--- title: "Is There Still a Future for WordPress Plugin Developers in the AI Era?" url: https://nexterwp.com/blog/future-of-wordpress-plugin-developers/ date: 2026-08-17 modified: 2026-08-17 author: "Aditya Sharma" description: "WordPress plugin development is changing in the AI era. What WordPress 7.0's Abilities API changed, which plugins are at risk, and what stays valuable." image: https://nexterwp.com/wp-content/uploads/2026/07/vQvVpahG-1024x538.jpg word_count: 1821 --- # Is There Still a Future for WordPress Plugin Developers in the AI Era? ## Key Takeaways - WordPress 7.0 adds the Abilities API, which lets a plugin register capabilities in a machine-readable way with wp_register_ability() and JSON Schema. - The MCP Adapter exposes registered abilities as tools that AI agents can discover and execute. - Nexter Blocks ships more than 90 WordPress blocks, and its Nexter Abilities feature connects the block library to MCP-compatible AI clients including Claude, Cursor, VS Code, Windsurf and Cline. - Patchstack records 11,334 new WordPress vulnerabilities in 2025, and 91 percent are in plugins. - A plugin listing with real installs, review history and a support forum is an asset AI cannot generate, so distribution and support stay valuable. Ask the question in any WordPress developer space right now and you will get two confident answers, both wrong. One says AI writes plugins today, so the craft is finished. The other says WordPress is 40.8 percent of the web, so nothing changes. Neither survives contact with what actually shipped in WordPress 7.0. Something more specific is happening. WordPress core now has a documented way for a plugin to register what it can do so that an AI agent can find that capability and run it. That single change moves the ground under the question. The useful version is not *will AI replace plugin developers*. It is *which parts of this job were always the valuable parts*, and the answer is more encouraging than the panic and less comfortable than the reassurance.   Table of Contents ## The Short Answer Yes, there is a future, but it is not evenly distributed. AI has genuinely compressed one tier of plugin work: the small, well-specified, mostly boilerplate plugin that a competent developer could write in an afternoon. That tier was already commoditised by 65,765 free plugins in the WordPress directory, and AI code generation finished the job. At the same time WordPress 7.0 created new work that did not exist two years ago. The Abilities API lets a plugin declare its capabilities in a machine-readable way, and the MCP Adapter exposes those capabilities as tools AI agents can call. Someone has to design, secure and maintain that surface. That someone is a plugin developer. So the honest summary is that the floor fell out and a new ceiling appeared. If your value was typing code, that is a problem. If your value was judgment, trust and maintenance, the market for it just got larger. ## What WordPress 7.0 Actually Changed Three pieces landed, and they matter together rather than separately. ### The Abilities API The official documentation defines it as "a standardized way to register and discover distinct units of functionality within a WordPress site." It arrived in WordPress 6.9. A developer calls `wp_register_ability()`, describes the inputs and outputs with JSON Schema, and attaches a permission callback. Abilities execute "within the bounds of WordPress permissions and validation rules," so the capability is discoverable without being unguarded. ### The AI Client Make WordPress Core describes the AI Client as "a provider-agnostic PHP API that lets plugins send prompts to AI models and receive results through a consistent interface." Worth noting precisely, because it is widely misreported: core does not bundle any AI providers. As the announcement puts it, "WordPress Core does not bundle any AI providers directly. Instead, they are developed and maintained as plugins." The official Anthropic, Google and OpenAI providers are separate plugins. Credentials are handled through Settings and Connectors. ![Introducing the AI Client in WordPress 7.0 on Make WordPress Core](https://nexterwp.com/wp-content/uploads/2026/07/ZgJhaM-K0CWtdMZlAx3MpUH3x_arT1tp4Py4LfzjQZ_P5A091o7TflwI_GTaemwAKpAMNnGpOFx0KWrJzXYNkQ-scaled.png)The AI Client announcement on Make WordPress Core, which describes a provider-agnostic PHP API that plugins call. ### The MCP Adapter This is the piece that closes the loop. It exposes registered abilities as tools that AI agents can discover and execute. A plugin stops being only a thing a human clicks in wp-admin and becomes a thing an agent can call. ***Also Read:** [Where WordPress 7.0 AI Actually Helps (and Where It Wrecks Your Site)](https://nexterwp.com/blog/wordpress-7-ai/) covers the site-owner side of the same release.