2026 Has Changed Everything About WordPress Security  🔗 **Source:** [2026 Has Changed Everything About WordPress Security](https://www.youtube.com/watch?v=B_VE-djcDpw) > [!note]+ Document Notes > tags: #wordpress-security #supply-chain-attacks #ai-tooling #wp-governance #devrel > author: Steve Burge × Austin Ginder > source: PublishPress Podcast (YouTube) > reference: https://www.youtube.com/watch?v=B_VE-djcDpw > date: 2026-05-19 > <!-- deep-read:sections start --> ## 🧰 Action Inbox - [H1] **Run Claude Code forensic audit on a customer site backup** — Austin's recommendation: grab a backup, download locally, have Claude Code do a code audit. "You'll be surprised." Even a $200/month cloud code subscription on a laptop is enough to find back doors. Test this against the WPCC/community-managed sites you advise on. #wordpress-security - [H1] **Connect with Austin Ginder for WPCC/FAIR conversation on SVN scanning** — His approach (study existing hijacked-updater fingerprints, scan SVN history of the top 2,000 plugins, look for hashes-that-shouldn't-exist) is a governance-layer pattern the FAIR.pm distribution discussion needs. He's at anchor.host and wpbeacon.io. #fair-governance - [H2] **Review the four documented attack patterns** as a reference for plugin author due diligence guidance: (1) expired domain → hacker registers → WordPress.org credentials [widget logic, 100K installs]; (2) plugin author buyout on Flippa → backdoor injection ["essential plugins"/WP Online Support, 30+ plugins, six figures]; (3) self-hijacked auto-updater years ago [quick page post redirect, 70K installs, 5 years ago]; (4) hijacked-updater-as-service [scroll-to-top, 20K installs]. #plugin-vetting - [H3] **Test scanning own customer set for JavaScript-tag changes** — Austin's first defensive system after a credit card skimmer incident: scan every JS tag the front end loads, alert when any change, run changed tags through Claude to assess. Pattern is reusable. #security-hygiene ## 🎯 Bottom Line February 2026 was the inflection point where bad actors picked up AI superpowers and the standard WordPress security advice (update plugins, good backups, reputable plugins) stopped being sufficient. The asymmetric defense is that the WordPress.org SVN repo is fully public — anyone with Claude Code on a laptop can scan it, which puts solo developers on par with corporate security teams for the first time. ## 📖 Key Claims & Evidence ### Three accidental discoveries + one intentional one 1. **Widget logic plugin (end of March)** — First find. Austin's homegrown JavaScript-tag-change scanner triggered on a sports JavaScript library appearing on a site that shouldn't have one. Investigation revealed manipulated version numbers on WordPress.org: the latest version was clean, but many sites were trapped at an old compromised version. Root cause: original author's domain expired, hacker registered it, gained WordPress.org credentials. ~100K active installs. 2. **"Essential plugins" suite (WP Online Support)** — Not Austin's discovery (community reported to WP team), but Austin's AI-powered investigation traced the story. Hacker purchased the company on Flippa for six figures, planted backdoors in 30+ plugins. Patch included scanner that put alert banner in WP dashboard — Austin's agency partner Ricky saw it. Site had compromised wp-config. Cloud Code wrote the article that went viral on Hacker News. 3. **Quick page post redirect plugin** — Discovered via Austin's hash-drift tool ("how many different versions of [plugin X] are running on my own sites"). Found 12 sites running a version not on WordPress.org. SVN history revealed the author hijacked their *own* plugin 5 years ago (2020-2021) via a third-party updater script. WordPress booted them; hacker kept maintaining for years. 70K sites still on hijacked version, most inert (Googlebot SEO cloaking). 4. **Scroll-to-top (WP Beacon's first intentional find)** — Active backdoor, 20K installs, same fingerprints as the others ("the same actor or the same sort of people in the same bad dark web ecosystem"). Reported to WP team, plugin closed. ### Recurring attack pattern: the hijacked update channel "The update channel seems to be a hot ticket item for these hackers. They try to slip a self-updator into a WordPress.org plugin, get it on hijacked channel, and then WordPress.org has zero visibility because they have no idea what's going on off their site." ### The asymmetry insight "Me on a laptop that's on a $200 a month cloud code subscription, I can find anything. Like, that should not be possible. That should just be security teams with lots of employees or resources. But no, anyone can actually scan it." ## ✅ Logical Validity - **Strong inductive reasoning** — Three independent discoveries with different fingerprints, plus one intentional find using a hypothesis built from the first three. Sample is small but methodology is