WordPress 7.0 is the biggest release in years, but it isn't the "AI revolution" the headlines are reaching for. The core team has shipped sensible plumbing (a provider-agnostic AI Client, a Connectors API for credentials, and an Abilities API that lets plugins describe what they can do) plus a long-overdue admin refresh.
For B2B marketing teams running content and lead-generation sites on WordPress, there is genuine upside. Most of the wins are unglamorous, and the failure modes are the same as ever: cost creep, plugin sprawl, data going somewhere it shouldn't, and AI bolted onto problems it doesn't fix.
This is what's actually in the box, what it changes for B2B teams, and what we'd do in the first 30 days.
WordPress 7.0 shipped on 20 May 2026, two months later than originally planned. The headline change is AI infrastructure in core, which is unusual for an open-source CMS that has historically left this kind of thing to plugins.
There are three new layers worth understanding.
The AI Client (php-ai-client) is a small PHP API in core. Plugins and themes can ask it to talk to "an AI", and the Client routes the request to whichever provider you've configured. The point is that plugins stop reinventing this wheel.
The Connectors API is the credential and provider layer. Under Settings > Connectors, site owners enter their API keys once. WordPress 7.0 ships with three providers configured by default: OpenAI, Anthropic (Claude), and Google (Gemini). One set of keys, shared across every AI-aware plugin on the site.
The Abilities API is the part that matters most for the future. It's a registry where plugins, themes, and core can declare structured capabilities ("I can create a post", "I can summarise this product description", "I can update an order status"). The capabilities are described with input and output schemas and permission checks. Translated: WordPress just gave every plugin a machine-readable interface for AI agents to call.
Outside of AI, the release also includes DataViews replacing the old admin list tables (Posts, Pages, Media all rebuilt; faster filtering, no more page reloads), PHP-only blocks (developers can register blocks server-side with no React or build pipeline), view transitions for smoother admin navigation, and a long-running migration of password hashing from phpass and MD5 to bcrypt. Real-time collaboration was promised, but pulled on 8 May 2026 after performance issues in beta. It has been pushed to a later release.
For B2B marketers, three things in the AI layer matter day-to-day.
Settings > Connectors is where you plug in. Pick a provider, paste an API key, choose a default model. From that point any plugin that uses the AI Client uses the same connection. If you want to switch from OpenAI to Anthropic, you change it in one place and every dependent plugin moves with you. This is the bit that quietly reduces lock-in to any one model vendor, which is more valuable than it sounds.
Settings > AI Experiments is the on/off switch for the AI features that ship in core: title generation, excerpt drafting, alt text on uploaded images, content summarisation, and basic image generation. These are off by default. By default, WordPress 7.0 does not send any data to an external AI provider. You have to turn each capability on, deliberately, after you've connected a provider.
The Abilities API is the one to keep an eye on. In 7.0 it's mostly developer-facing. The pay-off comes when agentic tools start using it, which we expect within a year. At that point, an external AI agent could be told "draft a Q3 campaign landing page in WordPress", and it would discover available capabilities through the API, draft the page, set the right tags, and submit it for review, without bespoke integration work. That's a long way from where most teams are now. It is the direction of travel and worth designing your content workflows around.
For B2B and professional services marketing teams in particular, there are four places we think the AI layer earns its keep.
Alt text and accessibility at scale. The most boring win and probably the most valuable. Auto-drafted alt text on image upload, reviewed by an editor in seconds rather than written from scratch in minutes. For sites that have spent a decade dumping images without alt attributes, this is a low-effort path to a meaningful accessibility and SEO improvement.
Title, excerpt and meta description drafting. Particularly useful for resource hubs and B2B blogs with high publishing cadence. You get a sensible starting draft and an editor improves it. The team writes fewer first drafts and reviews more, which is usually a better use of senior time.
One set of keys across the plugin ecosystem. Less admin overhead, fewer accounts to manage, easier governance. When the marketing team wants to trial a new AI-powered plugin (a content brief tool, a campaign idea generator, an SEO optimiser), you don't need a new vendor procurement. You install the plugin and it uses the keys you've already approved.
Easier provider switching. Pricing and model quality are moving every quarter. Being able to switch providers in one place, without rewriting plugin configurations, is genuinely useful in a market that hasn't settled.
What it doesn't do: it doesn't write your strategy, it doesn't fix tracking, it doesn't replace a content editor with judgment, and it doesn't turn a site that converts at 0.4% into one that converts at 4%. The AI layer is plumbing. What flows through it is still your team's job.
The risks are real and most of them are predictable.
Data leaving the site. The Abilities API makes it easier for plugins to send content to an external model. For a brochureware site, fine. For B2B sites with customer data in form submissions, CRM-integrated lead capture, gated content with personally identifying information, or sensitive proposal documents, you need to know exactly what content types are being sent, to whom, and what gets logged. Default-safe (nothing is sent without explicit configuration) is welcome. Default-safe two years from now, with twenty plugins installed by three different teams, is much harder to guarantee.
Connecting to a shared organisational AI account. This is the risk that gets discussed least and probably matters most. If your developers plug an existing organisation-wide OpenAI, Anthropic or Google key into Settings > Connectors, every CMS user with permission to use AI features is now operating through that account. Two problems follow.
First, anything the account has access to becomes reachable through that key. Uploaded files, assistants, vector stores, project memory, fine-tuned models, any of it. A content editor could write a prompt along the lines of "draft an article about the company's HR department and its redundancy plans" and the model could draw on whatever sits inside the organisational account, not just public knowledge. Most CMS user roles can edit prompts. Few have the security clearance to read what those prompts might surface.
Second, the audit trail collapses. Every API call gets attributed to the shared account, not the person at the keyboard. If something sensitive turns up in an unpublished draft, working out who asked for it gets hard.
