WordPress 7.0: What's New, Release History & EOL Status

What Is New in WordPress 7.0

What does the new WP AI Client mean for plugin developers in WordPress 7.0?

WordPress 7.0 ships a provider-agnostic AI layer that lets plugins route requests to generative AI models without hard-coding a specific vendor. The WP_AI_Client_Prompt_Builder class and using_model_preference() function give you fine-grained control over model selection, cost optimization, and sequential workflow execution through the Abilities API.

In practice, the integration point is the new Settings > Connectors screen, which manages API keys for Anthropic, Google, and OpenAI out of the box. Your plugin declares which models it prefers, and Core handles routing:

// Declare model preferences in order of priority
using_model_preference( array(
    'anthropic/claude-3-5-sonnet',
    'openai/gpt-4o',
    'google/gemini-1.5-pro',
) );

Watch out for plugins that previously bundled their own AI SDK calls directly. Those will still work, but migrating to the WP AI Client means your users only configure credentials once. The wordpress/wp-ai-client package handles the upgrade path automatically when transitioning to 7.0.

The Client-Side Abilities API (@wordpress/core-abilities) complements this by auto-fetching server-registered abilities via the REST API, giving React components reactive access through useSelect from core/abilities. Abilities and categories can be unregistered server-side via the PHP API, so you retain full control over what surfaces in the editor UI.

How does the enforced iframed editor in WordPress 7.0 affect existing blocks?

WordPress 7.0 enforces the iframed post editor only when every block on the page uses Block API version 3 or higher -- if any block falls below that threshold, the iframe is removed and the classic non-iframed editor is used instead for backward compatibility.

This matters if you maintain blocks that were registered against Block API v1 or v2. Those blocks will silently opt the entire editor out of the iframe, which may affect other plugins that expect the sandboxed environment. The migration path is straightforward: bump your apiVersion to 3 in block.json:

{
  "name": "myplugin/my-block",
  "apiVersion": 3,
  "title": "My Block",
  ...
}

Most teams running modern block setups will get the iframed editor automatically, which improves style isolation and reduces CSS bleed between admin and editor. The tradeoff is that any block still on v1 or v2 becomes a blocker for every other plugin on that post. Audit your registered blocks before deploying to production sites that mix first-party and third-party plugins.

How does PHP-only block registration work in WordPress 7.0?

WordPress 7.0 lets you register fully functional blocks entirely from PHP, with no JavaScript required for the registration step itself. Declare 'supports' => array( 'autoRegister' => true ) alongside a render callback, and Core exposes the block to the client via a JavaScript global variable automatically.

register_block_type( 'myplugin/server-block', array(
    'supports'        => array( 'autoRegister' => true ),
    'attributes'      => array(
        'message' => array( 'type' => 'string', 'default' => 'Hello' ),
    ),
    'render_callback' => 'myplugin_render_server_block',
) );

PHP-registered attributes become editable in the editor, and inspector controls are generated from the attribute schema automatically via DataForm integration. This is a significant DX improvement for server-rendered dynamic blocks -- you can skip writing a JavaScript edit component for many common patterns. In practice, it reduces bundle size and simplifies block scaffolding for backend-heavy teams.

This feature also plays well with Block Bindings and Pattern Overrides, which now extend to custom blocks. If your block has complex attributes the HTML API cannot process during static rendering, supply a render_callback() to ensure bound attribute values are output correctly.

What changed with contentOnly mode and patterns in WordPress 7.0?

WordPress 7.0 applies contentOnly mode more broadly -- patterns that previously allowed unrestricted editing of their inner blocks now default to contentOnly mode, which hides non-content blocks from List View and restricts editing to declared content areas.

This is the most impactful breaking pattern change for plugin and theme developers. If your blocks are nested inside a contentOnly pattern and editors report they can no longer edit certain attributes, the fix is to add "role": "content" in block.json for those attributes:

{
  "attributes": {
    "caption": {
      "type": "string",
      "role": "content"
    }
  }
}

To opt out entirely for unsynced patterns, use the new disableContentOnlyForUnsyncedPatterns setting or the block_editor_settings_all PHP filter. Pattern Overrides also now extend to custom blocks via the block_bindings_supported_attributes filter, making it possible to build per-instance customizable patterns with any block in your plugin.

What security and infrastructure changes ship with WordPress 7.0?

WordPress 7.0 raises the minimum supported PHP version to 7.4, drops PHP 7.2 and 7.3 support, and tightens the default user registration flow by removing Administrator and Editor from the new-user default role selector in General Settings.

Site Health will alert administrators if either of those elevated roles had been previously selected as the default, reducing the risk of accidental privilege escalation on registration. Developers who need to restore those options can use the new default_role_dropdown_excluded_roles filter. This matters if your plugin or onboarding flow relies on programmatic new-user creation with elevated roles via the admin UI defaults -- review and adjust accordingly.

Other infrastructure highlights include CodeMirror updated to v5 (Esprima replaced by Espree for full ES6 linting), PHPMailer bumped to 7.0.2, backbone.js upgraded to 1.6.1, and the Requests library updated to 2.0.17. The Script Loader now supports scripts depending on ES modules (Trac #61500), and HTML5 script theme support has been fully deprecated and removed.