reproducible. - **Appropriately humble about credit** — "It's so hard to know what is Claude and what is me when Claude's doing all the work." Owns the curiosity/domain-knowledge contribution without overclaiming. - **Causal reasoning is clean** — Links AI capability shift in February → attacker behavior change → his defensive response. No post-hoc rationalization. ## 🛡️ DARVO Analysis None observed. Austin is generous toward the WP plugin team ("they've been fantastic to deal with"), credits the original community reporter for the essential plugins story, and credits his security-firm friend Sahas for the infrastructure takedowns. ## 🚩 Areas needing further research - Identity of the actors behind the four attacks — Austin theorizes same actor or shared codebase ("same fingerprints all over it") but can't confirm - Whether automatic and WordPress.org plugin team are building parallel AI scanners — Austin mentions they're "passing notes back and forth" - How the WordPress.org infrastructure could surface variant-hash drift at the platform level rather than relying on hosting providers to detect it ## 🌍 For DevRel / WPCC context This is high-priority listening for WPCC + FAIR governance work. The "expired domain → hacker registers → WordPress.org credentials" pattern is a structural vulnerability in WordPress.org plugin governance worth discussing with the security/plugin teams. The Five for the Future framing question: should plugin maintenance handoff be a Five for the Future contribution category, since orphaned plugins are the attack surface? <!-- deep-read:sections end --> 📄 **Full text:** ![[Full Document Contents/Articles/2026 Has Changed Everything About WordPress Security.md|2026 Has Changed Everything About WordPress Security by PublishPress (Steve Burge × Austin Ginder)]] ## Highlights - thing. I'm really good at I can I can do this well, but the coding agent can do it just as well if not better than me. So that was one part. The other part was what was happening in the world of my business and other people had had also picked up AI and it's like a superpower for them but these other people that picked it up were bad actors. So, >> okay. >> Um, my business is I host and manage ([View Highlight](https://read.readwise.io/read/01ks19bqnk9ycsx2axtxjq7j4c)) - Note: February 2026 inflection point — bad actors with AI superpower drove the new attack escalation that the old "update plugins, good backups, reputable plugins" advice can no longer fully counter. - Tags: atom/literature/h1, wordpress-security, feb-2026-inflection, ai-asymmetry - thing. I'm really good at I can I can do this well, but the coding agent can do it just as well if not better than me. So that was one part. The other part was what was happening in the world of my business and other people had had also picked up AI and it's like a superpower for them but these other people that picked it up were bad actors. So, >> okay. >> Um, my business is I host and manage ([View Highlight](https://read.readwise.io/read/01ks1a2akrqg768jtcdezt6ny1)) - Note: February 2026 inflection point: AI gave both Austin AND bad actors superpowers simultaneously. This is the framing that justifies WP Beacon's existence. - Tags: ai-arms-race, feb-2026-inflection, atom/literature/h1, wordpress-security - we kept digging with AI. So, so one of my my security ideas is like, well, why don't I just scan all of my customers for tags that are changing. every JavaScript tag we audit. If a tag changes on the front end of the site, I run it through AI and I ask, does this look harmful? Does this or is this okay? So, I I I had set that up in place and this was like the first big hit. Uh it ([View Highlight](https://read.readwise.io/read/01ks19c3fqjymepfbgpb3q25ve)) - Note: The defensive JavaScript-tag-change scanner pattern. Triggered by a credit-card skimmer cleanup. Reusable architecture for any host monitoring customer sites at scale. - Tags: atom/literature/h2, javascript-monitoring, defensive-pattern, host-security - we kept digging with AI. So, so one of my my security ideas is like, well, why don't I just scan all of my customers for tags that are changing. every JavaScript tag we audit. If a tag changes on the front end of the site, I run it through AI and I ask, does this look harmful? Does this or is this okay? So, I I I had set that up in place and this was like the first big hit. Uh it ([View Highlight](https://read.readwise.io/read/01ks1a2qayxgdhrz2n1jrh0nvs)) - Note: The JavaScript-tag-change scanner pattern — every JS tag on every customer site is audited; any change is run through AI for assessment. Built after a credit card skimmer incident. Reusable defensive pattern for any WP hosting/agency. - Tags: defensive-scanner-pattern, javascript-audit, atom/literature/h1, action/h2 - A hacker was able to register a domain and this domain happened to give them access to WordPress.org with access