WordPress 7.0 had a strong first week. The rollout moved fast, and the big story for site owners is simple, update confidence looks justified. At the same time, one serious plugin flaw and one host control warning show why basic maintenance still matters.

WordPress 7.0: Stable start, small catch

WordPress 7.0 reached roughly 46% adoption in its first week. That is a strong signal. Auto-updates worked at huge scale, and no broad security or breakage story has surfaced.

That should push most site owners off the fence. If you still have not updated, do it soon. Test on a copy of your site first if you rely on older plugins or a custom theme.

The release also brought useful accessibility gains. WordPress can now pull image alt text from photo metadata when it exists. The media library works better with voice control, and the refreshed admin colors improve contrast.

Those changes help real teams. Editors save time on image uploads, and more people can use the dashboard comfortably. Still review imported alt text before you publish, because automation does not know your context.

One group should move more carefully. If your site uses the Classic Editor and adds custom buttons to the publish area, install the official hotfix or update Classic Editor to 1.7.0. Otherwise, your editors may hit a frustrating publishing bug.

Security: Patch the old risks, respect the new ones

If you run WP Maps Pro, update now. A serious flaw could let an attacker create an administrator account and take over the site. The fix landed in version 6.1.1, and the security advisory spells out the risk clearly.

Do not stop at the update. Check your user list for admin accounts you do not recognize. Then reset passwords for admins and review recent plugin or theme changes if anything looks odd.

WordPress 7.0 also raises a newer kind of risk. More site owners now store AI service keys, the secret codes that let WordPress use paid AI tools, inside the dashboard. Attackers will go after those because they can turn stolen keys into real bills fast.

Treat AI keys like payment details. Create limited keys when the service allows it. Set spending caps, rotate keys on a schedule, and delete any key your site no longer needs.

Hosting: Better support, better boundaries

WordPress now says newer versions fully support newer PHP releases. PHP is the server software WordPress runs on. That means WordPress 6.8 and later fully support PHP 8.4, and WordPress 6.9 and 7.0 fully support PHP 8.5, as outlined in the official clarification.

That matters because old PHP versions cost you speed and security. Ask your host which PHP version your site runs today. If you still sit on 8.1 or older, push for an upgrade plan.

This week also delivered a reminder about site control. SiteGround auto-installed its AI Agent plugin on customer WordPress sites, and customers pushed back hard. They had a point.

Your site should not become a test bed for host product decisions. Review the plugins your host can add or manage for you. Then make sure you can disable anything you do not want, and ask your provider to spell out that policy in plain English.

End of article