WordPress 7.2 ships December 8 with Secrets API, Ipsum theme and form styling

WordPress 7.2 is scheduled to ship on December 8, 2026, and Beta 1 landed on October 20, with the first release candidate due November 17. According to Matt Hummel's write-up on dev.to, the release bundles a Secrets API for storing credentials, a new default theme called Ipsum, form styling controls in Global Styles and several new blocks — all of it testable now on a staging site.

Release timeline

The schedule runs through four betas between October 20 and November 10, then a release candidate on November 17 that brings a hard string freeze and the published Field Guide. Two more release candidates follow on November 24 and December 1, a 24-hour dry-run code freeze happens December 7, and the final version arrives December 8. Hummel notes the dates come from the official 7.2 release page, while an earlier volunteer call mentioned a December 8 to 10 window, so a one-day slip would not be surprising. Matt Mullenweg is release lead, David Baumwald handles release coordination, and George Mamadashvili and Peter Wilson are tech leads. Nothing is locked until RC 1: the core team merges roadmap work only when it is ready enough.

A default theme without a year

Ipsum is a minimal, blank-canvas blog theme and the first default theme in years that drops the year from its name. Hummel describes it as a plainer starting point than Twenty Twenty-Five.

Notes gains suggestion mode

Notes, the block-level commenting feature on drafts, is in line for a suggestion mode that behaves like tracked changes in a word processor: editors propose edits and authors accept or reject them. Emoji reactions and a toolbar shortcut for adding a note are also planned. Because suggestion mode is still a large change under review, the smaller Notes updates could ship without it.

Secrets API and credential alerts

The Secrets API gives core a standard place to hold credentials such as API keys, replacing the common pattern of every plugin inventing its own storage, often in plain options. WP-CLI support arrives first, with a settings screen planned for 7.3. Two related security items: WordPress will send an email when a new application password is added to an account, a useful early warning against takeovers, and a sudo mode requiring password re-entry before risky admin actions is on the list but has no public proposal yet, so it may slip to 7.3.

Form styling and new blocks

Global Styles gains UI for styling buttons, text inputs, selects and labels, including hover and focus states. Block settings may also start displaying the value a block inherits from Global Styles, with a way to reset an override, though that design is still open. On the block side, 7.2 adds a Description List block for definition-list markup, moves Table of Contents to server-side rendering on its way to stable status, lets the Icon block search by keyword rather than only by label, and introduces a new data-wp-html directive in the Interactivity API for rendering trusted markup, plus router fixes.

Admin, accessibility and performance work

Smaller changes include clearer error messages with a copy button, admin notices that screen readers announce properly and that can be dismissed with the keyboard, automated axe-core accessibility checks in core's test suite, the return of an On This Day dashboard widget after it was pulled from 7.1, and the replacement of admin script and style concatenation with prefetching.

AI work stays in the plugin

Most AI work this cycle lives in the official AI plugin rather than core. The plan adds read-only abilities covering media, taxonomies and comments, and places the MCP Adapter — the bridge that lets AI tools talk to a site over Model Context Protocol — in the Plugin Directory.

What is not arriving in 7.2

Real-time collaboration is left out and being reworked. React 19 is far along but unlikely to fully land. The Secrets settings screen and the extensible Site Editor wait for 7.3.

How to test before release

Hummel recommends testing on a staging copy with a fresh backup, never on a live site. Install the WordPress Beta Tester plugin, pick the bleeding edge channel and the beta/RC stream under Tools, then update from the Dashboard, or run the WP-CLI core update command pointed at the beta build. Click through forms, custom blocks and any admin screens your plugins add, since the new form styling touches front-end buttons and inputs, and report bugs to Core Trac or the Gutenberg GitHub repository. His update guidance: personal blogs with few plugins can update in release week, business sites after staging tests, client sites after the first point release, and any site immediately when a security release drops — always with a full backup first.

Why it matters

The Secrets API closes a long-standing gap in how WordPress plugins store API keys and other credentials, and plugin authors handling secrets should start adapting to it now. Form styling in Global Styles can visibly change front-end buttons and inputs, so theme developers and site owners have real regression risk to check. Suggestion mode pushes WordPress toward proper editorial workflows. Because features stay fluid until RC 1 on November 17, testing during the beta window is the most effective way to influence what actually ships on December 8.