WordPress 7.0 ships May 20, 2026. The release brings three new core layers — the Abilities API, the WP AI Client (php-ai-client), and the Connectors API — that, together, turn every plugin on every WordPress site into a discoverable, callable interface for AI agents. Combined with the WooCommerce MCP that shipped in 10.3 and the agentic_commerce gateway in 10.7, the agent-readable storefront is now native infrastructure.

Every plugin you run just got a public API for AI agents. You did not approve a single one of them individually.

The Three Layers Shipping in 7.0

The Make WordPress Core release party confirmed May 20, 2026 as the final release date on April 22, 2026. RC1 went into Release Candidate phase on March 19, then was unprecedentedly returned to beta on March 31 to fix the Real-Time Collaboration data architecture (Gutenberg Times, 2026). Real-Time Collaboration has consumed almost all of the 7.0 commentary. The three AI infrastructure layers landing alongside it have not.

The release ships:

• The Abilities API. A WordPress core API that lets plugins register the capabilities they expose. AI agents — and the command palette, and any other UI built against the API — discover what a plugin can do without scraping the admin interface. The WooCommerce Developer Blog calls it “the foundational interaction layer underneath the WooCommerce MCP” (WooCommerce, 2025).
• The WP AI Client. A shared PHP library — package name php-ai-client — that provides a single abstraction layer for talking to AI providers. Plugin developers write against the shared interface; provider switching becomes a configuration change. Per WordPress Developer News, provider packages for OpenAI, Google, and Anthropic are already in the Plugin Directory and ready for the May 20 release.
• The Connectors API. The credential and provider-selection layer. AI service authentication becomes platform-level infrastructure rather than per-plugin configuration. Once a store admin authorises an AI provider through the Connectors API, every plugin that uses the WP AI Client inherits the connection.

WordPress 7.0 also raises the minimum PHP version to 7.2.24, with PHP 8.3+ recommended for best performance (InMotion Hosting, 2026). Most stores will be fine; the few still on PHP 7.0–7.2.23 are blocked from the upgrade entirely.

How the Three Layers Compose

The composition is the part the release notes do not draw out. Here is what an AI agent does on a WooCommerce store running WordPress 7.0:

The agent connects to the site through an MCP-compatible interface — the WooCommerce MCP for commerce actions, or any of the broader WordPress MCP integrations under development. It calls the Abilities API to discover what is registered. The API returns a list: WooCommerce ships abilities for product search, order lookup, and order creation; the SEO plugin ships abilities for content recommendations; the inventory plugin ships abilities for stock updates; the booking plugin ships abilities for slot availability; and so on for every plugin that has registered.

The agent then invokes the abilities it needs — directly, server-side, with no page rendered. The WP AI Client routes any AI-provider calls (e.g. “summarise this customer’s order history”) through the Connectors-API-managed credentials. Per the WooCommerce roadmap, the initial MCP already covers product and order management — search, add, update products; create and manage orders. The agent never loads a page. The browser is not in the conversation.

You may be interested in: WooCommerce 10.3 Shipped the MCP — and Now Your Tracking Pixels Are Counting AI Agents as Human Buyers

Why GA4, Meta CAPI, and Bot Filters Will Not See It

Three blind spots open simultaneously on May 20:

GA4 sees nothing. GA4’s data layer is a browser-side measurement protocol with a server-side fallback bolted on. Every standard event — page_view, view_item, add_to_cart, begin_checkout, purchase — is tied to a session keyed on a browser. Ability invocations do not generate a session. The agent never set a _ga cookie, never loaded gtag, never acquired a client_id. Whatever the agent does on your store does not enter your GA4 property unless you build a server-side path explicitly for it.

Meta CAPI’s dedupe model has nothing to dedupe against. The same gap that opened with the WooCommerce 10.7 agentic_commerce gateway opens here. Ability invocations are server-only events. The browser pixel is absent. Meta receives orphan CAPI events with no event_id pair, or no events at all if the CAPI plugin only fires on thank-you page render.

