WordPress Core Dev Chat Summary: Secrets API Proposal, 7.2 Roadmap, and Support Tooling

The WordPress Core Development Team held its weekly meeting on September 2, 2026, at 15:00 UTC in the #core Slack channel. Facilitated by @audrasjb, the session brought together developers, security leads, and core contributors to discuss critical infrastructure proposals, release timelines, and community updates. The agenda focused on foundational updates for the upcoming WordPress 7.2 release, the scheduling of the WordPress 7.1.1 point release, and strategic moves regarding open-source security and artificial intelligence policies.

Executive Summary of the September 2, 2026 Core Dev Chat

Key highlights from the meeting included:

• WordPress 7.2 Proposals: Introduction of a proposed native Secrets API designed to standardize key management and secure credential storage in core.
• Release Cadence: Release squad selection for WordPress 7.2 is nearing completion, with an announcement expected early the following week. The official schedule for WordPress 7.1.1 was also confirmed.
• Roadmap Planning: Core team lead @annezazu initiated priority collection for the WordPress 7.2 roadmap, with Beta 1 approaching in under two months.
• Support Diagnostics: Discussion surrounding ticket #65910, aiming to build standardized support and diagnostic tooling into core for plugin, theme, and WordPress.org support teams.
• Security and Policy: Updates to the WordPress Vulnerability Disclosure Program and official support for the Open Weights and American AI Leadership letter.

Architectural Proposal: A Dedicated Secrets API for WordPress 7.2

One of the most notable technical updates announced during the meeting was the proposal for a dedicated Secrets API slated for WordPress 7.2. Historically, WordPress has relied on constants defined within wp-config.php (such as AUTH_KEY, SECURE_AUTH_KEY, and LOGGED_IN_KEY) or stored unencrypted options within the wp_options database table to manage API keys, tokens, and credentials.

This traditional approach presents several architectural limitations:

• Lack of Rest Encryption: Storing API keys or access tokens directly in the options table leaves sensitive data exposed to unauthorized database reads or database export leaks.
• Inconsistent Integration: Plugin and theme authors frequently implement ad-hoc encryption layers or plain-text options, leading to varying security standards across the ecosystem.
• Environment Management Challenges: Modern hosting environments favor environment-variable-driven secret management, which is difficult to seamlessly interface with standard WordPress options without custom code.

The proposed Secrets API aims to address these limitations by establishing a unified interface within WordPress core. By standardizing secret storage, retrieval, and potential hardware- or environment-level key wrapping, the API will allow developers to store sensitive configuration data securely while minimizing attack surfaces.

WordPress 7.2 Release Timeline and Roadmap Preparation

With WordPress 7.2 Beta 1 less than two months away, planning for the release cycle has entered a key phase. During the meeting, @jeffpaul resurfaced a call to action from @annezazu, who is drafting the official WordPress 7.2 roadmap post.

The core roadmap prioritizes major architectural initiatives, block editor refinements, and core performance tracks rather than granular bug fixes. Contributors working on core features intended for 7.2 were requested to flag their projects immediately to ensure inclusion in the early public draft. Additionally, @jeffpaul confirmed that the official WordPress 7.2 release squad is expected to be published early the following week, establishing the leadership structure for the upcoming beta and release candidate phases.

Support Tooling and API Architecture: Ticket #65910

Core facilitator @audrasjb brought attention to ticket #65910, highlighting its potential utility for technical support teams across WordPress.org as well as commercial plugin and theme ecosystems.

The proposal centers on creating a standardized diagnostic or support-facing tool built directly into core, potentially backed by an extensible API. Key technical considerations raised for ticket #65910 include:

• API Architecture: Creating structured endpoints or internal functions that surface operational health data without exposing sensitive environment variables or unmasked configuration details.
• UI and Proof of Concept: While formal UI design is still required, the team noted that a functional Proof of Concept (POC) can be built using existing Dashicons and native core CSS styles to evaluate usability before committing to custom design assets.
• Ecosystem Utility: Providing a reliable standard for third-party support technicians to quickly identify environment mismatches, broken rewrite rules, or database state issues without requiring ad-hoc diagnostic plugins.

WordPress 7.1.1 Maintenance Schedule Confirmed

In addition to 7.2 planning, the meeting covered immediate maintenance track milestones. The official release schedule for WordPress 7.1.1 has been published. Point releases like 7.1.1 focus exclusively on resolving bugs, regressions, and security edge cases identified following the primary 7.1 release.

Maintaining a predictable minor release cadence is essential for host automated update pipelines and enterprise deployments, ensuring stability across production environments without introducing breaking changes or schema modifications.

Security Governance and AI Policy Updates

The meeting also covered broader governance updates impacting core development practices and ecosystem policies:

Vulnerabilities Disclosure Program Updates

Updates to the WordPress Vulnerability Disclosure Program were highlighted. These revisions aim to streamline security bug reports submitted via official channels (such as HackerOne), ensuring faster triage times, consistent severity scoring via CVSS metrics, and clear disclosure guidelines for security researchers auditing core software.

Open Source AI and Open Weights Leadership

WordPress has officially signed the Open Weights and American AI Leadership letter. This movement advocates for open-source AI models and open-weights accessibility, reflecting WordPress’s core philosophy of open software distribution. As machine learning tools and automated assistants become increasingly integrated into CMS publishing workflows, defending open access to model parameters ensures independent developers are not locked out by proprietary AI ecosystems.

Technical Quality: Expanding Core Test Coverage

During the open discussion section, long-time contributor @pbearne advocated for merging pending patches focused on expanding core unit test coverage. Enhancing the unit and integration test suite (managed via PHPUnit and Playwright) is critical as core preps for major structural changes like the Secrets API.

Increasing test coverage provides several tangible technical benefits:

• Prevents subtle regressions in legacy hook executions and database queries.
• Accelerates continuous integration (CI) test suites run via GitHub Actions.
• Provides clear usage contracts and expected fail-states for new core APIs.

Next Steps for Core Contributors

Developers and contributors planning to participate in the WordPress 7.1.1 and 7.2 release cycles should focus on the following immediate actions:

1. Review the Secrets API Proposal: Test early patches and submit architectural feedback regarding key rotation and encryption methods.
2. Flag 7.2 Priorities: Notify @annezazu of dedicated core feature work to ensure accurate roadmap representation.
3. Contribute to Ticket #65910: Test the diagnostic POC and contribute feedback regarding support API requirements.
4. Submit Test Patches: Help review and merge test-only Trac tickets to bolster build confidence ahead of 7.2 Beta 1.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.