The WordPress Drama Is a Security Risk - ThreatWire  🔗 **Source:** [The WordPress Drama Is a Security Risk - ThreatWire](https://www.youtube.com/watch?v=m8t76ToNRI0) > [!note]+ Document Notes > tags: > - #WordPress > - #SecurityRisks > - #FreeSoftware > Author: ThreatWire (Transcript) > Source: YouTube (ThreatWire by Shannon Morse) > Reference: [Link](https://www.youtube.com/watch?v=m8t76ToNRI0) > date created: 2024-10-17 18:30 > > # Title: The WordPress Drama is a Security Risk - ThreatWire > <!-- deep-read:sections start --> ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: The video discusses the escalating conflict between WordPress hosting companies Automattic (owner of WordPress.com) and WP Engine. The situation poses serious security concerns as WP Engine has been blocked from accessing critical plugin updates from the WordPress.org directory, potentially leaving WP Engine-hosted websites vulnerable to attacks. The tension arises from disputes over legal and financial issues, which have led to plugin takeovers, litigation, and governance struggles. Additionally, recent security vulnerabilities and data breaches affecting other platforms like Zendesk and Internet Archive are also highlighted. ## 📖 Main Content: This section explores the growing friction between Automattic (which controls much of the WordPress ecosystem) and WP Engine, one of its largest competitors in the hosting space. The conflict escalated when Automattic’s CEO Matt Mullenweg blocked WP Engine from the plugin directory, citing security concerns. This has raised fears of potential vulnerabilities for WP Engine customers, as critical updates to popular plugins like Advanced Custom Fields are no longer accessible via WordPress.org. The report also touches on broader security threats, including vulnerabilities in platforms like Zendesk and a breach at the Internet Archive. ### 🗒️ Notes: - **Key Players**: - **Automattic**: Company behind WordPress.com, led by Matt Mullenweg, involved in hosting services and numerous plugins. - **WordPress.org**: The non-profit responsible for maintaining WordPress's open-source core and plugin ecosystem. - **WP Engine**: A major competitor of Automattic in the hosting space, recently locked out of the WordPress.org plugin directory. - **The Conflict**: - Automattic demanded a percentage of WP Engine’s profits, initially set at 8%, to continue using WordPress-related services and software. - Tensions escalated as Automattic imposed restrictions on WP Engine’s access to WordPress.org services, effectively locking them out of the plugin directory. - As a result, WP Engine-hosted sites were denied critical plugin updates, such as those for the Advanced Custom Fields (ACF) plugin, which they had acquired in 2022. - **Security Risks**: - The inability of WP Engine to access the WordPress.org plugin directory creates potential security vulnerabilities for its customers. - If WP Engine clients do not receive timely plugin updates, this could lead to widespread attacks, especially with widely used plugins like ACF. - Automattic’s unilateral takeover of ACF under WordPress.org’s plugin guidelines (invoking rule #18) allowed them to fork ACF into Secure Custom Fields (SCF), citing security concerns as justification. - **Impacts on the WordPress Ecosystem**: - **Plugin Ecosystem Fracturing**: Other plugin developers, such as SEO Framework, are beginning to distance themselves from WordPress.org due to concerns about control and governance. - **Security Implications**: The ongoing conflict poses significant security threats to WordPress users, especially those relying on WP Engine for hosting services. - **Business Consequences**: The WordPress ecosystem is heavily dependent on open collaboration, and fractures like this one risk damaging the broader community. Hostile takeovers and governance struggles could result in further fragmentation. - **Related Security Issues**: - **Zendesk Vulnerability**: A security researcher exploited email spoofing to access sensitive ticketing systems, potentially exposing company data through their support systems. - **Internet Archive Breach**: The Internet Archive suffered a breach resulting in the exposure of over 31 million user records, including usernames, passwords, and email addresses. This was followed by a DoS (Denial of Service) attack that took the site offline temporarily. - **Legal and Governance Considerations**: - The legal actions taken by Automattic against WP Engine, including the claim for a percentage