AI features in WordPress core, plugin AI connectors, and how WordPress sites are integrating with modern AI providers.
AI is no longer a plugin afterthought. WordPress 7.0 introduces the Web Client AI API, an in-core layer that gives every plugin and theme a standardised way to talk to any AI provider. That's a much bigger change than it sounds. Up until now, every WordPress AI integration has been a one-off: bespoke OpenAI key wrappers, settings pages reinventing the same wheels, no consistent UX. The new abilities API replaces all of that.
The articles here track what the in-core AI layer actually enables, which plugins are wiring up early, and what it means for the small and medium UK businesses we work with. We're not in the business of AI hype. We're in the business of pointing out what works, what doesn't, and what's worth using on a real client site this quarter.
Ask an AI to email you a PDF and it either says it can't, or it starts typing the file out as base64 and runs out of reply. That is not the model being bad at files. MCP tool arguments are JSON, and JSON has no file type, so every server hits the same wall separately. Here is the gap in the spec, what base64 really costs (including the figure we published wrong for a month), and the four routes we built instead.
An ability can pass every test, satisfy its JSON Schema and have a hardened permission_callback, and still be a bad ability, because the model will not pick it, picks it for the wrong job, or calls it four hundred times in a row. We ship a commercial MCP server with 32 mail tools and up to 21 calendar tools on live customer mailboxes. Here are the nine design rules that surface bought us, each translated into runnable wp_register_ability() code.
Every WordPress 7 Abilities API tutorial ships the five-line `__return_true` pattern. It works on a laptop. It's also the shortest path to an AI-callable backdoor on production. Here's the hardened permission + input + output schema stack production sites need, plus a 12-point pre-ship audit.
WordPress 7 (due once the revised schedule is confirmed on 22 April) extends the Block Bindings API so every block can pull its content from a structured data source instead of holding it directly. Edit one field and every page that uses it updates. Cleaner maintenance, faster sites, stronger SEO, and content an AI can actually understand.
Anthropic's Claude Mythos model identified thousands of zero-day vulnerabilities in every major operating system and web browser. Twelve companies got advance access through Project Glasswing. Everyone else, including the businesses whose websites run on that software, will have to wait for patches.
WordPress 7.0 ships a Connectors API, a built-in AI Client, and an Abilities API. Configure your API key once, and every plugin on your site can use it. The catch: core has no per-plugin budget cap, no rate limit, no monthly ceiling.
WordPress 7 was supposed to ship live from WordCamp Asia today. It hasn't. The core team paused the release to rebuild the database layer for real-time collaboration. Here's what that quietly tells you about the state of the release.
Press Forge
