Today we did not get up until after 9am, Obi then went with Sonia for a poo walk while I started the engine to warm the water and then had a shower, at last I can hear you saying, when they returned it was Sonia turn in the shower while Obi had his breakfast. We then decided to take a walk to see if we could find a place that served breakfast, that was on a plate, a rarity around here.
In this issue of Delicious Brain Bytes, we track the final progress of WordPress 6.9 RC1 and the new Abilities API, explore the security advancements of the FAIR/Patchstack collaboration, preview the future of ACF Blocks, and much more!
The final major WordPress release of 2025 is right around the corner. WordPress 6.9 Release Candidate 1 is now available, putting the release on track for its scheduled launch on December 2, 2025. The core team encourages all developers and users to test the RC1 build to ensure stability, particularly since new features like the improved Site Editor experience and the universal Command Palette are included.
The 6.9 release includes several key developer updates, such as enhancements to the DataViews components and the Interactivity API. However, the most foundational change is the introduction of the Abilities API.
The Abilities API is a new foundational system designed to transform how plugins, themes, and WordPress core expose their functionality. It allows developers to register self-contained units of functionality—an “ability”—with standardized inputs, outputs (using JSON Schema), and permissions.
This system is a key part of the broader AI Building Blocks initiative. By registering abilities using the new PHP functions, developers make their plugin features discoverable and executable by AI agents, automation tools, and other systems. Registered abilities are automatically exposed through a new REST API endpoint (wp-abilities/v1), creating a unified, machine-readable registry of functions. This eliminates the need for isolated functions or custom AJAX handlers, simplifying integration and offering developers a predictable method for building the next generation of AI-powered WordPress solutions.
Developers are urged to begin testing the RC1 and exploring the detailed documentation for the Abilities API now. You can download and test RC1 via the WordPress Beta Tester plugin or view the Abilities API documentation here.
The Advanced Custom Fields (ACF) team is hosting a webinar to showcase the latest advancements in ACF Blocks and how modern developers are leveraging them for efficient, creative WordPress solutions.
The session will cover the full spectrum of ACF’s power, from fine-tuning the client editing experience to establishing structured data for the emerging “agentic web.” Speakers Rob Stinson and Iain Poulson will provide a quick “ACF 101” refresher before diving into a live demo of features from recent releases, highlighting how custom block creation has taken a significant leap forward. The team will also address how pairing ACF PRO with managed hosting platforms like WP Engine can unlock new workflow opportunities.
This session is designed to empower developers to build more efficient and creative solutions. The live webinar takes place on Wednesday, November 19, 2025, at 10am CT / 4pm GMT. Secure your spot now and discover the new capabilities transforming the custom block creation experience.
A new plugin called Hidden Gems aims to fundamentally change how developers and users find quality software in the WordPress ecosystem. The plugin addresses a core issue: the default plugin directory prioritizes popular tools with millions of installs, leaving thousands of excellent, lesser-known plugins flying under the radar.
The Hidden Gems plugin solves this by adding a dedicated tab to the “Add New Plugin” screen, using a smart discovery logic built on “quality over popularity.” It defines a “hidden gem” as a plugin that maintains excellent ratings (3+ stars) but has low installation counts (often filtered to under 10K). This logic ensures that users bypass poor-quality, unknown plugins and well-known, established ones to find truly innovative solutions before they become mainstream.
For plugin developers, this tool creates a pathway for quality to be recognized without requiring a massive marketing budget. For users, it offers a competitive advantage by surfacing niche solutions and high-quality alternatives. The plugin includes advanced filtering options based on installation limits, quality thresholds, and more.
You can read the full story behind the plugin’s creation here and find the plugin itself on GitHub.
It’s the best time of year to pick up new developer tools! We’re offering new customers big savings on the essential plugins trusted by top developers and agencies worldwide. Whether you’re trying to move a complex website, offload a massive media library, or structure cutting-edge content, this is the best time to invest in the power and efficiency you need.
This sale covers WP Migrate Pro, WP Offload Media, WP Offload SES, ACF PRO, and NitroPack, giving you the chance to build your perfect tech stack at the lowest price of the year. Please note that all discounts listed below are for new customers only.
Here’s a breakdown of the incredible deals available on WP Engine’s developer-focused plugins:
The time to invest in efficiency, performance, and structure is now, with savings on every tool you need to build faster, more stable, and more profitable client sites.
The sale runs from November 17th through December 5th, 2025. Make sure to get these deals now and upgrade your entire WordPress workflow!
