29 stories
A core flaw exploited within hours of its patch, a WooCommerce plugin attacked seven months after its fix. How attackers pick WordPress sites, and how to check yours for free without installing anything.
This week in Respira: the controls that decide what an AI may do now answer only to the site owner, structure changes are one restore away, and Respira runs on top of the official WordPress MCP Adapter, which has no drafts, approvals or undo of its own.
One landing page, one prompt, one AI. Built by hand through WPVibe, by hand through Respira, and with Respira Exhale, on Elementor, Bricks, Divi, Breakdance, Beaver Builder and Gutenberg. Time, tool calls, cost, how close each page came to the file, with screenshots and links to every page.
WPVibe sells a daily allowance of tool calls and stops your AI when it runs out. Respira has no meter: you pay for site slots, and your AI does as much as the work needs. Compared on price, live edits, privacy, features and the legal small print, checked on 3 October 2026.
Grok can now read and edit your WordPress site through Respira for WordPress. On grok.com your site goes in as a custom connector with a sign-in, in Grok Build it is one command, and Respira AER runs on an xAI key. Grok Bot is submitted and waits for review.
A company's terms and privacy pages started answering "No results found". The cause was a plugin WordPress was running and wp-admin was not showing, and one rewrite rule placed ahead of the page rule.
Respira Exhale turns a finished HTML page, written by ChatGPT, Claude or a designer, into a page in your WordPress builder's own blocks, in seconds, with no AI in the middle and no tokens from your plan.
A form with an upload field was enough for anyone to drop a PHP file into your uploads folder. What the flaw needed, which version fixes it, and the folder worth opening on any site that ran 4.2.1 or below.
An attacker reached the vendor's update server and two builds went out with a web shell in them. The files, the directory and the database rows to look for, why the version number cannot clear you, and what to do if you find one.
The patched release for every WordPress branch back to 4.7, what the reported Click2Shell chain actually needs before it works, why the 9.6 in the headlines is not WordPress's own rating, and the one trace a forced theme install leaves behind.
Thirty-five critical records in twenty-one days. The plugins with real install numbers behind them, the version that fixes each one, the core release nobody should miss, and the one that no version can fix.
Jev is a new kind of AI model from TypeSafe that answers typed questions with probabilities instead of writing text. What I found testing it, the one prompting lesson worth knowing, and how Respira AER 0.3 uses it to check every change to a WordPress site.
Respira AER is live: Respira builder intelligence in a chat connected to all your WordPress sites, in your dashboard and on your phone, with duplicates, approvals and receipts.
Your Claude or ChatGPT subscription is not an API account, which is why most WordPress AI plugins cannot use it. Here is the way round that, in plain terms.
An agency owner had trustees reviewing a staging site and no good way to collect what they said. Two days later the plugin mints a signed link that opens the page with a review bar, every note lands anchored to its element, and the agent applies the notes on a duplicate.
WebMCP put the agent on the same page as you: open a WordPress site in ChatGPT's browser and it stages edits, waits for approval, and rolls back. Every staged draft now returns a login-free preview link you can send to anyone.
Anthropic measured it: humans clicking approval prompts caught 13.6% of dangerous commands, falling to 5% after fifty prompts. Auto mode, Guardian and always-on cloud agents are the industry removing a button that was not working. What safety means for a WordPress site once nobody is watching.
WordPress.com gave sites a persistent AI memory, core is building wp_knowledge, and self-hosted sites have had Resonance since 3 August. What the three share, why memory that travels with the site beats memory that belongs to one assistant, and the one thing a memory cannot do by being read.
Showing 18 of 29 stories
Load more storiesGet the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
