Key Takeaways
- AI coding agents are replacing plugins in practice: Experienced developers can now build lean, purpose-built WordPress plugins faster than configuring bloated commercial alternatives.
- Plugin bloat is the real vulnerability: Many popular plugins carry years of legacy code and bundle features most sites never use. That is technical debt you inherit.
- Vibe coding is misunderstood: The term has negative connotations, but under the direction of an experienced software architect, AI agents produce hardened, purpose-fit code.
- WordPress plugins are a form of SaaS: If developers can rapidly build custom replacements, the subscription-based plugin economy faces the same disruption that broader SaaS is beginning to feel.
- The real disruption comes when non-developers can do this: The plugin repository's true existential threat arrives when WordPress itself ships AI tooling that lets anyone generate custom functionality.
I have been noticing something in my own workflow over the past twelve months. Progressively, quietly, almost without conscious planning, I have been replacing the commercial plugins I relied on for years with custom-built alternatives. Not because I wanted to – because AI coding agents made it faster to build exactly what I need than to configure what someone else thought I might need.
That shift has me asking a question that would have sounded absurd two years ago: could vibe coding and AI agents spell the end of the WordPress plugin repository as we know it?
What Changed in My Workflow
Until recently, my standard WordPress stack for client projects included repository or commercial plugins for SEO, visitor statistics, image optimisation, SVG support, and a handful of smaller utilities. These were not bad plugins. Many had millions of active installations. But each came with trade-offs I had learned to tolerate rather than solve.
Today, the only third-party plugins I still rely on are for security and server caching – two domains where the ongoing threat landscape genuinely justifies dedicated, continuously maintained solutions. Everything else I have built with AI coding agents in VS Code using GitHub Copilot's agent mode. I wrote about how this shift changed my day-to-day work in How AI Coding Agents Freed Me to Focus on Design.
These are not quick hacks. They are properly architected plugins with docblocks, clean class structures, and specific feature sets tailored to what my clients actually need. The difference is that they took hours to build instead of weeks, they do exactly one thing well, and they carry zero unnecessary overhead.
The Plugin Bloat Problem
The WordPress plugin directory currently hosts over 61,000 free plugins. The popular ones – Yoast SEO, Elementor, WooCommerce – each have 7 to 10 million active installations. Impressive numbers that speak to a thriving ecosystem.
But impressive adoption masks a structural problem: bloat. An SEO plugin does not just handle meta descriptions and sitemaps. It adds schema markup, readability analysis, social media previews, redirect managers, breadcrumb generators, and internal linking suggestions. Each feature adds database queries, admin interface elements, and JavaScript bundles that load whether you use them or not.
The legacy problem runs deeper. WordPress's own statistics show that over 20% of sites still run on PHP 7.4, released in 2019. Plugin authors must maintain backward compatibility with these environments, meaning modern PHP features are often off the table. The codebase carries a decade of iterative development on top of architectural decisions made when PHP 5.6 was current.
When I build a custom plugin with an AI agent, I target the specific PHP version running on my client's server. I use modern WordPress APIs. I include only the functionality the project requires. The result is typically 90% smaller in file size and makes fewer database queries than the commercial alternative it replaces.
Vibe Coding: Misunderstood and Misnamed
The term "vibe coding" was coined by AI researcher Andrej Karpathy, co-founder of OpenAI and former AI lead at Tesla, in February 2025. He described it as coding where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists." The term became Collins Dictionary's Word of the Year for 2025.
The negative connotations are real. Simon Willison drew a clear line: "If an LLM wrote every line of your code, but you've reviewed, tested, and understood it all, that's not vibe coding – that's using an LLM as a typing assistant." Andrew Ng called the term "unfortunate" because it misleads people into assuming software engineers just "go with the vibes."
I agree with both of them. What I do is not vibe coding. I operate as a software architect directing a very fast junior developer. I define the architecture, specify the class structure, and dictate the security patterns. The AI writes the implementation at speed. I review every line before it ships.
This is where 30 years of experience becomes the critical differentiator. I know WordPress plugin security best practices – nonce verification, capability checks, data sanitisation, prepared SQL statements – because I have implemented them hundreds of times. When the AI generates code that skips input validation, I catch it immediately.
