SteemEverything you need to know about WordPress and AI in 2026
· 6 min read
Everything you need to know about WordPress and AI in 2026 is this: WordPress is no longer just a CMS you use. It is becoming the operating system for the agentic web.
After years of bolt-on AI plugins, the core went AI-native with WordPress 7.0 “Armstrong” in May 2026. The aim was never to box in ChatGPT. It was to provide the plumbing that lets any AI work securely with any WordPress site.
Here is the complete stack, and what it changes for anyone who builds plugins.
The prompt
Loads into the composer so you can edit it first. Nothing is built, and nothing is charged, until you send it.
Build a WordPress plugin that registers a custom ability with wp_register_ability() so AI agents can call it over MCP. The ability should be named acme/recent-posts, return the ten most recent published posts with their titles, URLs and publish dates, declare an input schema with an optional category filter, gate execution behind a read capability check in its permission callback, and set meta.public to true so the MCP Adapter exposes it automatically. Include a short readme explaining how to point Claude Desktop at the site's MCP endpoint.
The four AI building blocks
WordPress.org launched the AI Building Blocks initiative to stop every plugin inventing its own integration. Master four concepts and the rest of the stack follows.
1. The PHP AI Client
This layer sits between WordPress and any LLM, so plugins no longer have to work around the differences between providers. You configure a provider once, and developers call a single function: wp_ai_client_prompt().
It speaks to Claude, ChatGPT, Gemini and others through one API, with methods like using_temperature and using_max_tokens. The plugin never handles the API key itself; WordPress stores it centrally.
2. The Abilities API
Introduced experimentally in WordPress 6.9 and part of core in 7.0, the Abilities API turns a pile of disconnected functions into one discoverable system. Developers call wp_register_ability() to declare what their plugin, theme or core can do.
A registration names the ability, gives it a label and a description, declares an input schema describing the data it expects, supplies an execute callback that runs when it is invoked, and a permission callback that decides whether the current user is allowed to invoke it at all. Metadata marks whether it should be public.
That permission callback is the part worth pausing on. It is the same capability check you would write for any admin action, and it is what stands between a registered ability and anyone who can reach the endpoint.
Once registered, an ability is available to the editor, to JavaScript through @wordpress/abilities, to REST, and to AI agents. It is the contract an AI uses to understand your site.
3. The MCP Adapter
This is where it gets powerful. The MCP Adapter translates WordPress abilities into a Model Context Protocol server, exposing them as tools and resources.
MCP, an open standard introduced in late 2025, lets assistants such as Claude Desktop, ChatGPT and Cursor securely understand a site's context. The official WordPress/mcp-adapter package is the bridge.
It needs WordPress 6.9 or higher and works over HTTP or STDIO, with a default endpoint at /wp-json/mcp/mcp-adapter-default-server. Any ability marked meta.public: true is exposed automatically, discoverable through mcp-adapter/discover-abilities and callable via mcp-adapter/execute-ability.
4. The AI Experiments plugin
WordPress's AI laboratory, and a canonical plugin: new features land here before they reach core. Version 0.7.0, released in April 2026, shipped the parts people actually use today.
What WordPress 7.0 Armstrong actually shipped
WordPress 7.0 is a shift in kind rather than degree. Named for Louis Armstrong, it moves the platform from a traditional CMS towards something personalised and AI-driven, with the infrastructure in core rather than bolted on top.
Two things to check before you upgrade
7.0 raises the baseline to PHP 7.4 and MySQL 8.0 or higher, which is the sort of requirement that turns a routine update into a hosting conversation.
There is also a security note worth acting on. As of 7.0, API keys entered through the UI are stored as plaintext. On anything that matters, put them in environment variables in wp-config.php instead, and keep them there until the encryption patch ships. A database backup is a very ordinary thing to lose control of, and a plaintext provider key in one is an expensive afternoon.
Why MCP is the part that matters
Before MCP, every AI plugin built its own custom integration. Now there is one protocol.
On 20 March 2026, Automattic announced that WordPress.com sites support full write capabilities for AI agents. Site owners can connect Claude, ChatGPT or Cursor directly to a site and hand it admin and editorial work.
That turns AI from a passive assistant into something that can actually touch the site. In practice it means asking for a 500-word draft about the spring collection filed under Announcements, or a scan for images missing alt text with suggestions for each, or a review of pending comments flagging anything that mentions refunds.
The safeguards, and why they are the interesting part
An agent with write access to a live site is a genuinely different risk from an agent that suggests text, and the guardrails are what make it usable rather than alarming.
The WordPress.com AI Assistant
Separate from MCP, WordPress.com launched a built-in assistant in February 2026. It sits inside the site, reads its content and layout, and takes instructions in plain language: “make this section feel more spacious”, or “add a testimonials section below this one”, with the change appearing immediately. It works with block themes only.
It also brings content rewriting, translation and headline suggestions; @ai in the Block Notes editor, pulling AI into collaboration comments; and a Generate Image button in the Media Library. It is opt-in under Settings › AI tools.
What this changes for plugin development
Read the four building blocks together and a pattern falls out. The Abilities API means the useful unit is no longer a page of settings but a declared capability, with a schema and a permission check. The MCP Adapter means anything declared that way is immediately reachable by an agent the site owner already uses.
Which makes the small, specific plugin more valuable than it has been in years. A single ability that exposes the one thing your business does — check stock, look up a booking, file a support note — is now a thing Claude or ChatGPT can call on your behalf. That is a much smaller piece of work than a settings page, and considerably more useful.
It is also the sort of plugin nobody was going to install from a directory, because it only makes sense for one site. Which is exactly the kind you now have to write yourself.
Questions
- Do I need WordPress 7.0 to use the Abilities API?
- The Abilities API arrived experimentally in 6.9 and became part of core in 7.0. The MCP Adapter needs 6.9 or higher. If you are on 6.9 you can start registering abilities and exposing them over MCP today; 7.0 is what makes the rest of the AI infrastructure available alongside them.
- Is it safe to let an AI agent write to my WordPress site?
- It depends entirely on the permission callbacks. An ability is exposed with whatever capability check you gave it, so the honest answer is that an agent is exactly as dangerous as the weakest ability you registered. WordPress.com's own implementation keeps a human approving each step, starts content as drafts and logs every action, which is a reasonable model to copy.
- Are my AI provider API keys stored securely in WordPress 7.0?
- Not yet if you enter them through the UI, where they are stored as plaintext as of 7.0. Use environment variables in wp-config.php for anything that matters until the encryption patch ships.
- Does any of this replace writing plugins?
- No, it changes what a plugin is for. An ability still needs someone to define its schema, write its permission callback and implement what it actually does. What has changed is that the useful unit got much smaller, so the plugin worth writing is often a hundred lines rather than a thousand.
The prompt
Loads into the composer so you can edit it first. Nothing is built, and nothing is charged, until you send it.
Build a WordPress plugin that registers a custom ability with wp_register_ability() so AI agents can call it over MCP. The ability should be named acme/recent-posts, return the ten most recent published posts with their titles, URLs and publish dates, declare an input schema with an optional category filter, gate execution behind a read capability check in its permission callback, and set meta.public to true so the MCP Adapter exposes it automatically. Include a short readme explaining how to point Claude Desktop at the site's MCP endpoint.