Bot filtering is keyed on the wrong signal. Standard WooCommerce bot filtering (Cloudflare rules, Wordfence, security plugins) classifies traffic on user-agent strings and request fingerprints. AI Client invocations come from authenticated server connections that look like API traffic — because they are. They are not crawling, they are calling. The existing rules do not distinguish a registered AI provider from any other authenticated server-to-server request.

The cumulative effect: any agent activity on your store from May 20 onwards is invisible to every measurement layer most stores rely on.

The Pre-May 20 Audit

You have less than two weeks. The audit is a one-evening project on most stores:

• List every active plugin. Group by vendor — first-party WooCommerce extensions, your SEO suite, security, backups, third-party integrations.
• Check which ones plan to register Abilities. Many large plugin authors have already declared intent in their changelogs and beta channels. The plugins that have not declared yet will follow within a release or two of 7.0.
• Identify the credential surface. Which plugins currently store API keys for AI providers (OpenAI, Anthropic, Google) inside their own settings? Those will migrate to the Connectors API. The migration may invalidate or duplicate stored credentials.
• Stage the upgrade. Run WordPress 7.0 in staging before pushing to production. RC1 returning to beta on March 31 is the warning signal: this is a structurally large release, and the AI infrastructure layers have not had a full release-candidate cycle.
• Document who decided what. The Connectors API will give a single admin user the power to authorise AI providers for the entire site. Make sure your team has agreed who that user is and which providers are authorised.

The Post-May 20 Logging Requirement

After upgrade, the operational gap is logging. WordPress core does not ship a default invocation log for the Abilities API. If you do not instrument it, you have no record of which agent called which ability when.

The minimum useful log captures, per Ability invocation: timestamp, calling client identifier (from the Connectors API authentication context), ability namespace and method, input parameters (with PII redaction), output size or status, response time, and the provider routing path through the WP AI Client. The same record is what your warehouse needs for downstream analytics — agent traffic classification, ROAS attribution to agent-influenced segments, capacity planning, and security incident review.

The 6.8 precedent matters here. The previous time WordPress shipped a default behaviour change that altered what counted as a visit, the Speculative Loading API caused tracking pixels to fire on pages users never opened. The 7.0 Abilities API expands that pattern by an order of magnitude — not pixels firing on pages users did not visit, but plugins running actions for users who never connected to the site at all.

You may be interested in: WordPress 6.8 Ships Speculative Loading by Default — Your Meta Pixel and GA4 Are Now Firing on Pages Users Never Visit

The Architectural Fit

A plugin-only logging solution cannot see WP AI Client traffic for the same reason GA4 cannot — it is server-side, it bypasses the browser, and a plugin that hooks into wp_footer or any page-render action is in the wrong layer. The architecture WordPress 7.0 rewards is one that sits between WooCommerce events and the destinations they fan out to, captures both browser-originated and Ability-originated events, and routes both to the warehouse and the ad platforms with consistent classification.

Transmute Engine™ is a first-party Node.js server that runs on your subdomain (e.g., data.yourstore.com). The inPIPE WordPress plugin captures both standard WooCommerce hooks and Ability-API invocations, batches them, and sends them to the Transmute Engine server, which formats per destination — GA4 Measurement Protocol, Meta CAPI, Google Ads enhanced conversions, BigQuery — and tags every event with its origin (browser, agent_ability, agent_checkout). Agent traffic becomes a queryable dimension rather than an invisible class.

Key Takeaways

• May 20, 2026: WordPress 7.0 ships with the Abilities API, the WP AI Client (php-ai-client), and the Connectors API.
• Every plugin becomes an agent-readable surface. Plugins register their capabilities; AI agents discover and invoke them server-side.
• Provider packages already exist. OpenAI, Google, and Anthropic provider plugins are in the WordPress Plugin Directory ready for the release.
• GA4, Meta CAPI, and bot filters miss this traffic by default. Browser-keyed measurement does not see server-only invocations.
• RC1 returned to beta on March 31, 2026. Stage the upgrade; do not push 7.0 directly to production on May 20.
• Operational requirement: server-side logging of Ability invocations distinct from browser sessions, routed to a warehouse where agent traffic is a queryable dimension.

Frequently Asked Questions

Run the plugin audit this week, stage the upgrade, then plan the agent-traffic logging layer. Start at seresa.io.