Vibe coding is shrinking WordPress. We are not sending the bill to our customers.

For the first time in its history, WordPress is getting smaller. W3Techs had it on 43.6% of all websites in January 2025. At the end of October 2026 the figure was 39.5%. The sites that left mostly did not move to another CMS. They became custom code, a growing share of it written with AI: in Chrome’s real-user data, the number of Next.js sites roughly doubled over the same period, while WordPress lost about 14% of its sites with real traffic.

Plugin companies feel it first. Barn2, GravityKit and Paid Memberships Pro have all reported new sales down by almost half compared with two years ago. Renewals are what keeps the lights on.

Some companies have answered with the simplest possible move: charging more to the customers who stayed. We think that is the wrong answer, for those customers and for WordPress itself. This post is about what we are doing instead, and about why we think the people who left will need the professionals sooner than they expect.

Vibe coding is real, and we use it too

Let us get this out of the way: this is not an anti-AI post. Describe a booking system to an AI agent in the morning, and by the afternoon you have something that works. For a lot of small websites, that is a genuinely good outcome, and we would be lying if we pretended otherwise. We use AI every day ourselves, to write code, to test it, to review it and to answer support tickets.

The sites WordPress is losing are mostly the ones where it was always a little too much: a five-page brochure, a landing page, a simple internal tool. At the same time, the competition inside WordPress exploded. The plugin directory used to get around 300 new plugins a month. In October 2026 it was closer to 3,500, many of them written with AI. A smaller market, with far more products fighting over it.

The easy answer: send the bill to the loyal customers

When new sales fall by half, the customers who renew become the business. They are also the easiest customers to charge more, because the switching cost sits on their side: the agency with 40 client sites built around one plugin, the webshop whose checkout depends on it, the company whose staff only know this one admin screen. Some of them stay because they like WordPress. Some stay because leaving would cost more than paying. Either way, they are the ones who see the new invoice.

We went through the pricing pages of 133 WordPress plugin, theme and service vendors, comparing mid-2024 with today. Thirty-three of them raised prices well beyond the usual yearly adjustment. These are the clearest cases:

Patchstack, CookieYes, Crocoblock, BuddyBoss, MemberPress and Paid Memberships Pro made similar moves, and the pricing pages of LearnDash and The Events Calendar now sell a four-plugin bundle starting at $350 a year, where a single-site license used to cost $199 and $99. But most vendors did not do this. Of the 133, 63 kept their list prices, among them WPForms, Gravity Forms, ACF, Divi, Bricks, WPML and UpdraftPlus, and six cut them: AIOSEO lowered its renewal prices by a fifth. A shrinking market does not force anyone to double a renewal. It is a choice.

Every company has its reasons, and some of them are real. Wordfence explains its new prices with the cost of keeping up with attackers who now build exploits with AI, and its research team does serious work. But look at where the bill lands. Customers on legacy Wordfence Premium pricing get a flat 40% increase. Yoast moved existing WooCommerce SEO subscriptions into a bundle with Premium that costs more than twice as much. The most common move was not a bigger number on the same plan, but the end of the generous multi-site license: WP Rocket, Kadence, Beaver Builder, GeneratePress and Ultimate Member all capped or retired the plans agencies had built their business on. At Cookiebot, the smallest accounts were the ones moved to the higher rate.

In the short term, the math works. In the long term, it is a tax on loyalty, and it speeds up the very trend it reacts to. Every price increase becomes a new line in somebody’s “should we leave WordPress?” spreadsheet. The agency passes the cost on to its clients, and the client asks an AI what a rebuild would cost. The vendors who raise prices to survive a shrinking WordPress are, one renewal at a time, helping it shrink.

What we are doing instead

We have been building WordPress products since 2018, and the brief has never changed: find answers to WordPress problems that nobody else is giving, instead of shipping the twentieth copy of an existing plugin. A shrinking market is one more problem to solve, and squeezing the people who already trust us is not an original answer to it.

• The price you subscribe at is the price you keep. It has worked this way for eight years: as long as your subscription runs, your renewal price does not change. We are not breaking that to make up for a smaller market. Our customers did nothing wrong by staying with WordPress, and they should not pay for the ones who left.
• Our prices stay where they are. Single-site licenses start at $6.99 a year, and most of our plugins cost less per year than a single hour of a developer’s time.
• AI lowers our costs, and we pass that on. The same tools that let a small business build an app let a small team like ours build, test and support more products. That saving goes into prices and products, not into a margin taken from a declining market.
• We want to grow against the wind. We would rather earn new customers by being the better choice than shrink comfortably on renewals. It is slower. It is also the only direction in which WordPress keeps getting better.