of profits, raise questions about the future of governance in the WordPress ecosystem. Automattic’s control over key assets such as the plugin directory and the WordPress trademark gives them considerable power over competitors. - The takeover of plugins like ACF by Automattic also sets a precedent for how plugins might be managed in the future, especially if conflicts of interest arise between core contributors and third-party developers. - **Broader Industry Implications**: - The situation illustrates the growing pains of large open-source projects when intertwined with for-profit interests. Automattic’s dominance over WordPress.org resources raises concerns about the balance of power within open-source ecosystems. - Similar security risks and governance challenges could emerge in other platforms that depend heavily on community contributions and corporate sponsorship. - **Call to Action for Developers**: - Developers maintaining WordPress sites should be vigilant about plugin security, considering alternatives for plugin updates if their hosting provider is affected by this conflict. - The community should engage in broader discussions about governance, the role of corporate influence in open-source projects, and how security concerns are handled within decentralized ecosystems. ## 📖 References: - ThreatWire by Shannon Morse, “The WordPress Drama is a Security Risk,” YouTube, [Link](https://www.youtube.com/watch?v=m8t76ToNRI0) ## 🗣️ Paraphrase: 1. The conflict between Automattic and WP Engine escalated when Automattic, using its control over WordPress.org, blocked WP Engine’s access to the plugin directory. This created potential security vulnerabilities for WP Engine customers, as they could no longer receive critical updates. Automattic justified this move by citing security concerns, but it raised broader questions about governance and corporate influence in the open-source WordPress ecosystem. 2. The inability of WP Engine-hosted sites to access essential plugin updates through WordPress.org could lead to major security risks. The ongoing feud over profits and control has left users of popular plugins like Advanced Custom Fields vulnerable. Automattic’s takeover of the plugin to mitigate these risks highlights the power dynamics within the ecosystem. ## 📰 Newsletter: In our latest newsletter, we break down the escalating conflict between Automattic and WP Engine, which is causing security concerns for WordPress users. With WP Engine locked out of the WordPress.org plugin directory, customers face potential vulnerabilities from outdated plugins. We also dive into broader governance issues in the WordPress community and how this power struggle could affect developers and site owners. Check out the full report and stay informed on how to keep your site secure in these turbulent times. Plus, learn about new security measures and plugins to help safeguard your WordPress sites. [Read more](https://www.youtube.com/watch?v=m8t76ToNRI0) ## ✅ Action Items: This article aligns with my professional focus on open-source advocacy and WordPress governance. As a Developer Advocate and educator, understanding the governance issues highlighted in this report is crucial. The conflict between Automattic and WP Engine illustrates the tensions that can arise in open-source projects where corporate interests and community values collide. It also raises questions about transparency and security in the WordPress ecosystem—topics that are central to my role in supporting and engaging contributors. This case study will serve as a critical example in my efforts to advocate for sustainable, transparent, and inclusive governance models within open-source communities. ## 🧪 Hypotheses: 1. Open-source ecosystems with a high degree of corporate control are more prone to conflicts that compromise security. 2. Corporate influence in plugin governance can lead to fragmentation and decreased security for end-users. ### 📊 Methodology: - Conduct surveys to assess security risks in WordPress sites affected by the Automattic and WP Engine conflict. - Case studies on the impacts of corporate governance on plugin ecosystems. - Comparative analysis of plugin security vulnerabilities before and after corporate takeovers. ### ❓ Questions: - How can the WordPress community ensure fair governance while balancing corporate and community interests? - What security protocols should be implemented when plugin governance is under dispute? ### 🔮 Future Research: Further research is needed to explore