* ## The Kind of Plugin That Is Genuinely at Risk Being straight about this matters more than reassurance. The plugins under real pressure share a shape: - It solves one narrow problem with a few hundred lines of code. - The problem is fully specified before you start, with no ongoing judgment calls. - It has no meaningful data, integration or compatibility surface. - Its value was convenience, not expertise. A snippet plugin that adds a body class, hides an admin notice or registers one shortcode fits every line. A site owner with an AI assistant can now produce that in a couple of minutes, and increasingly will. Arguing otherwise is not useful to anyone making career decisions. What does not follow is that the same is true one layer up. The moment a plugin touches other people's data, other plugins' assumptions, or a payment flow, the cost of being wrong stops being measured in minutes. ## The New Surface: Plugins as Tools AI Agents Call WordPress is not treating AI as a threat to the plugin ecosystem. It is actively recruiting plugin developers into it. In July 2026 the official WordPress Developer Blog published a tutorial called "Build your first AI-Powered WordPress plugin," which walks through a plugin that reads an image, describes it with AI vision and drafts a post from the description. The framing in that tutorial is the important part. It describes the ability to "register a unit of functionality so that *anything* (REST, the block editor, another developer, an AI agent) can discover and run it." Write the capability once, and it is available everywhere, including to agents. A commenter on that post asked the question the whole ecosystem is now sitting inside: "the really interesting question now is what happens when thousands of plugins expose composable capabilities this way." Nobody knows yet. But the developers who find out first will be the ones who built the abilities. ***Also Read:** [What Is MCP in AI? A Plain-English Guide for WordPress Site Owners](https://nexterwp.com/blog/what-is-mcp-in-ai/) explains the protocol underneath the MCP Adapter.* ## What Stays Scarce When Code Gets Cheap If generating code is close to free, value moves to everything that is not generating code. Four things stay scarce. ### Trust and Security Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42 percent increase on 2024. Of those, 91 percent were in plugins and 9 percent in themes. WordPress core accounted for 6, all low priority. ![Patchstack State of WordPress Security whitepaper reporting 11,334 new vulnerabilities found in 2025](https://nexterwp.com/wp-content/uploads/2026/08/5ceTXJoR-xgrorzKqSYfoYN6bHdi2wzg74tL-L8Jy_gTA1bNmuuIHvnn3tN1yDf_KAfxdWosL9xbtx0P0rUIbw-scaled.png)Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91 percent of them were in plugins. Read that against the Abilities API and the stakes become clear. An ability is an action an agent can invoke, which means a badly scoped permission callback is no longer a bug that waits for a human to click something. Writing the ability is the easy half. Deciding what it must refuse to do is the half that needs a developer who has been burned before. ### Maintenance Across Other People's Breaking Changes In August 2026 a developer posted to r/ProWordPress that Gravity Forms had changed its submit control from an input to a button, and added: "I am partway through updating this on a whole bunch of sites at the moment." Nothing about that work is generatable. It requires knowing which sites you built, which ones targeted that selector, and which clients will notice. ![The WordPress Plugin Handbook page defining the readme header fields including Tested up to and Stable tag](https://nexterwp.com/wp-content/uploads/2026/08/RncmenqZiHOQ66nRmhPxOvjgofd8yKGlgiD1V5BN20Ztn4Z1-_rNRTmJXgCsvfSPkvneGoMPKCTf37KjA8m6Bg-scaled.png)The Plugin Handbook readme fields. Keeping these honest across releases is unglamorous work that users still judge you on. ### Domain Judgment The clearest recent illustration came from a developer who built a 500,000-order WooCommerce store purely to find what makes the admin slow. They found a single count query consuming 130ms of 252ms total SQL time, then traced it to WooCommerce caching that count in the object cache, which on hosting without a persistent object cache is empty on every request. The valuable part came next. They tested the obvious fix, saw SQL time halve, and noticed wall time got worse. Rather than publish, they checked their own rig and found the result was partly an