WordPress 7.0 RC4, StellarWP shutdown and Envato commission changes

#WordPress 7.0 release date and removed features

The key technical milestone is WordPress 7.0 RC4, published on 14 May 2026, and the accompanying Field Guide. RC4 means the release is very close to stable. It also marks the hard string freeze for translators. It also shows a more pragmatic release cycle than the earlier marketing around 7.0 suggested.

Real-time collaboration was one of the most visible planned features, but it has been removed from core for this release. The core team post of 8 May says Matt Mullenweg made the call because he was not confident the current approach was robust enough. The concerns it lists are surface area, race conditions, server load and memory efficiency, plus bugs that kept turning up in fuzz testing. The schedule stayed as it was, and the post names no target version for the feature, only “a future release”. That matters for agencies and site owners because a release candidate is not a wishlist. It is the point where compatibility, testing and operational discipline matter more than roadmap ambition.

The stable release was scheduled for 20 May 2026. That date itself came from a revised schedule published on 22 April, which replaced the original 9 April target. In parallel, the WordPress AI team was preparing version 1.0 of its AI plugin for 19 May, one day before core. That pairing matters: core ships Abilities API infrastructure while the plugin team adds governance controls on top of it.

Before a production rollout, teams should verify:

• theme and plugin compatibility,
• custom blocks and editor behaviour,
• WooCommerce, LMS, membership and editorial workflows,
• integrations using REST API, WP-CLI or custom endpoints.

For complex commercial sites, updating on day one is still a poor default. Test on staging, compare logs, check business-critical flows, then schedule the production window.

#What WordPress 7.0 Armstrong shipped on 20 May

WordPress 7.0 “Armstrong” was released on 20 May 2026, on the revised date. The announcement credits more than 875 contributors, over 200 of them first-time contributors, and more than 420 enhancements and fixes.

For developers, the AI pieces are the part that changes architecture. The Field Guide lists:

• WP AI Client, a provider-agnostic interface that lets plugins talk to generative AI models, with model preferences declared through using_model_preference(),
• Connectors API and a Connectors screen in the admin, where site owners manage connections to external AI providers,
• Client-Side Abilities API, a JavaScript counterpart to the PHP Abilities API, which the AI Client also builds on.

Two compatibility notes from the Field Guide belong on every upgrade checklist. The minimum PHP version for core is now 7.4, so any host still running PHP 7.2 or 7.3 blocks the update. The editor is now iframed, and the Field Guide ties that to block API version 3, which means older custom blocks registered with an earlier apiVersion need testing in the editor before the update reaches production.

The rest of the release is editor and admin work: a new “Modern” admin colour scheme, view transitions in wp-admin, a Command Palette shortcut, a Font Library page that works across block, hybrid and classic themes, visual revisions, per-device block visibility, a Breadcrumbs block and PHP-only block registration. Image generation, title and excerpt suggestions and alt text suggestions are not part of core. They live in the separate AI plugin.

#Why Liquid Web is retiring the StellarWP brand

The retirement of StellarWP by Liquid Web is not surprising in itself. After acquisitions, larger groups often simplify brand architecture. Kadence, LearnDash, The Events Calendar and Give are more recognisable product names than the umbrella brand.

The primary source is Liquid Web’s announcement of 12 May 2026. It says Liquid Web by Nexcess is concentrating its WordPress software into four core products: Kadence, LearnDash, The Events Calendar and Give. The word StellarWP does not appear in it. What is observable from outside: stellarwp.com now answers with a permanent redirect to liquidweb.com (checked on 15 October 2026).

The same post lists what happened to the smaller brands. SolidWP, Iconic, Restrict Content Pro and MemberDash are no longer sold as standalone products:

For agencies holding client licences, the operational details matter more than the branding. According to the announcement, existing licence keys stay valid and do not change, current plans keep their price and features while the subscription stays active, and switching to a new plan is optional, with a credit for unused time. All products now sit in one portal at software.liquidweb.com, and old portal links such as my.solidwp.com redirect there. If a subscription lapses, the customer has to buy one of the new plans to restore access. A small set of older tools is being retired: they keep working, but receive only critical security patches, and only until April 2027. For Kadence, the list includes WooCommerce Elementor, WooCommerce Elementor Pro, AMP, Slider Pro and Pricing Table, and the free Virtue, Pinnacle and Ascend themes are no longer available on WordPress.org.