The fix is straightforward. Spin up a dedicated AI provider account, or with OpenAI and Anthropic a dedicated project or workspace, used only for the website. No file uploads. No assistants. No shared resources. Separate billing if possible. Treat the website's AI key like you'd treat any other production credential.
Cost creep. There are no spend caps in core. A poorly written plugin could quietly burn through your OpenAI budget. Watch for plugins that don't expose their request volumes, and set provider-side spending limits on whatever account you connect.
Cloud-favoured defaults. The three default connectors are all cloud providers. WordPress supports local AI providers in theory, but the tooling, documentation, and default UX all assume you're calling out to a hosted model. For regulated industries or organisations that have made commitments about where their data sits, that's a working assumption to push back on.
Plugin security track record. Independent researchers found that 43% of WordPress AI plugins shipped in 2025 had critical security flaws. The AI Engine plugin, with over 100,000 installs, shipped a vulnerability that exposed API credentials on a public page. The Connectors API helps because credentials live in one trusted place. The broader plugin ecosystem is still the soft underbelly. Be cautious about which AI-aware plugins you install, and treat the AI Experiments shipped in core differently from third-party AI features.
AI for the sake of AI. The biggest cost is opportunity cost. There is a strong temptation to turn on every AI feature because it's there. Most B2B marketing problems we see (weak tracking, broken attribution, slow pages, thin content, a homepage that doesn't speak to the buyer) are not problems AI can fix. They are problems AI can help disguise. The right move is to treat the AI layer as an editor's productivity tool first, not a content strategy.
Standard upgrade advice applies. Wait for the 7.0.1 point release before upgrading production sites that matter. Plugin compatibility is the usual concern; expect a few weeks of churn while plugin authors catch up. Sites already on WordPress 6.7 or 6.8, with a managed hosting partner and a staging environment, should plan a controlled upgrade in the next six to eight weeks.
If you're on a custom Drupal build, a Shopify storefront, or a headless setup, none of this changes your roadmap. The AI Client is a WordPress-core feature. The wider direction of travel (provider-agnostic AI APIs, agent-callable platform capabilities) is industry-wide.
Five practical steps for B2B marketing teams running WordPress sites.
Talk to your development partner about an upgrade window for 7.0.1, not 7.0. Get the upgrade booked in.
Decide which AI provider your organisation is already comfortable with. If there's a vendor agreement in place with OpenAI, Anthropic, or Google, use that one. The Connectors API is provider-agnostic. Procurement isn't.
Audit your existing AI plugins. Anything still on phpass-era assumptions, anything that asks for an API key in its own settings page rather than using the AI Client, is a candidate for replacement.
Write a one-page AI usage policy for your marketing team before you turn anything on. What content is allowed in prompts. What isn't. Who reviews AI-drafted copy before publication. Boring, but it pays back when the first awkward question lands.
Decide what you're not going to do. Probably more important than what you will.
If you'd like a second opinion on whether to upgrade, or want help scoping the work, book a 30-minute call with one of our Directors and we'll give you a straight answer.
When did WordPress 7.0 release? WordPress 7.0 released on 20 May 2026, two months later than the original April date. The delay gave the core team time to firm up the AI infrastructure and pull real-time collaboration out of the release.
Does WordPress 7.0 send my content to AI providers by default? No. By default, WordPress 7.0 does not send any data to external AI providers. AI features are opt-in. You have to connect a provider in Settings > Connectors and turn on each capability in Settings > AI Experiments before any external requests are made.
Which AI providers does WordPress 7.0 support? WordPress 7.0 ships with three default connectors: OpenAI, Anthropic (Claude), and Google (Gemini). Other providers, including local and self-hosted models, can be added by plugins through the Connectors API.
What is the Abilities API in WordPress 7.0? The Abilities API is a core feature that lets plugins, themes, and WordPress core register named capabilities with structured input and output schemas. It gives AI agents a discoverable, machine-readable interface to interact with WordPress features, such as drafting posts, generating excerpts, or updating content.
Is the AI integration in WordPress 7.0 safe for regulated industries? It can be, but it requires deliberate configuration. The AI Client is provider-agnostic and supports local AI providers in theory, but the default tooling favours cloud providers. For regulated industries, work with your development partner to scope what content can be sent, where it goes, and what gets logged before turning anything on.
Can I use my organisation's existing OpenAI or Anthropic account for WordPress 7.0? Technically yes, but it's a poor idea. The API key entered in Settings > Connectors gives every AI-enabled CMS user access to whatever the account can see, including any uploaded files, assistants, vector stores, and fine-tuned models attached to it. A content editor writing a creative prompt could end up surfacing material that was never meant for marketing use. Use a dedicated AI provider account or project for the website only, with no other resources attached, and treat the key as a production credential.
Will WordPress 7.0 break my existing plugins? Most plugins should continue to work. Some plugins that managed their own AI provider connections may need updates to use the Connectors API properly. As with every major release, wait for the 7.0.1 point release before upgrading production sites and test thoroughly in staging.
What happened to real-time collaboration in WordPress 7.0? Real-time collaboration was originally planned for 7.0 but was pulled on 8 May 2026 due to performance issues in beta testing. The feature has been deferred to a later release. No firm date has been announced.
Is WordPress 7.0 worth upgrading for if I'm not using AI? Yes. Outside of AI, 7.0 includes DataViews replacing the old admin list tables (faster, no page reloads), PHP-only blocks for developers, view transitions for smoother admin navigation, and a migration of password hashing to bcrypt. These are useful improvements regardless of whether you turn on the AI features.
If you prefer to speak with someone, call 01202 203160 or if you'd like to book a 30 min meeting to see if we can help just let us know and we'll arrange a call with one of our Directors.