CDN’s AI crawler settings and your robots.txt against a decision someone actually made.
  • Pick one read-only agent task, such as an SEO field audit, and run it as a dedicated low-privilege user.

If you want a second pair of eyes on any of this before an agent touches production, start on our Connect page.