The research validates why that oversight matters. The VeraCode 2025 GenAI Code Security Report found that AI-generated code security has generally not improved despite dramatic improvements in functionality. A December 2025 CodeRabbit analysis of 470 open-source pull requests found AI co-authored code contained 1.7 times more major issues and 2.74 times more security vulnerabilities than human-written code. These findings describe unsupervised vibe coding – code accepted without review. Under architectural discipline, those risks are manageable.
WordPress Plugins as SaaS
There is a broader conversation about whether AI coding agents spell the end of SaaS. If businesses can build custom tools tailored to their exact workflows, why pay monthly subscriptions for generic software that does 80% of what they need?
WordPress plugins are, in many respects, a form of SaaS. The popular ones follow the freemium model – a free version in the repository with a paid "Pro" tier. Annual licence renewals. Priority support tiers. Upsell emails. The economics mirror any subscription software business.
Y Combinator reported in March 2025 that 25% of startups in its Winter 2025 batch had codebases 95% AI-generated. The Wall Street Journal reported in July 2025 that vibe coding was being adopted for commercial use cases. This is not a fringe experiment anymore.
I can now rapidly develop software solutions that re-engineer and automate parts of my customers' workflows directly into their websites. Where I once paid for a commercial statistics plugin, I now have a lightweight custom tracker recording exactly the metrics my clients care about. Where I used an image optimisation plugin, I have a focused utility that converts uploads to WebP via WordPress's built-in image editor API. Each replacement eliminates a subscription, reduces page load time, and gives me full control.
The Risks Are Real
I want to be honest about the risks, because the discourse tends to split into uncritical enthusiasm or blanket dismissal.
A July 2025 randomised controlled trial by METR found that experienced open-source developers were actually 19% slower when using AI coding tools – despite predicting they would be 24% faster. AI tools feel fast even when they are not, particularly for complex tasks.
A January 2026 academic paper titled "Vibe Coding Kills Open Source" argued that AI-assisted coding reduces engagement with open-source maintainers. AI models gravitate towards large, established libraries in their training data, removing the organic discovery process for newer tools. Fast Company reported on the "vibe coding hangover" – senior engineers encountering development hell when maintaining AI-generated codebases that lacked coherent architecture.
The common thread: AI-generated code without architectural discipline becomes technical debt at machine speed. The tool is not the problem. The absence of expertise is.
When Non-Developers Can Build Plugins
Everything I have described so far is a developer replacing one tool with another. The fundamental skill – understanding WordPress internals – remains essential. This limits the disruption to the relatively small pool of experienced WordPress developers.
The real existential threat to the plugin repository comes when non-developers can generate custom WordPress functionality. WordPress already has an experimental AI Experiments plugin in the repository. It is not hard to imagine a future WordPress release that ships with an integrated AI service for generating plugin code from natural language. "I need a booking system that shows available slots from my Google Calendar" becomes a prompt that produces a working plugin.
If that happens, the economics of the repository change fundamentally. Why browse 61,000 plugins to find one that sort of does what you need, then pay for the Pro version, when you can describe exactly what you want and have it built immediately?
The counter-argument is quality and security. A repository plugin with millions of installations has been battle-tested. It has had vulnerabilities reported and patched. But this counter-argument weakens with every improvement in AI capabilities and the tooling around them – automated testing, security scanning, code review. The gap between "throwaway project" and "production-ready" is closing rapidly.
The Hollowing Out of the Middle
I do not think the WordPress plugin repository disappears. What I think happens is a gradual hollowing out of the middle.
The large, complex plugins – WooCommerce, major page builders – survive because they solve genuinely complex problems requiring continuous development investment. Security and caching plugins survive because their value comes from ongoing threat intelligence. The small, focused utility plugins – SVG support, admin tweaks, specific integrations – are the most vulnerable. These are exactly the kind of well-defined, bounded problems that AI agents handle well.
The freemium model comes under particular pressure. If the value proposition is "the free version does 60% of what you need, pay $99/year for the rest," and an AI agent can build a custom version that does 100% of what you need in an afternoon, the conversion funnel breaks.
For WordPress developers like me, this is mostly good news. The ability to build custom, lightweight plugins for client projects is a genuine competitive advantage. My clients get faster websites, lower ongoing costs, and functionality tailored to their business.
The 61,000 plugins in the repository are not all becoming obsolete overnight. But the assumption that every WordPress site needs a stack of third-party plugins to function? That assumption is already outdated. And once WordPress itself ships AI tooling that empowers non-developers to generate custom functionality, the disruption will accelerate in ways the plugin economy is not prepared for.
