WordPress 7.2 Roadmap: Sudo Mode, Secrets API, Gutenberg Notes, and Mullenweg's Return

#1. Matt Mullenweg Returns as Release Lead

In a move that has captured the attention of the entire WordPress ecosystem, Matt Mullenweg is officially leading the WordPress 7.2 Release Squad. Following the tumultuous events of September 2026, during which Automattic’s board temporarily placed Mullenweg on paid leave before he re-asserted control, his return as the active technical lead of the core release signals a direct, hands-on approach to steering the project’s direction.

Coordinating core developers, the Make Community teams, and system operations, Mullenweg’s squad is driving an ambitious agenda designed to solidify WordPress’s position as both a highly collaborative platform and a highly secure enterprise CMS.

#2. Collaborative Editing: Gutenberg Notes

WordPress 7.2 is taking direct aim at Google Docs-style collaboration within the block editor. At the center of this push is Gutenberg Notes, which is being built directly into the core editor interface.

With Notes, multi-user teams can:

• Highlight specific texts or block elements.
• Leave inline annotations and suggestions (similar to Google Docs’ suggestion mode, allowing authors to accept or reject edits).
• Add emoji reactions to facilitate quick, interactive feedback.

This feature represents a major step forward for editorial teams, shifting WordPress from a simple writing canvas into a fully collaborative production environment where writers, proofreaders, and clients can work concurrently without leaving the editor.

#3. “Sudo Mode” for Administrative Security

As the web adapts to automated scanning and sophisticated session-hijacking scripts, traditional administrator authentication is no longer sufficient. If a malicious script or attacker intercepts an active administrator’s cookies or session token, they gain unrestricted access to the entire site.

To mitigate this, WordPress 7.2 introduces “Sudo Mode”.

[Admin Action] ➔ [Sudo Mode Check] ➔ Session Active but Sensitive Action? ➔ [Re-Auth Prompt] ➔ [Action Executed]

Mimicking the Unix sudo command, Sudo Mode identifies highly sensitive actions, such as editing theme/plugin files, adding or promoting administrative users, changing core security settings, or updating plugins, and temporarily freezes them until the user re-verifies their identity. Even if an admin session is compromised, the hijacker cannot execute destructive operations without passing Sudo Mode’s re-authentication gate.

#4. First-Class Secrets API

Storing sensitive credentials (such as Stripe API keys, Mailchimp tokens, or custom database logins) has historically been an architectural vulnerability in WordPress. For over two decades, developers had no choice but to hardcode keys into wp-config.php or save them as un-encrypted options in the wp_options table.

WordPress 7.2 solves this with the native Secrets API.

The Secrets API introduces a standardized, secure core layer designed explicitly for managing credentials:

• Decoupled storage: Secrets can be stored outside of the standard SQL database, integrating with environment variables ($_ENV) or cloud-hosting secrets vaults.
• First-class functions: Standardized PHP functions like wp_get_secret() and wp_set_secret() ensure developers can retrieve keys without risking SQL injection or raw database exposures.
• Encrypted fallbacks: If cloud-level vaults are unavailable, keys are stored in the database using strong, native cryptographic encryption by default.

For agencies and developers building modern WordPress integrations (including AI agent integrations where API keys are heavily utilized), the Secrets API provides a robust, standardized framework that brings WordPress security up to modern enterprise standards.

#Preparing Your Platforms for WordPress 7.2

WordPress 7.2 represents one of the most structurally significant updates of 2026. The combination of collaborative editor workflows and hardened backend security primitives means agencies and developers must begin preparing their custom setups now.

At WPPoland, we are already preparing our headless Astro setups and serverless MCP integrations to consume the new Secrets API and adapt to Sudo Mode re-authentication flows.

Are you looking to secure your enterprise WordPress installation or migrate your custom plugins to the new 2026 core standards? Contact our core development team today for a custom migration plan.