artifact of Docker on Windows. Their conclusion was "so I don't know. It needs a Linux re-test before anyone should act on it." That is the skill. Not producing an answer, but recognising when a confident-looking answer is wrong. Models are fluent by default and they are fluent when they are wrong. ### Distribution and Support A plugin listing with real installs, review history and a support forum where someone answers is an asset accumulated over years. AI can write you a competing plugin. It cannot hand you the trust. ## What This Looks Like in Practice Today This is not theoretical. Nexter Blocks ships more than 90 WordPress blocks, and its Nexter Abilities feature connects the block library to MCP-compatible AI clients including Claude, Cursor, VS Code, Windsurf and Cline, so pages can be built by prompt. ![Nexter Extension security and AI abilities features page](https://nexterwp.com/wp-content/uploads/2026/07/QBalM7wAYCMSh7c8IuLj2rBDus7cLRO7BqA-qX4Q7HnXAAZUny1JfQAlT315HhRUWoMdo1fOk3GeYXGt5siSaQ-scaled.png)Nexter Abilities expose block and site actions to MCP-compatible AI clients, which is the pattern this article describes. The instructive part is not the feature list. It is the direction. The work was not "add an AI button." It was exposing what the plugin already did as capabilities an agent can call correctly and safely. The blocks were the easy part. Deciding which actions to expose, with which permissions, was the plugin development. ![Nexter Blocks plugin page on WordPress.org showing version and active installs](https://nexterwp.com/wp-content/uploads/2026/08/s354tAXxYTM85ezlbKrT0wjjJEBv4PWHRAHD7hpPDoMCaGVhXhyvPoxl7IV0MQI-c0pkNlEUX_VjGCXjoy48Gg-scaled.png)Nexter Blocks on WordPress.org. Distribution and a maintained listing are assets an AI model cannot generate for you. ## How to Position Yourself as a Plugin Developer Now Concrete moves, roughly in order of return: - **Register abilities for what your plugin already does.** Start with read-only ones. They are lower risk and they make your plugin discoverable to agents immediately. - **Treat permission callbacks as the product.** Assume every ability will be called by something with no judgment and infinite patience. Scope accordingly. - **Move up the stack, not sideways.** If your catalogue is small utility plugins, that tier is compressing. Depth in one domain beats breadth across ten. - **Compete on maintenance.** Fast compatibility updates and an honest readme are a durable moat precisely because they are boring. - **Use AI on the parts that deserve it.** Scaffolding, tests and documentation are fair game. Security boundaries and data models are not, yet. - **Keep your distribution alive.** Answer support threads. Ship on a rhythm. That record is the part nobody can generate. None of this is a hedge against AI. It is a description of where the work moved. ***Also Read:** [How to Vet a WordPress Plugin Before You Install It](https://nexterwp.com/blog/how-to-vet-a-wordpress-plugin/) shows the standard your own plugin is now judged against.* ## The Verdict WordPress runs 40.8 percent of all websites and 59.0 percent of those whose CMS is known. That install base is not disappearing, and it now has a native way for plugins to hand capabilities to AI agents. The demand for people who can build that layer responsibly is going up, not down. The plugin developers who struggle will be the ones whose value was writing code others could specify. The ones who do well will be the ones who were always doing something else: making judgment calls, absorbing other people's breaking changes, and being accountable when something goes wrong on a site that matters. AI is very good at the first job. It is nowhere near the second. ## Suggested Reading - [Where WordPress 7.0 AI Actually Helps (and Where It Wrecks Your Site)](https://nexterwp.com/blog/wordpress-7-ai/) - [WordPress 7.1 Adds Tabs, but Not a Table of Contents. Do You Still Need a Blocks Plugin?](https://nexterwp.com/blog/do-you-still-need-a-gutenberg-blocks-plugin/) - [What Is MCP in AI? A Plain-English Guide for WordPress Site Owners](https://nexterwp.com/blog/what-is-mcp-in-ai/) - [MCP vs API: What Is the Difference, and When Your WordPress Site Needs Each](https://nexterwp.com/blog/mcp-vs-api-wordpress/) - [AI Website Builders vs WordPress: Can AI Really Build Your Site?](https://nexterwp.com/blog/ai-website-builder-vs-wordpress/) - [Best WordPress Security Plugins: 6 Compared for 2026](https://nexterwp.com/blog/best-wordpress-security-plugins/) #### Stay updated with Helpful WordPress Tips, Insider Insights, and Exclusive Updates – Subscribe now to keep up with Everything Happening on WordPress! Subscribe