WordPress 7.2: 7 Essential Features Coming December 2026

WordPress 7.2 is scheduled for release on December 8, 2026, and it changes how plugins store sensitive data, how the default theme looks, and how far block styling can go without custom CSS. The headline addition is the Secrets API, which gives developers encrypted, rotatable storage for API keys instead of plain-text database options. Alongside it ships a new default theme called Ipsum, native text shadow controls, and a reworked Notes experience. Here is what actually changed, what got pushed to the next release, and what site owners and developers should do before it ships.

When Is WordPress 7.2 Coming Out?

The release is targeting a final build on December 8, 2026, timed to land around the annual State of the Word event. Beta 1 already shipped in late October 2026 with the Secrets API and the first round of Notes changes bundled in. A second beta round, including Beta 5, is expected around November 10, with Release Candidate 1 planned for roughly November 17. That leaves a few weeks of release-candidate testing before the final build goes out to every self-hosted site running automatic core updates.

• Beta 1: late October 2026 — Secrets API and initial Notes rework ship for testing.
• Beta 5: targeted for November 10, 2026.
• Release Candidate 1: targeted for November 17, 2026.
• Final release: targeted for December 8, 2026.

Dates on a release-candidate schedule can still slip by a few days if a regression turns up during testing, so treat December 8 as a target rather than a guarantee until the core team confirms it in the RC1 announcement. Major WordPress releases have shifted by a week or two before, most recently with parts of 7.1, so a short delay here would not be unusual. The official roadmap to 7.2, published by the WordPress core team, is the authoritative place to check if any of these target dates move.

What Is the Secrets API in WordPress 7.2?

The Secrets API is the biggest developer-facing change in this release. It gives plugins a standard way to store credentials, such as third-party API keys and access tokens, in encrypted form instead of as plain text inside the wp_options table. Today, most plugins that need an API key simply save it in an option, which means anyone with database access, or access to a misconfigured backup, can read it directly in a text editor.

With the new wp_set_secret() and wp_get_secret() functions, a plugin can store a value that gets encrypted at rest and stays out of debug logs and error output unless the code explicitly asks to reveal it. The API also supports rotating a stored value, so a plugin can issue a new key without leaving the old one readable in version history, server logs, or cached requests. The storage layer is pluggable, meaning hosts can swap in their own platform-level secret manager instead of relying purely on the built-in WordPress encryption.

What is not landing this time is a dedicated admin settings screen for managing these values visually; that is scoped for the following release, 7.3. For now, secrets are managed through code and WP-CLI commands, which means the first wave of adoption will come from plugin developers rather than site owners clicking through wp-admin. A developer building an SMTP, payment, or AI-integration plugin is the most likely early adopter, since those plugin categories hold the most sensitive credentials today. The feature plugin that core development is based on is open source and tracks the proposal’s progress on GitHub at ericmann/secrets-api, which is also the fastest way to see the exact function signatures before the final merge to core.

A typical migration looks like this: on plugin activation or update, check whether wp_set_secret() exists; if it does, read the legacy option, write it into the new encrypted store under a namespaced key, delete the plaintext copy, and fall back to the old storage path only on versions where the function is unavailable. That fallback matters because plugins need to keep working on sites still running older WordPress versions for years after this release ships, so the encrypted path should be an enhancement layered on top of existing storage rather than a hard requirement.

Why Does Encrypted Secret Storage Matter for Site Security?

Plain-text credentials stored in the options table have been a recurring source of real-world breaches. A SQL injection vulnerability, an exposed staging backup, or a misconfigured phpMyAdmin instance can hand an attacker every API key a site’s plugins hold, often without the site owner ever noticing the exposure. Storing those same values through an encrypted, pluggable layer does not make a site unbreachable, but it does raise the cost of a breach: a stolen database dump alone is no longer enough to recover usable credentials.

This also brings WordPress closer to how modern hosting platforms and SaaS products already handle secrets, where credentials live in a dedicated vault rather than beside ordinary application settings. For agencies managing many client sites, it is worth asking plugin vendors directly whether they plan to adopt the new storage layer, since migration timing will vary plugin by plugin even after the core feature ships.