As reported in The Repository, the decentralized architecture of the FAIR Package Manager recently took a major step toward robust security integration at the inaugural CloudFest USA Hackathon. A collaborative team from FAIR and Patchstack built a Minimum Viable Product (MVP) for the FAIR Software Security Assistant.
The project’s goal was to surface vulnerability warnings directly in the WordPress admin by translating Patchstack’s vulnerability data into FAIR’s trust labeling model. This model allows independent organizations to attach verified trust signals to plugins. FAIR technical steering committee co-chair Carrie Dils noted the process was crucial for figuring out “how we talk to the API, how we turn that into labels, and how we build rules around those labels.”
The resulting policy engine will allow hosts or site owners to define automated rules—such as automatically hiding critically vulnerable plugins from the search screen—addressing supply-chain security directly during plugin discovery. This MVP demonstrates a model where decentralization and security are designed to work together.
The Smart Search AI MCP Server is a powerful new feature in WP Engine’s AI Toolkit that transforms your WordPress site into a dynamic, real-time knowledge base for any external Large Language Model (LLM) you connect to it. When enabled, this server responds to requests from AI tools formatted using the Model Context Protocol (MCP) standard.
In this article, Fran Agulto discusses what MCP is, how to work with the Smart Search AI MCP Server, and how it enhances the Smart Search AI product.
The WordPress media library serves us well for public content, but what about premium assets, private documents, or confidential client data? The default setup makes every uploaded file publicly accessible via a direct URL. This is a critical limitation for membership sites, digital product stores, and businesses sharing sensitive information.
Relying on direct links in your wp-content/uploads folder means anyone who finds the URL can access your content. This is a significant security risk and, for some sites, a potential loss of revenue.
In this article, we address that challenge. We’ll explore a solution to move beyond basic file storage and achieve granular control over your WordPress media, ensuring your valuable or confidential files are securely delivered only to those with proper authorization.
What’s the most interesting news you’ve come across recently? Pop by Twitter and let us know.
The post Delicious Brain Bytes: WordPress 6.9 RC1, FAIR’s Security MVP, and Finding Hidden Gems appeared first on Delicious Brains.
AI-powered coding tools have been around for some time, but Cursor has been getting a lot of press recently. While other tools often focus on code completion, Cursor allows natural language inputs and can guide you in exactly what to do with the code once it’s written.
One of its more attractive features is the ability to set rules, such as “Follow WordPress coding standards.” In this article, we’ll set up Cursor for WordPress development, and then use it to create a simple plugin.
Getting started with Cursor is relatively straightforward. Just visit the downloads page, download the file for your OS, and install following the on-screen instructions. There are builds available for Mac, Windows, and Linux. We’ll be using the Windows distribution throughout this article, but it shouldn’t make much difference.
The installation screen allows you to choose Vim, Emacs, Atom, Sublime, Jetbrains, or VS Code keybindings, with VS Code as the default. You can also specify the language you wish to use (defaults to English), and disable Cursor’s codebase indexing if you choose. There are also a couple of options to launch Cursor from the command line. Once you’ve made your choices, click Continue to proceed with the installation.
Next, the installer will also if you’d like to import existing VS Code extensions, settings, and keybindings. This is a handy feature if you have a complicated setup, but I’m going to just click Start from Scratch. Next, you can choose your data preferences. “Help Improve Cursor” allows them to collect usage data, while “Privacy Mode” disables this function.
Next, you’ll be prompted to log in. You can create a fresh ID for this, or use an existing Google or GitHub account.
At this point, you should see three options in Cursor: “Open project”, “Clone repo”, and “Connect via SSH”. Those are all fairly self-explanatory, but we’re going to ignore them for now anyway. Instead, I’m going to put in some time configuring Cursor for WordPress development.
Click on the gear icon in the top right corner to access Cursor’s settings. On the “General” tab, find the “Rules for AI” section, and add the following global rule:
LoginWhen working with WordPress projects, follow WordPress Coding Standards and best practices.
Adding a rule in this section sets it as a global rule that will be used for all projects. You can also set project-specific rules that only apply to that project.
Cursor’s Rules for AI documentation goes into more detail on this.
The goal here is to create a plugin called “Hello Homer” that displays random Simpsons quotes in the WordPress admin area, similar to the “Hello Dolly” plugin. We’ll use Cursor to assist us in developing this plugin, showcasing how AI can streamline the WordPress plugin development process, even when the plugin only achieves something pointless that no reasonable person would ever want.
