Six months earlier than usual, work has begun on Twenty Twenty-Seven, a theme expected to be one of the most polished yet, launching alongside WordPress 7.2.

Remember that you can listen to this program from Pocket Casts, Spotify, and Apple Podcasts or subscribe to the feed directly.

Program transcript

Hello, I’m Alicia Ireland, and you’re listening to WPpodcast, bringing the weekly news from the WordPress Community.

In this episode, you’ll find the information from March 9 to 15, 2026.

It was an intense week for WordPress releases. On Tuesday, March 10, WordPress 6.9.2 was published — a security release addressing ten vulnerabilities, including XSS flaws, a vulnerability in the external library getID3, an authorization bypass, and a path traversal issue in PclZip. As a security release, immediate updating was mandatory.

Just hours after 6.9.2 went live, some sites started showing a blank screen. The problem was caused by certain themes loading templates in a non-standard way. The security team moved fast and published WordPress 6.9.3 that same day to address it. But it didn’t end there: the following day, March 11, it was discovered that not all security patches from 6.9.2 had been applied correctly, which required publishing WordPress 6.9.4 with the remaining fixes. In short, three maintenance releases in under 48 hours — unusual, but a clear example of how WordPress’s security...

Kicking Off Twenty Twenty-Seven