WordPress, the CMS that powers over 43% of the internet, faced a defining month in July 2025. From security crises and forward-looking development updates to governance disputes that shook its open-source core, this month revealed both the platform’s strengths and the growing pains of its maturity. This detailed recap covers the most important stories, insights, and expert commentary from the last 30 days—including quotes and references from developers, security researchers, and community leaders.
Widespread Vulnerabilities: July’s Cybersecurity Wake-Up Call
WordPress’s vast plugin ecosystem is a double-edged sword—offering functionality but also exposing sites to risk. Adopting a zero trust security model can help mitigate these risks. July 2025 was particularly rough, with over 37 new vulnerabilities reported in Sucuri’s monthly roundup. These included XSS flaws, SQL injections, PHP Object Injections, and Remote Code Execution (RCE) vulnerabilities.
Notable Exploits
- Elementor Website Builder: With over 10 million active installations, this plugin faced an XSS flaw (CVE-2025-4566). “If you’re running v3.30.2 or below, you’re exposed,” warned @sucurisecurity.
- WPvivid Backup & Migration: Over 700,000 sites were exposed to an unauthenticated file upload vulnerability (CVE-2025-5961), allowing full site takeover. Wordfence noted, “The impact could be catastrophic for poorly maintained installs.”
- Forminator Forms: A trifecta of vulnerabilities included PHP Object Injection, Arbitrary File Deletion, and SQL Injection, all patched in v1.45.1.
- Post SMTP (CVE-2025-24000): With 400,000 active users, 160,000 were unpatched as of July 28. Attackers could reset passwords and hijack admin accounts.
- Alone Theme (CVE-2025-5394): One of the most severe. Exploited in the wild, the RCE vulnerability affected 9,000+ sites. @wordfence reported over 120,000 blocked attempts.
Community Reaction
On X, conversations exploded around the sheer volume of high-severity issues. Developers and agencies alike began reevaluating their plugin stacks, some even publishing their own internal vulnerability audits for clients.
Development Bright Spots: Coding Standards and the Road to 6.9
In contrast to the ongoing security challenges, WordPress’s development community released important enhancements.
Coding Standards 3.2.0
On July 24, the WordPress Coding Standards (WPCS) 3.2.0 release delivered faster linting, improved support for deprecated functions, better heredoc/nowdoc formatting rules, and compatibility with PHP 8.4. Tools like the WPCS MCP Server are making it easier for developers to adopt these standards with AI assistance.
WordPress 6.9 Roadmap
Scheduled for December 2, 2025, WordPress 6.9 promises advancements in the block editor, AI-assisted tooling, and overall performance. Highlights include:
- Block-level commenting and collaboration support
- Support for multiple templates per slug
- Expansion of the Command Palette for admin workflows
- AI-ready functions using the new Abilities API
Admin UI Overhaul: Introducing a New Paradigm
A proposal emerged on July 26 via GitHub suggesting a comprehensive redesign of the WordPress admin interface. The proposed overhaul aims to shift WordPress toward a modern, component-based UI system.
Structural Criticisms: Is WordPress Losing Its Way?
One of the most widely read pieces in July was “The Slow Implosion of WordPress”, which argued that WordPress is becoming increasingly complex, commercialized, and detached from its open-source ethos.
Leadership and Legal Drama: Mullenweg vs. WP Engine
The drama between Matt Mullenweg and WP Engine continued to dominate governance conversations in July. In July, a class-action suit was filed on behalf of affected users.
Looking Ahead
WordPress in July 2025 was a microcosm of the platform’s complex reality. The rest of 2025 promises critical developments including the release of WordPress 6.9 in December. For a deeper look at the WordPress roadmap, see our complete guide to WordPress 7.0.
For now, the takeaway is clear: WordPress is evolving, but that evolution demands transparency, vigilance, and above all, community.
