WordPress 7.2 is scheduled for release on December 9, 2026, with Beta 1 landing October 20–22 — worth planning around now if you manage multiple sites or have a testing workflow that needs lead time. As with any beta roadmap, being on the current feature list doesn’t guarantee final inclusion, but several of the planned changes are worth knowing about ahead of release regardless of exact final scope.
What’s Actually Planned
| Area | What’s coming |
|---|---|
| Default theme | “Ipsum” — a deliberately minimal, blank-canvas theme, kept simple partly so AI tools can work with it more easily |
| Collaboration | Suggestion mode for Notes — proposed edits an author accepts or rejects, similar to Google Docs’ Suggesting mode |
| Styling | Form styling added to Global Styles — style buttons, text fields, dropdowns, and labels without writing custom CSS |
| New blocks | A Description List block (for glossaries/specs) and a Table of Contents block nearing stable status |
| Security | Improved Application Passwords, a new Secrets API for storing API keys, and early groundwork for “sudo mode” |
| Admin UX | Clearer error messages, more accessible notices, and a cleaner, more consistent icon set |
Why the Secrets API Specifically Matters
A dedicated Secrets API for storing API keys addresses a real, long-standing gap — plugins have historically stored API keys and similar sensitive values in regular postmeta or options tables with no special protection, the same storage mechanism as ordinary content. A proper Secrets API gives plugin developers a standard, more secure place to put genuinely sensitive values, which matters directly for the kind of credential-handling we’ve covered across various plugin CVEs this year.
Why “Sudo Mode” Is Worth Watching
Early groundwork for sudo mode suggests WordPress core is moving toward requiring re-authentication before sensitive actions (even within an already-logged-in session) — a pattern familiar from other platforms that re-prompt for a password before letting you change account security settings, even mid-session. This is a meaningful security-model shift if it lands, directly relevant to limiting the damage a hijacked session can do, which connects to the credential-stuffing and session-hijacking patterns we’ve covered elsewhere.
What to Actually Do Before December 9
- Plan staging-environment testing time around the Beta 1 window (October 20–22) if you want to test early, rather than waiting until the stable release to discover compatibility issues.
- If you’re currently building custom functionality around Application Passwords, watch for the improvements specifically, since your implementation may benefit from or need adjustment for the updated behavior.
- Don’t assume every listed feature will ship — beta roadmaps regularly shed scope before final release; treat this as a preview of direction, not a committed feature list.
- Budget normal update-testing time around December 9 as you would for any major release, particularly checking custom code against the new Form Styling and block additions if your site uses heavily customized forms.
This connects to WordPress 7.1: What’s New (And What to Test Before You Update). Want help planning your WordPress 7.2 update testing? Get in touch.
Frequently Asked Questions
When exactly does WordPress 7.2 release?
December 9, 2026 is the currently scheduled release date, with Beta 1 arriving October 20–22, 2026.
Will all the features listed here definitely ship in the final release?
Not guaranteed — being on the current roadmap list doesn’t ensure final inclusion; scope commonly narrows between beta and stable release as issues surface in testing.
Should I wait to update until well after December 9?
For most sites, a short wait (days to a couple of weeks) after a major release to let early adopters surface compatibility issues is a reasonable, low-risk approach, rather than updating on release day or waiting indefinitely.
Featured image: original illustration.