The lesson is about dependency management. When the umbrella brand disappears faster than the licence portal updates, clients call their agency first. For every critical plugin, know who owns it, how often it ships, what changed after any acquisition and what the fallback plan is if the product direction changes.

#How much does Envato pay authors from July 2026

Envato’s move away from the old exclusive author economics is also significant. ThemeForest and CodeCanyon helped define how WordPress themes and smaller plugins were sold during the 2010s. That model had real flaws: heavy bundled themes, lock-in, uneven support and difficult migrations. Still, it gave many businesses a fast route to market.

Envato’s Author Hub announcement sets out the change. From 1 July 2026, Envato Market removes exclusivity requirements entirely, drops the distinction between exclusive and non-exclusive accounts, and moves every author to a 50% author fee, meaning authors receive 50% of the item price component of the list price. Envato states plainly that this is a reduction in earnings for exclusive authors. Non-exclusive authors see their fee fall from 55% to 50%. The new rate first shows up in the 15 August payout, and the changes sit in sections 9 and 13 of the Envato Market Author Terms. Envato explains the move with market conditions and says the new model is closer to Envato Elements, “which continues to be our core focus” (Envato’s wording).

The timing fits a longer pattern. When Shutterstock completed its acquisition of Envato in July 2024, its press release highlighted 650,000 Envato subscribers and Envato Elements, and did not mention Envato Market or its authors.

The new revenue model makes Envato less compelling as an exclusive home for authors. More product teams will likely build direct sales channels, documentation hubs, private licensing systems and GitHub-based development flows. Envato itself now allows that: an author can sell the same item on Market and in their own store or on other marketplaces. For buyers, that means more choice, but also more due diligence.

The practical question is no longer “is this item popular on a marketplace?” It is “can this vendor maintain the product, support it clearly and keep it compatible with the stack we run?”

#CERN migrating 800 sites to WordPress

CERN announced in 2025 that it is adopting WordPress as its future CMS. The WordCamp Europe 2026 session description puts the migration at 800+ websites, moved automatically onto a customised WordPress service. That is the kind of programme most agencies never touch in marketing copy but recognise instantly in procurement and governance meetings.

At WordCamp Europe 2026 in Kraków, CERN Web Manager Joachim Valdemar Yde and platform engineer Francisco Borges Aurindo Barros opened the conference programme on 5 June with Two worlds collide: WordPress at CERN, the first session after the opening remarks. The talk covered governance, infrastructure development and the automated migration. For European agencies, that is a useful reference when a client asks whether WordPress still belongs in “serious” infrastructure conversations. The hard part is not picking core. It is roles, editorial workflow, multilingual governance and update policy across hundreds of properties.

#How to set AI agent permissions in WordPress and WooCommerce

The most important AI news is not about copy generation. It is about infrastructure.

The WordPress AI plugin (formerly AI Experiments) shipped version 0.9.0 on 7 May with a Comment Moderation experiment, which scores comments with sentiment analysis and toxicity detection and flags them for review, a Content Resizing experiment and a wp ai alt-text generate command for bulk alt text. Version 1.0.0 followed on 19 May with two governance experiments: Request Logging, which lets administrators review AI requests and responses, and Connector Approvals, which lets administrators decide which plugins may use the configured AI connectors. WooCommerce is moving towards Abilities API and MCP adapter workflows. The direction is clear: AI agents should not merely read site data. They should be able to perform controlled actions with explicit permissions.

For commercial projects, that raises practical questions:

• who pays for token usage,
• which data may leave WordPress,
• how agent actions are logged,
• when human approval is mandatory,
• how read-only access is separated from actions that change orders, products or content.

This is where serious WordPress engineering work sits in 2026. The value is not adding another chatbot. The value is designing permissions, audit trails, cost controls and reliable operational boundaries.

#What do WooCommerce 10.8 and 10.9 add for AI agents

The WooCommerce developer blog described the commerce side on 12 May. WooCommerce 10.9 introduces canonical abilities for products and orders:

• woocommerce/products-query, woocommerce/product-create, woocommerce/product-update, woocommerce/product-delete,
• woocommerce/orders-query, woocommerce/order-update-status, woocommerce/order-add-note.

Each ability carries its own permission_callback that goes through WooCommerce’s existing permission model, and schema validation rejects unknown fields before anything runs. WooCommerce does not maintain its own MCP implementation. It bundles the official wordpress/mcp-adapter package, which exposes three tools to an MCP client: discover abilities, get ability info and execute ability. The older REST-derived MCP beta at /wp-json/woocommerce/mcp stays as a deprecated transition path and will be removed in a future version. The post gave 23 June 2026 as the planned 10.9 release date.