Cursor is similar to other code editors you may be familiar with. Once you’ve opened a project, you’ll see the files and folders in the left-hand pane. You can click into any of these and modify them as you normally would, creating new files, editing code, etc. However, the real power of Cursor is its AI editing. To access this, click the Toggle AI Pane button in the top right, next to the Settings icon. When opened, the pane will show three tabs: “Chat”, “Composer”, and “Bug Finder”.
Chat: This tab provides an interactive AI assistant that you can converse with about your code. You can ask questions, get explanations, or request help with specific coding tasks. The chat feature has built-in context awareness, allowing it to understand your codebase and provide relevant answers.
Composer: This is an advanced multi-file editing feature that can help you build entire applications or make large-scale changes across your project. With Composer, you can describe what you want to create, and the AI will generate code across multiple files to implement your request. It’s particularly useful for quickly prototyping ideas or setting up boilerplate code.
Bug Finder: This tab offers automated code analysis to detect and highlight potential bugs or issues in your codebase. Before you get too excited, it’s worth mentioning that it’s an experimental feature, and it’s very expensive because it has to run through every single change in your codebase. You might be able to get the price down by stashing Git changes you don’t want scanned.
First, I’ll try the “Chat” feature and see how far that gets us. When it comes to LLMs, the old principle of “garbage in, garbage out” still applies. The more instructions you give it, and the more precise those instructions are, the better your results will be.
This means I should give Cursor very precise and detailed instructions for exactly what I want it to do. That’s not much of a test, though. Instead, we’re going to give it very brief instructions and see what it can whip up based on those and the single rule I set, instructing it to follow the WordPress coding standards and best practices.
The initial results look pretty good, complete with notes on how to implement it, and a warning that the server has to have the right permissions to make external API calls to Frinkiac.com.
The code window has a button marked “Apply” at the top. In this case, clicking this button will create a new file, hello-homer.php, with the provided code, placing it in the root directory of the project. The plugin won’t be functional until it’s moved to the plugins directory and activated through the WordPress admin. Moving the file is simply a matter of clicking on the file in Cursor, and dragging it to the right directory. Once that’s done, we can activate the plugin in the usual way.
Opening the backend of the site, we can see that the plugin definitely exists, complete with a description.
Now it’s time for the real test, seeing if it actually works as intended:
Success! We now have a Simpsons quote in our WordPress admin. Since that worked so well, I’ll ask Cursor to “improve” the plugin. I’m using scare quotes as none of what we’ll ask it to do will make it more useful, because zero plus zero still equals zero. However, it will make it more complicated, allowing us to test Cursor’s abilities further.
Here’s the list of what I’ll ask it to do:
In a few seconds, Cursor had made the needed revisions to the plugin’s code. After clicking Apply again, we refreshed the site again. On first examination, it worked like a charm:
We’ve got a quote, the episode’s title and season, and a screenshot. Cursor also managed to create a settings page:
Long story short, it did everything I asked it to do. Expanding on that a bit, it also did a couple of things I didn’t specifically ask it to do: adding sanitization and escaping to protect against cross-site scripting, and using i18n internationalization to make it translatable to other languages. It went ahead and added these because they’re part of WordPress coding standards and best practices, set in the “Rules for AI” settings.
You can see the code for the complete plugin here.
This was a quick test, and the plugin we created was fairly simple, but Cursor definitely fulfilled the objectives. Despite that, I’d be very cautious about deploying any of its code in a real-world situation without having a highly experienced dev go over it first. Off the top of my head, there are quite a few situations where a human touch wouldn’t just be helpful, but practically required:
Complex Logic: When dealing with intricate business logic or custom algorithms, human developers often have a better grasp of the nuances and edge cases that AI might overlook.
Performance-Critical Code: Manually crafted code is often more efficient than AI-generated solutions. There’s usually more than one way to do something. The code the AI spits out at you may work, but there’s no guarantee that it’s the best way to do it.
Security-Sensitive Areas: When working with user authentication, data encryption, or other security-critical features, it’s crucial to have a human expert review and implement the code.
In every case, it’s essential that a living, breathing human being take responsibility. That way at least you have someone to blame. This may sound like a joke, but I’m 100% serious. You can have a robot do your work for you, but you’re still on the hook for making sure that work is up to scratch. The key is to view AI as a powerful assistant that enhances your development workflow rather than a replacement for your expertise and judgment.
Have you used Cursor or other AI coding tools? What was your experience? Let me know in the comments.
The post Creating a WordPress Plugin With Cursor appeared first on Delicious Brains.