to like 100,000 active installs. >> Wow. Okay. So then they they could start to do nefarious things acting as the the original author because the original author left their domain expired because they weren't interested in maintaining a plugin. Who knows? Maybe they maybe it was an accident. I don't know the the whole story. So you start off with one ([View Highlight](https://read.readwise.io/read/01ks19cgp8g5bdx3rzxaaj7szc)) - Note: The structural WordPress.org governance vulnerability: an expired plugin-author domain becomes the credential. Orphaned plugins are the attack surface. Worth raising with the plugin team / FAIR.pm. - Tags: attack-vector, wp-governance-gap, expired-domain, fair-pm-relevance, atom/literature/h1 - A hacker was able to register a domain and this domain happened to give them access to WordPress.org with access to like 100,000 active installs. >> Wow. Okay. So then they they could start to do nefarious things acting as the the original author because the original author left their domain expired because they weren't interested in maintaining a plugin. Who knows? Maybe they maybe it was an accident. I don't know the the whole story. So you start off with one ([View Highlight](https://read.readwise.io/read/01ks1a34c1esvg2s0c7qybz939)) - Note: The expired-domain attack vector: domain expires → hacker registers it → gains WordPress.org access via that domain → can act as the plugin author on ~100K active installs. This is the governance vulnerability worth raising with FAIR.pm and the WP plugin team. - Tags: action/h1, atom/literature/h1, fair-pm-relevant, wp-governance, expired-domain-vector - study I had cloud code study the existing uh uh back uh the existing back doors and update channels specifically the update channel like the update channel seems to be a hot ticket item for these hackers. They they try to slip in a self-updator into a WordPress.org or plugin, get it on hijack channel, and then after that, WordPress.org has zero visibility because they have no idea uh what's going on off off their site. So, ([View Highlight](https://read.readwise.io/read/01ks19cxkp9j7bxzrrnstw2b74)) - Note: The recurring attack pattern across all four documented investigations: hijacked update channel as the persistence mechanism. WordPress.org has zero visibility once a plugin's update channel is off-site. - Tags: wp-org-visibility-gap, persistence-mechanism, atom/literature/h1, update-channel-hijack - study I had cloud code study the existing uh uh back uh the existing back doors and update channels specifically the update channel like the update channel seems to be a hot ticket item for these hackers. They they try to slip in a self-updator into a WordPress.org or plugin, get it on hijack channel, and then after that, WordPress.org has zero visibility because they have no idea uh what's going on off off their site. So, ([View Highlight](https://read.readwise.io/read/01ks1a3gzrha9dftvn69d2jmm0)) - Note: The recurring attack pattern: slip a self-updater into a WordPress.org plugin → get it onto hijacked channel → WordPress.org has zero visibility after that. This is the structural flaw the plugin-team needs to address at the platform layer. - Tags: hijacked-update-channel, plugin-platform-vulnerability, atom/literature/h1, wp-governance - inspires other security folks to start looking at the raw data in a way that they haven't done before. So, the SVN um repository is public. Anyone can just start sifting through it and start finding stuff. And that's that's that's like the that's crazy to me that like me on a laptop that's on a $200 a month cloud code subscription. I can find anything. Like I that should not be possible. Like ([View Highlight](https://read.readwise.io/read/01ks19d9x5s8cya94dzfhn83mw)) - Note: The asymmetry insight — Austin's most quotable point. The WP.org SVN repo is public; a $200/month Claude Code subscription is enough to scan it. Puts solo developers on par with corporate security teams. - Tags: asymmetric-defense, ai-democratization, atom/literature/h1, svn-public-scan - inspires other security folks to start looking at the raw data in a way that they haven't done before. So, the SVN um repository is public. Anyone can just start sifting through it and start finding stuff. And that's that's that's like the that's crazy to me that like me on a laptop that's on a $200 a month cloud code subscription. I can find anything. Like I that should not be possible. Like ([View Highlight](https://read.readwise.io/read/01ks1a3y63s3xr6djzfrf11hbh)) - Note: The asymmetric-defense thesis: $200/month Claude Code subscription on a laptop now matches the capability of a corporate security team. The WordPress.org SVN repo is public; anyone can scan it. This democratizes security research for solo developers and WPCC-class community advocates. - Tags: claude-code, asymmetric-defense, ai-democratization, atom/zettel/z1