There is also a compliance angle that agencies and enterprise site owners should not skip. Businesses handling payment data, health information, or EU customer data under GDPR already have to document how credentials are stored and who can access them. Encrypted, rotatable secret storage gives those teams a cleaner answer during a security questionnaire or audit than “the API key sits in a database table alongside everything else,” and it reduces the blast radius if a single plugin’s stored value ever does leak.

What Does the New Ipsum Default Theme Add?

This release ships with a new default block theme called Ipsum, continuing the tradition of a fresh default theme with each major annual release. Early beta coverage describes Ipsum as leaning on more responsive gallery layouts and newer styling controls, rather than introducing a dramatically different visual identity from recent default themes. It is built entirely as a block theme, so every template part is editable through the Site Editor without touching PHP template files.

Installing the update does not switch your site to Ipsum automatically. Your active theme stays active after the update; Ipsum simply becomes available in Appearance → Themes for anyone who wants to try it, the same way Twenty Twenty-Five and earlier default themes arrived without forcing a theme change. If you maintain a custom theme, it is worth checking that your template parts still override the new default correctly, particularly if your theme relies on fallback template hierarchy behavior.

How Do Text Shadows Work in the Updated Block Editor?

Native text shadow controls arrive for heading and paragraph blocks, so editors can add a drop shadow or glow effect directly from the block settings sidebar without writing custom CSS. This sits alongside a broader push for more responsive typography and styling controls that theme authors can expose through theme.json, giving block themes finer control over how text renders across breakpoints and screen sizes.

For most sites this is a cosmetic addition rather than a workflow change: existing content keeps rendering exactly as before, and the new shadow option simply appears as an extra toggle the next time someone edits a heading or paragraph block in the editor. Beta testers have also reported small refinements to form-field styling and an “On This Day” widget for sites that want to surface older posts automatically, though neither is as significant as the typography work.

What’s Changing in the Notes Feature?

Notes, the commenting layer that lets editorial teams leave feedback directly on post content, gets its first substantial rework since launch. Beta coverage describes an improved visual presentation and workflow for leaving and reading comments inside the block editor, building on the feature introduced in earlier 7.x releases. The goal is to make editorial back-and-forth feel closer to leaving a comment directly on a paragraph, rather than managing a separate feedback thread elsewhere.

Two related features did not make the cut this time. Suggestion Mode, which would let a reviewer propose text edits inline the way Google Docs handles tracked changes, has been pushed to the following release. A “sudo mode” re-authentication step for sensitive admin actions was also deferred. If you were planning your editorial workflow around inline suggestions, this is not the version that delivers it; plan around the current comment-style Notes for now and revisit the feature once 7.3 lands.

How Does WordPress 7.2 Compare to 7.0 and 7.1?

Each 2026 release has focused on a different layer of the platform. The table below lines up the flagship changes in 7.0, 7.1, and the upcoming release so you can see where it fits into the year’s broader roadmap.

Read our full breakdowns of what shipped in WordPress 7.1’s new features and the breaking changes that followed it if you skipped straight from 7.0 and want the full picture of what changed along the way. The Abilities API introduced in 7.0 is also worth revisiting, since the new secret-storage layer is built to work alongside it for plugins that expose programmatic actions to other software and AI agents.

How Should Plugin Developers Prepare?

If your plugin stores API keys, access tokens, or OAuth credentials in a plain options field, this is the right moment to plan a migration to wp_set_secret(). Install the official feature plugin against a staging copy of the beta or RC build, confirm your existing stored values still read correctly, and add a one-time migration routine that moves legacy plaintext values into encrypted storage the next time your plugin updates.

• Audit every option and user-meta key your plugin writes, and flag any that hold a credential, token, or password.
• Test against a beta or RC build on staging, not production, before your plugin’s next stable release.
• Write a migration routine that moves legacy plaintext values into the new encrypted storage automatically.
• Check your error logging and debugging code to make sure it never prints a secret value directly.
• Review the official changelog for deprecated functions and changes to how 404 and 410 responses are routed.

