PhotoFetch brings WordPress Photos to your site

The WordPress Photos team has created PhotoFetch, a plugin that makes it quick and easy to search for royalty-free photos and add them to your website. Remember that you can listen this program from:     ## Program transcript Hello, I’m Alicia Ireland, and you’re listening to WPpodcast, bringing the weekly news from the WordPress Community. In this episode, you’ll find the **information from October 19 to 25, 2026**. **WordPress 7.2** is now in testing: Beta 1 came out on October 20 and, as always, it is for testing environments only, never for production sites. The planned release date is December 8, which is the one in the announcement and in the release party schedule. The Test team’s testing guide says the 9th, a discrepancy to keep in mind. It is the last major version of 2026 and arrives with the new default theme, Ipsum. For people who edit content, the most visible change is a batch of editor improvements. The responsive styling introduced in 7.1 is expanded, especially in the Gallery, where you’ll be able to set columns, cropping, and image aspect ratio per screen type. Global Styles gets a “Custom” filter to show only blocks with modified styles, and, back after being postponed in 7.1, inherited values are shown in the block inspector controls. Text shadows with their own controls are added, along with styling of form elements without touching code. Notes gain emoji reactions, their own icon in the toolbar, and a minimized mode, and they move to the canvas margin so they can stay open alongside the block settings bar. There is also navigation link management from the Site Editor sidebar, clearer error messages, and a post inspector rebuilt with the DataForm system. In media and administration there are several useful changes. Client-side image processing comes to the Media Library, and it finally fixes a limitation from twelve years ago: animated GIF and WebP thumbnails keep their animation. The media inserter is redesigned for very large libraries, and crops are linked to their original image, so the library doesn’t fill up with loose duplicates. The dashboard debuts the “On This Day” widget, switches the admin bar and menu Dashicons to SVG icons, and adds an option to disable metabox reordering, aimed at touchscreen devices. For anyone working in hosting, a performance change deserves attention: WordPress stops combining scripts and stylesheets into large files, loads them separately to make better use of browser caching, and preloads the admin screen most likely to be visited next. For developers, the big news is the *Secrets API*, a standard way to store API keys and tokens with encryption, credential rotation, and customizable storage providers, with WP-CLI support and checks in Site Health, based on the proposal from recent weeks. Random content redirects also arrive, along with new capabilities in the *Abilities API*, the `data-wp-html` directive of the *Interactivity API*, and further hardening of the HTML API. The Test team is asking for help with a detailed guide that explains what to test in each feature. Anyone who finds bugs can report them on the forums, in Trac, or in the Gutenberg repository, including WordPress and PHP versions, theme, plugins, and steps to reproduce. The technology behind **WordPress Playground** now runs another content management system in the browser. Herman Peeren, a Joomla contributor, has created Joomla Playground, a community project still in an early stage that opens Joomla in a tab, with its admin area and public site, and no local PHP server or database. It relies on two pieces of the WordPress ecosystem: the `wasm` packages, which run PHP as WebAssembly in the browser, and `mysql-on-sqlite`, the library that lets MySQL queries run against SQLite, to which he has connected a custom Joomla adapter. It works in Chromium-based browsers, documents Joomla 6.2 and 5.4 with PHP 8.3 to 8.5, and allows saving the site in the browser, importing and exporting ZIP files, and inspecting email without sending it. What’s interesting for the WordPress side is what Joomla contributes back, because its use exposes cases WordPress alone doesn’t exercise. In SQL compatibility, for example, session identifiers stored as binary values didn’t match the text comparisons Joomla uses and broke login, a case that could become a regression test for the shared library. Saving thousands of loose files in browser storage was slow, so Peeren moved to a shared base ZIP plus a snapshot of the modified files, relying on the Playground filesystem’s change log. By his measurements, saving dropped from 13 seconds to about 0.3. And because a single PHP process was shared, a dropped network connection blocked subsequent requests for minutes, and background search indexing jumped ahead of navigation. Enabling networking through the browser’s `fetch` and chunking the indexing so it yields its turn roughly halved the time until the demo was usable. The **WordPress Contributor Toolkit**, the desktop app for contributing to Core and Gutenberg, reaches version 2.0 with a redesigned interface and translated into ten languages. The Core and Gutenberg workflows we saw in the previous version remain the same. The entire window is built on the WordPress design system, so buttons, notices, and dialogs will be familiar to anyone who uses the block editor, and the site list now shows each site’s server status. There is also a settings dialog with three groups (general, sites, and account), with light, dark, system, or custom themes built from a background and a primary color, and options such as each site’s PHP version or whether whatever was running when you closed the app starts again. The other major change is language. All interface strings are translatable on translate.wordpress.org, and 2.0 includes Czech, Dutch, English (Canada) and English (UK), Galician, Hungarian, Lao, Polish, Serbian, and Turkish. A language enters the app once it’s at least 80% translated, so the list will grow with each release, and the team itself proposes translating it as a first contribution. By default the app follows the operating system’s language. There are also improvements aimed at everyday Contributor Day use. After applying a patch or pull request, site details show the changed files as a tree, separating those from the patch and your own, with a button to revert just one without losing what you’re testing. Data read from Trac, such as summary, status, or component, is kept when you close and reopen the app, with a button to refresh it. And the installation is about 350 MB lighter, which matters when everyone downloads at once on the same network. Emre Erkan, Locale Manager for the Turkish team, has measured how many people with management roles in Polyglots are still active, and