Update, 23 October 2026: the removal now has a version number. The WooCommerce developer blog wrote on 21 October that WooCommerce 11.3 removes /wp-json/woocommerce/mcp and stops bundling the wordpress/mcp-adapter package. Stores connect AI clients through the MCP Adapter plugin and a WordPress application password instead of a WooCommerce REST API key. If the same agent also has to reach a Shopify store or a custom backend, see MCP server development.

WooCommerce 10.8.0 shipped on 26 May, a week later than planned to leave room around the WordPress 7.0 release. It introduced a GraphQL API with its own settings section, and the 10.8 pre-release notes warned that the feature was still work in progress.

For stores, the practical test is not demo chatbots. It is whether product reads, order status changes and notes can be exposed with explicit capabilities and audit logs before any agent gets write access. The ability list above is a good starting point for that review: query abilities read, everything else writes.

#Avada and Burst Statistics security warnings

Recent warnings around Avada Builder and Burst Statistics show the same pattern from different angles. Popular WordPress tools attract attackers, and one compromised administrator account can affect many sites at once.

• Burst Statistics: Wordfence published CVE-2026-8181 on 13 May, a critical authentication bypass (CVSS 9.8) in versions 3.4.0 to 3.4.1.1 of a plugin with more than 200,000 active installations. An unauthenticated attacker who knows an administrator username could act as that administrator during a REST API request and, in the worst case, create a new administrator account. The vendor shipped version 3.4.2 on 12 May, one day after receiving the report.
• Avada Builder: the Wordfence vulnerability database lists an unauthenticated SQL injection (CVE-2026-4798) and an authenticated arbitrary file read (CVE-2026-4782) on 12 May, then an unauthenticated remote code execution (CVE-2026-6279, CVSS 9.8) affecting versions up to 3.15.2 on 20 May. All are marked as patched.

Not every security story this month was negative. GravityKit shipped cryptographic package signing for its commercial suite. According to its technical overview, every package is signed at build time with Ed25519 over a SHA-256 hash of the ZIP, and the shared Foundation library verifies the signature on the upgrader_pre_download hook, before WordPress unpacks anything. GravityView 2.57 is the first product to carry the verifier, and a signed revocation manifest lets GravityKit invalidate a compromised key. That is still rare in WordPress commercial plugins, and it is the kind of control enterprise clients ask about after the next supply-chain headline.

Maintenance in 2026 cannot mean “press update and hope”. It needs multi-factor authentication, separate operator accounts, update staging, admin activity monitoring and a list of critical plugins with clear ownership.

The headline trend is AI, but the operational reality is still security. A site with experimental agent workflows and weak account controls is not modern. It is exposed.

#Does Divi 5 hurt performance and cause page builder lock-in

Elegant Themes declared Divi 5 ready for production in its Divi 5.6 release notes of 25 May 2026, which say the beta phases have ended. The same notes include fixes for Divi 4 to Divi 5 conversion, including cases where Backward Compatibility Mode stayed active after migration. A new framework does not remove theme lock-in, but it changes the performance conversation for sites still on Divi-heavy stacks, and any migration needs a page-by-page check of converted layouts.

May’s Envato commission changes push more authors toward direct sales channels. If you are weighing native blocks against commercial builders, see Gutenberg vs Elementor vs Divi in 2026 for the audit matrix I use on client projects.

#How to prepare WordPress sites for 7.0

The May update points to a more fragmented but more capable WordPress ecosystem. Core is becoming more cautious with release quality. WooCommerce is preparing for agent-oriented workflows. Marketplaces are losing some of their old gravity. Product groups are consolidating brands after acquisitions. Large institutions such as CERN are betting on WordPress at scale. Security still decides whether a stack is professionally maintained.

For site owners, this is not a reason to panic. It is a reason to treat WordPress as a platform, not a one-off installation. The sensible next steps are staging for 7.0 with a PHP version check, a plugin ownership review, marketplace licence checks for any ThemeForest or CodeCanyon dependencies, and one controlled AI workflow with measurable value.

#WordPress 7.0 and AI integration guide

This article is an ecosystem roundup. For Abilities API, MCP adapters, and implementation detail, see the complete guide to WordPress 7.0 and AI integration.