the long-term effects of corporate involvement in open-source projects, particularly regarding security and governance. A study on how other open-source communities manage similar conflicts could provide insights into best practices for WordPress. ### 💡 Implications: Improved transparency in decision-making and governance processes could prevent conflicts like the one between Automattic and WP Engine. Enhancing security protocols and community involvement in plugin governance will likely reduce the risks associated with corporate control. Short Summary for [The WordPress Drama is a Security Risk - ThreatWire](https://www.youtube.com/watch?v=m8t76ToNRI0) by [Merlin](https://merlin.foyer.work/) Title: WordPress Security Risk Exposed: Automatic vs. WP Engine Drama Unfolds - ThreatWire Recap [00:06](https://www.youtube.com/watch?v=m8t76ToNRI0&t=6) WordPress in turmoil due to internal conflict. [01:35](https://www.youtube.com/watch?v=m8t76ToNRI0&t=95) WordPress Drama: Automatic trying to harm WP Engine [02:53](https://www.youtube.com/watch?v=m8t76ToNRI0&t=173) WordPress Security Drama and Plugin Vulnerability [04:12](https://www.youtube.com/watch?v=m8t76ToNRI0&t=252) WordPress.org can unilaterally take over a plugin for quality control. [05:29](https://www.youtube.com/watch?v=m8t76ToNRI0&t=329) Vulnerability in zenes support ticketing system led to access to company's slack instances [06:49](https://www.youtube.com/watch?v=m8t76ToNRI0&t=409) Security risk highlighted through Apple ID exploit [08:09](https://www.youtube.com/watch?v=m8t76ToNRI0&t=489) User data breached from IIA databases [09:29](https://www.youtube.com/watch?v=m8t76ToNRI0&t=569) WordPress drama impacts internet archive --------------------------------- Detailed Summary for [The WordPress Drama is a Security Risk - ThreatWire](https://www.youtube.com/watch?v=m8t76ToNRI0) by [Merlin](https://merlin.foyer.work/) Title: WordPress Security Risk Exposed: Automatic vs. WP Engine Drama Unfolds - ThreatWire Recap [00:06](https://www.youtube.com/watch?v=m8t76ToNRI0&t=6) WordPress in turmoil due to internal conflict. - Automatic and WP Engine are in a battle causing destructive decisions. - Key players include WordPress.org, wordpress.com, Automatic, and Matt Mullenweg. [01:35](https://www.youtube.com/watch?v=m8t76ToNRI0&t=95) WordPress Drama: Automatic trying to harm WP Engine - Matt is attacking WP Engine to extort payment - Automattic using legal tactics and trademark ownership against WP Engine [02:53](https://www.youtube.com/watch?v=m8t76ToNRI0&t=173) WordPress Security Drama and Plugin Vulnerability - WP Engine unable to update Advanced Custom Fields plugin led to security concerns. - WordPress.org team took unilateral action to fork Advanced Custom Fields plugin for security reasons. [04:12](https://www.youtube.com/watch?v=m8t76ToNRI0&t=252) WordPress.org can unilaterally take over a plugin for quality control. - Commercial upsells removed and security issues fixed in plugin directory guidelines. - Open-source vulnerabilities affecting plugin quality may lead to loss of support from creators. [05:29](https://www.youtube.com/watch?v=m8t76ToNRI0&t=329) Vulnerability in zenes support ticketing system led to access to company's slack instances - Email spoofing allowed anyone to be added to a zenes support ticket and access entire ticket history - Hacker Mev's finding led to recognition of the potential threat to zendesk and access to slack instances [06:49](https://www.youtube.com/watch?v=m8t76ToNRI0&t=409) Security risk highlighted through Apple ID exploit - Exploiting Apple ID creation process to gain unauthorized access to company systems - Hacker rewarded for exposing vulnerability, companies affected took action [08:09](https://www.youtube.com/watch?v=m8t76ToNRI0&t=489) User data breached from IIA databases - 6.4-gigabyte file contained email addresses, usernames, bcrypt hashed passwords, and internal data - Dos attack by group snore black meta took down internet archive services [09:29](https://www.youtube.com/watch?v=m8t76ToNRI0&t=569) WordPress drama impacts internet archive - JS Library scrubbing disabled - Internet archive in semi-fine state, will be back online soon <!-- deep-read:sections end --> 📄 **Full text:** ![[Full Document Contents/Articles/The WordPress Drama Is a Security Risk - ThreatWire|The WordPress Drama Is a Security Risk - ThreatWire, Hak5]] ## Highlights - WordPress is under attack by its own hands ([View Highlight](https://read.readwise.io/read/01jae3hqtha215gkxgdevsjbp5))