It is also worth testing any code that reads 404 or 410 responses, since this release touches how expired or permanently removed content is handled at the routing layer. Run your plugin’s test suite against a beta build, check the changelog for deprecated functions, and confirm compatibility before your next stable release goes out, rather than waiting for support tickets after users update their sites.

Should You Update Right Away?

For most production sites, the safer path is to wait for the first point release, typically 7.2.1, rather than updating on launch day. Major releases occasionally ship with a regression that gets patched within a week or two, and a short delay costs you nothing since none of the new features require immediate adoption to keep a site running normally.

Before updating any production site, take a full backup, and run a plugin security audit so you know exactly which plugins are active and current. Test the update on a staging copy first, paying particular attention to any plugin that handles API keys or payment credentials, since those are the ones most likely to adopt the new secret-storage layer in a future update. If your site relies on a caching plugin, clear and rebuild the cache after updating core, since a new default theme and updated block markup can occasionally leave stale cached fragments behind.

Agencies managing several client sites should stagger the rollout: update one lower-traffic site first, watch it for a few days, and only then schedule the rest. That staggered approach has caught more than one regression before it reached a client’s main storefront or lead-generation site in past release cycles.

What Comes Next in WordPress 7.3?

Several features that got discussed for this cycle are already pencilled in for the next one, in early-to-mid 2027. A visual admin settings screen for the Secrets API tops that list, since the current release only exposes the feature through code and WP-CLI. Suggestion Mode for Notes and the sudo-mode re-authentication step are the other two carryovers, and both were far enough along in discussion that they are likely to ship rather than slip further.

None of that changes what you should do now: adopt what has actually shipped, keep an eye on the official roadmap for scope changes, and treat anything still “proposed” as not guaranteed until it appears in an actual beta build. The core team’s own roadmap posts are explicit that discussed work does not necessarily make it into the named release, which is exactly what happened to Suggestion Mode here.

Frequently Asked Questions About WordPress 7.2

When is the official WordPress 7.2 release date?

The final release is targeting December 8, 2026, following release-candidate testing expected to begin around November 17, 2026. The exact date can still shift by a few days if testing surfaces a blocking bug before the deadline.

What happened to Suggestion Mode in WordPress 7.2?

Suggestion Mode, the planned inline text-editing feature for Notes, was removed from scope during beta development and pushed to the following release, 7.3. It will not be part of the December 2026 build, so editorial teams should keep using the existing Notes workflow for now.

Does my plugin have to use the new Secrets API?

No. Adoption is optional. Existing plugins that store credentials in regular options will keep working exactly as before; switching to wp_set_secret() is a developer choice made to improve security, not something forced on every plugin by the update itself.

Will the Ipsum theme replace my site’s current theme?

No. Updating adds Ipsum to your list of installed themes under Appearance → Themes, but it does not activate it automatically. Your current active theme stays in place until you manually switch themes yourself.

Is it safe to install WordPress 7.2 on a live production site?

It is generally safer to wait for the first point release and to test on staging first. Back up your site, confirm your active plugins and theme are compatible, and update core only after a successful staging test rather than applying it directly to a live site on release day.

Where can I test the new version before the final release?

Install the official WordPress Beta Tester plugin on a staging or local environment and switch it to the beta or RC channel. This lets you run pre-release builds safely without affecting your live site, and it is the same process used to test every major WordPress release.

What happens if a plugin never adopts the Secrets API?

Nothing breaks. A plugin that keeps storing credentials in a regular option will continue to function exactly as it does today; nothing in this release forces a change on plugins that skip the new storage layer. The risk is purely the ongoing security exposure of plain-text storage, not a compatibility problem with the update itself.

The Bottom Line on WordPress 7.2

WordPress 7.2 is a developer-focused release wrapped around a handful of visible editorial changes. The Secrets API matters most for plugin security over the long run, the Ipsum theme and text shadow controls are welcome but optional additions, and the reworked Notes experience improves editorial review without yet delivering the inline-suggestion workflow many teams are waiting for. Mark December 8, 2026 on your calendar, test on staging first, and prioritize migrating any plugin that stores API keys in plain text once the new storage layer lands.