WordPress 7.0: Connectors API and the End of MD5 Security

TL;DR: WordPress 7.0, due April 9, 2026, delivers two foundational changes. The new Connectors API enables native third-party data integration without custom database tables. Concurrently, the platform completes its long-planned migration from phpass/MD5 to bcrypt and BLAKE2b, marking a decisive shift to modern cryptographic standards for core security.

Introduction: An Architectural Pivot

For years, WordPress has navigated a tension between its monolithic, database-centric heritage and the modern demand for a composable, API-first web. Integrating external data from a SaaS platform or a headless backend typically necessitated clunky workarounds: custom database tables, transient caches, or entirely separate admin interfaces. This pattern introduced complexity, syncing issues, and a deviation from the native WordPress experience. WordPress 7.0, the first major release of the project’s “Data Liberation” phase, directly confronts this architectural problem. It offers a canonical path for external data while simultaneously addressing a critical, decades-old vulnerability in its foundational security model. This release is not merely a feature update; it is a coordinated move towards a more connected and inherently secure platform.

What is WordPress 7.0?

WordPress 7.0 is the scheduled major core release for April 2026, representing a strategic pivot in the platform’s evolution. Its defining characteristic is the introduction of a new, first-class Connectors API that allows developers to natively bind third-party data sources directly into the WordPress admin interface and data layer. In parallel, the release finalises the platform’s long-anticipated migration away from the phpass library and its underlying MD5-based password hashing, replacing it with the modern bcrypt algorithm and BLAKE2b for application secrets, establishing a post-MD5 security architecture compliant with 2026 standards.

The Connectors API: A New Primitive for Integration

The most significant architectural innovation in WordPress 7.0 is the Connectors API. This new system provides a standardised, WordPress-native methodology for integrating external data sources—be it a CRM like Salesforce, a headless CMS like Contentful, or a custom microservice—without the traditional overhead of creating and maintaining parallel database tables. The API treats external data as a first-class citizen within the WordPress data lifecycle, enabling it to appear in the admin list tables, benefit from core search and filtering, and utilise familiar APIs like WP_Query and the REST API through a unified abstraction layer.

At its core, the Connectors API uses a registration pattern. A developer implements a connector class that defines how to fetch, format, and optionally write data to the external service. Once registered, this data becomes accessible through a consistent internal interface. This dramatically simplifies the creation of admin listings for external data, moving away from bespoke React components or shortcode-based dashboards.

Pro Tip: When designing a connector, prioritise implementing pagination and filtering at the source service level. The Connectors API can delegate these operations, preventing the performance hit of transferring entire datasets to WordPress for simple list views.

The business value is substantial. It reduces development time for integrated solutions, ensures a consistent user experience for site administrators, and eliminates the data synchronisation and integrity challenges inherent in duplicating data into wp_posts. For a deeper technical dive, refer to the official WordPress Core Handbook entry on the Connectors API.

Why Does the Post-MD5 Security Architecture Matter?

The security enhancements in WordPress 7.0 are not incremental; they are foundational. The deprecation of the phpass library, which has used salted MD5 hashes for password storage for over two decades, marks the end of an era. This system, while robust for its time, is computationally cheap to attack with modern hardware. Its replacement with bcrypt, a deliberately slow and memory-hard algorithm, is a critical compliance and risk-mitigation step. Bcrypt automatically adapts its computational cost, making brute-force attacks economically non-viable.

Version 7.0 extends this modernisation with the implementation of BLAKE2b hashing for application passwords and password reset keys. These are high-value, single-use secrets where speed is a vulnerability. BLAKE2b provides significantly higher resistance to brute-force and length-extension attacks compared to the older SHA-based methods, aligning with 2026 cybersecurity standards. This shift, coupled with the emergency patches in 6.9.3 for REST API vulnerabilities, signals a mature, proactive approach to platform security that extends beyond the core to the broader plugin ecosystem, as highlighted by recent disclosures like CVE-2026-2579 in third-party block libraries.

Performance and Interactivity: The Speculation and Interactivity APIs

Beyond data and security, WordPress 7.0 introduces significant performance primitives. Native support for the Speculation Rules API allows developers to declaratively instruct the browser to pre-render or prefetch specific pages based on user intent, such as hovering over a link. This “speculative loading” can dramatically reduce perceived load times for subsequent page views, a technique previously requiring complex custom JavaScript.

Simultaneously, the Interactivity API reaches version 2.0, introducing server-side state hydration. This solves a key performance issue in complex, block-based applications: First Input Delay (FID). By serialising the initial state of interactive blocks directly into the server-rendered HTML, the client-side JavaScript does not need to fetch additional data before becoming interactive. This reduces the time-to-interactive for features like instant search filters or dynamic counters within blocks.

// Example: Declaring server-side state for an Interactivity API block.
$state = array(
    'productCount' => count( $external_products ),
    'filters'      => array(),
);
wp_interactivity_state( 'myCommerceBlock', $state );

The 2026 Outlook: Towards a Composable Core

The features solidified in WordPress 7.0 set a clear trajectory for the year ahead. The Connectors API establishes a pattern that will likely expand, with future core features potentially offering “connector-aware” functionality for caching, revisions, and even the Block Editor. The security mandate will continue to push third-party developers to audit and update their cryptographic practices, especially in popular commercial plugins. Furthermore, the maturation of the Interactivity and Speculation Rules APIs points to a future where WordPress core increasingly provides low-level primitives for modern, fast web experiences, while the theme and plugin layer focuses on composition and business logic. The platform is strategically evolving from a monolithic CMS into a composable application framework with a rich, integrated admin centre.

Key Takeaways

• The Connectors API is a paradigm shift: It provides the first canonical method to natively integrate external data into the WordPress admin, eliminating the need for custom database tables and sync routines.
• Bcrypt migration is non-negotiable: The move from phpass/MD5 to bcrypt and BLAKE2b is a critical security upgrade that brings WordPress in line with 2026 cybersecurity compliance standards.
• Performance is now declarative: Leverage the native Speculation Rules API for pre-rendering and the Interactivity API v2.0’s server-side hydration to measurably improve Core Web Vitals like FID.
• Security focus is expanding: Core updates, like the 6.9.3 REST API patches, alongside high-severity CVEs in plugins like WowStore, indicate a growing emphasis on securing the entire WordPress ecosystem, not just the core software.
• Plan for backward compatibility: Audit custom authentication flows, password-related functions, and data integration patterns in your projects to ensure compatibility with the new security and data models.

Conclusion

WordPress 7.0 is a release of profound architectural intent. It moves decisively to solve two long-standing challenges: the friction of external data integration and the legacy risk of an outdated cryptographic foundation. By introducing the Connectors API and completing the migration to bcrypt, the platform is not just adding features but redefining its boundaries and responsibilities. For senior engineers and architects, this release demands a review of existing integration patterns and security implementations. At Zorinto, we are already assisting our enterprise clients in architecting connector-based data layers and conducting security audits to ensure a seamless, secure transition to this new, more capable WordPress paradigm.