WP Pulse — February 28, 2026

🔒 Security

195 WordPress Vulnerabilities Disclosed in a Single Week

Wordfence's weekly intelligence report for February 16-22 logs a substantial batch of plugin and theme vulnerabilities, several at critical severity. Alongside the disclosure data, Wordfence has launched a Triple Threat Bug Bounty Challenge running through April 6, offering 2x payouts on high-threat submissions to incentivize researchers to hunt the riskiest attack surfaces.

See full report

🌟 Industry News

App Kits, AI Agents, WordPress 7.0: February's Biggest Moves

WPBeginner's February Spotlight rounds up the most eventful month in recent memory. WordPress 7.0 Beta is live for testing, MemberPress AppKit lets membership sites launch branded iOS and Android apps without code, and AI agent integrations are spreading fast across the plugin ecosystem. One issue, five storylines worth your attention.

Read the roundup

🔍 Research

AI Is Rewriting the Search Rules: Yoast's February Breakdown

Yoast's monthly SEO update unpacks February's AI-driven search shifts. Bing's new citation report shows publishers how often Copilot references their site, while Google's expanded robots.txt controls let sites manage AI crawler access with precision. The agentic web is no longer hypothetical.

Read the recap

📝 Tutorial

That Asterisk Is Lying to You About Required Fields

ACF's deep-dive reveals a common WordPress trap: the required-field asterisk is purely visual and enforces nothing on its own. The post maps out how forms, registration plugins, and publishing workflows each handle validation differently, and shows where server-side enforcement is the only reliable option.

Read the deep-dive

🔐 Security

Another Host Bets on Patchstack for WordPress Security

UK and Ireland-based BigWetFish Hosting has integrated Patchstack's automated vulnerability detection, giving customers real-time protection during the critical window between a vulnerability's public disclosure and an available patch. It's the latest sign that serious hosting providers are treating dedicated WordPress security tooling as a baseline, not a bonus.

Read announcement

Trend of the Week

Security and AI Are Eating the WordPress Ecosystem

This week's news makes two forces impossible to ignore. WordPress security is professionalizing at pace: Wordfence's weekly disclosures keep climbing, and hosting providers are embedding Patchstack-style protection as a baseline expectation, not an upgrade. Simultaneously, AI is reshaping how WordPress sites are discovered, built, and ranked, as Yoast's February update makes clear. The builders paying attention to both fronts right now are the ones who will be well-positioned when these shifts fully mature.