the result is rather discouraging. He reviewed the public profiles of the 870 people who are Locale Managers or General Translation Editors across the 203 locales. Only 31% have translated something in the last 90 days, 15% did so between three months and a year ago, 36% more than a year ago, and 17% have no recorded activity since mid-2022. Broken down by locale, in 95 of them, nearly half, no manager or general editor has been active in the last quarter, and in 74 not even in the last year. It matters because they are the ones who open the door for others: without them no one grants the project translation editor role, and those who wait eventually leave quietly. The manual’s inactive-locale process only triggers when a translation is two major versions behind, so a locale can look up to date thanks to two or three people while nearly all of its managers have been gone for years. In the comments, Emre added a second analysis of editor requests published since 2022: 4,601 entries and 6,640 requests per locale. Half were answered by a manager or editor from the same locale, with a median of nine hours, but 39% never received a reply from their team, and in 1,901 of those cases the only person who handled it was Tor-Björn Fjellner. The most striking part is the pace: between January and October 2026 there were already 2,821 requests, 2.4 times the total for all of 2025, which ties into the wave of machine translations we’ve covered. Tobi confirms it: most locales depend on one or two active editors, and the pressure from developers who send thousands of strings to languages they don’t speak is wearing people out. It’s also noted that project editors go inactive because they only work on the project that interests them and get no notifications afterward, and that imports marked as “current” aren’t recorded in profiles, so the figures skew toward inactivity. On solutions there is broad agreement. An honorary or emeritus status has been proposed for some time, partly for security reasons, since it’s worth limiting the permissions of those who no longer contribute, especially without two-factor authentication, and partly so newcomers feel needed. **WordPress Credits**, the program that connects students from partner institutions with real project contribution work, opens sponsorship tiers for 2027. It started with eight institutions, and in its first year it has worked in 17 countries and reached more than 900 students, figures you can follow on the program’s public dashboard. That growth is the reason for the change: curriculum, translation, tools, and onboarding of new institutions need stable funding, and the current sponsorship system wasn’t designed for that. It will be a pilot, and the team promises to publish what it learns and retire what doesn’t work. Current sponsors have funded mentors and contributed products that students use, and the tiers are built on what they made possible. There are five tiers: Friend, in kind through Five for the Future, for companies that already sponsor mentors; Supporter, at $5,000 a year; Backer, at $10,000; Champion, at $15,000; and Partner, from $30,000. All appear on the partners page and are mentioned in the mentor feature. From Supporter up you get a logo, a badge for your own website, and an annual report. From Backer, you can name the specific part of the program being funded, with a report on that cost and an educational article about the sponsored product. Champion adds another article with factual, neutral information about more products, an invitation to the annual educational partners session, and a joint webinar or event. The company writes the articles, but they are published on *wordpresseducation.org* after team review, so that what gets published is useful to students first. Apart from the tiers, any sponsor can donate free access to their products, which the Foundation distributes, with no card required and with a way to export the work so no one is locked in. The tier the team most wants people to look at is Partner, which funds a complete, named program. The team hasn’t been able to build one until now because they were limited to the available budget. The sponsor would be the exclusive partner of that program, would appear at its launch, and would receive a dedicated report. The team prefers to design it together with the sponsor rather than offer a closed list. Among the ideas: students translating WordPress into under-covered languages, working on accessibility, or building websites for nonprofits that couldn’t otherwise commission them. A program manager will contact each current sponsor to adjust their tier. Campus Connect events are outside these tiers. There’s already a plugin to use the **Photos** directory without leaving the dashboard. It’s called PhotoFetch, is published in the WordPress.org plugin directory, and lets you search for photos and import them directly into the Media Library. It has its own screen under the Media Library menu for searching and importing, but it also integrates into the editor’s media picker, as a tab next to the Library tab. The Photos directory gathers images contributed by the public under the CC0 license, that is, free of rights, so the plugin saves you the step of downloading a photo and re-uploading it by hand. The interesting part is where it came from. A seven-person team built it during the Contributor Day at WordCamp US 2026. Starting from the idea and the research to assess its feasibility, the rest of the day went to features, documentation, and testing. It’s a good example of what a well-used contribution day can deliver. The **BuddyPress** team has published the security releases 14.5.3, 12.7.3, and 11.6.3, with patches for the three branches still receiving support. The following day a 14.5.4 also arrived, but don’t be confused: according to the notes for that version, it doesn’t bring new fixes. It’s just a version-number change added to the main branch so sites can update. All the fixes are in 14.5.3, and since the database version doesn’t change, there’s no migration to run. The six fixed bugs are significant. There are two SQL injections, one blind in profile field management and another from an unbound argument. It also blocks an abuse of the `maybe_unserialize` function, and prevents users without administrator permissions from assigning themselves member types. The other two have to do with groups: you can no longer comment on activity from groups you aren’t a member of, and the REST API stops revealing details of hidden groups. And finally, this podcast is distributed under a Creative Commons license as a derivative version of the podcast in Spanish; you can find all the links for more information, and the podcast in other languages, at WPpodcast .org. Thanks for listening, and until the next episode!