The vibe coding bubble, and the day you need a professional

We think the vibe coding bubble will deflate. Not AI coding itself; that is here to stay. What will deflate is the belief that anyone can build anything alone, and then run it alone, forever, without ever needing a professional.

Building was never the hard part of owning software. Running it is: security fixes, updates, backups, a payment provider that changes its API, a privacy law that changes its rules. With a vibe-coded app, all of that belongs to one person, and that person usually has a different job. October gave a clean example of what that means.

PHP2Shell: one week in October

On October 21, PHP shipped fixes for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Remote code execution, no login needed, exploitable with default settings, in practically every PHP version still in use. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older got no official release at all. The attackers did not wait for the announcement: Amazon’s honeypots logged the first exploitation attempt on October 17, four days before disclosure, and proof-of-concept code was on GitHub within days.

Fixing it is easy. An AI agent with access to the server will update PHP and restart it in five minutes, and it will do it correctly. That is not the problem. The problem is that someone has to know they need to ask.

The news travelled where technical news travels: r/PHP and r/sysadmin, Hacker News, security blogs, vendor advisories. Hosting companies, agencies and sysadmins read those every morning, and many patched within hours; Qualys alone counted 199,000 patched installations in the first twelve hours. The plumber, the florist and the webshop owner do not read r/sysadmin. They hear about it days later, if at all, usually when a customer calls about a strange redirect or the browser starts showing a warning on their site. And even then, would they connect “a vulnerability in PHP” with their own website? An AI built it. Do they know it runs on PHP?

This is not a PHP problem. In December 2025, React2Shell did the same to apps built on React Server Components, including a lot of Next.js apps, the stack many vibe-coded projects run on. Every stack gets its day. The only question is whether anybody is on watch when it comes.

Why WordPress is the better place for AI to work

The irony is that AI works better on WordPress than on a custom CRM or a homemade webshop. AI does its best work when it has a lot to stand on.

• Less code to own. Ask an AI for a webshop from scratch, and it writes logins, roles, sessions, permissions, a database layer, an admin and an update path, every line of it yours to maintain. On WordPress the same AI writes a few hundred lines of plugin on top of a core that already has all of that, maintained by a security team and tested on tens of millions of sites.
• The models already know it. More than twenty years of public WordPress code, documentation and forum answers went into them. Hooks, the REST API and WP-CLI are familiar ground. Your custom code base, the AI meets for the first time in every new session.
• Somebody else is watching too. When PHP2Shell landed, hosts patched their fleets, vulnerability databases logged it, and security vendors wrote about it. A vibe-coded app has an audience of one.
• Someone else can take over. A WordPress site can be handed to any of millions of developers. A custom app is fully understood by one thing: the chat history that created it.

We wrote the longer version of this argument, with payments and invoicing as examples, in WordPress in the AI era. The short version: use AI, and use it on top of WordPress.

What this means if you run WordPress

• Check your PHP version today. Tools → Site Health → Info → Server. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. On 8.1 or older, ask your host what they did about PHP2Shell.
• Make sure someone is on watch. A host that patches PHP for you, an agency, or at least a weekly look at what was disclosed. Our weekly WordPress vulnerability report exists for exactly that.
• Keep using AI. For a plugin, a snippet, a migration, a support answer. It is a better developer on WordPress than on a blank page.
• Plan your renewals without fear. If you use our plugins, you renew at the price you subscribed at, every year.

Frequently asked questions

Are Must-Have Plugins prices going up?

No. The price you subscribe at stays the same for as long as your subscription runs, and it has worked that way for eight years. Single-site licenses start at $6.99 a year.

Can an AI agent keep my server patched?

Yes, if it is told to, or if it runs on a schedule and someone reads its reports. The fix is rarely the hard part. Knowing that a fix is needed, and that it applies to your site, is.

Is WordPress still worth building on in 2026?

Yes. It is smaller than it was, but it is still the largest, best documented and most watched platform on the web, and AI tools are more productive on it than on custom code. For sites that take payments, collect personal data or need to run for years, that matters more than how fast the first version was built.

The takeaway

Vibe coding changed the market, and the companies that live on WordPress have to react. Raising prices on the customers who stayed is the easiest reaction, and the one that does WordPress the most harm. We are keeping our prices where they are, using AI to work faster instead of charging more, and betting on WordPress, because when the next PHP2Shell arrives, it is the platform where somebody is on watch.