Plugin Security Will Sink WordPress  🔗 **Source:** [Plugin Security Will Sink WordPress](https://justinferriman.com/plugin-security-will-sink-wordpress) > [!note]+ Document Notes > --- > tags: [wordpress-security, plugin-ecosystem, platform-risk, ai-threats, wordpress-governance] > author: Justin Ferriman > source: justinferriman.com > reference: https://justinferriman.com/plugin-security-will-sink-wordpress > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > --- > # 🏷️ Title: Plugin Security Will Sink WordPress > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [🗒️ Notes](#️-notes) > - [📚 References](#-references) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > ### 🔗 References > - Roger Montti's Search Engine Journal piece on WordPress 7.0 AI API keys (the stated inspiration). > - Patchstack vulnerability exploitation data (cited via SEJ). > - Emdash, SimplyStatic Studio, and Loveable as named alternatives or comparison points. > ## 📝 Summary > - A former WordPress product founder (LearnDash) argues that plugin-driven security problems, supercharged by AI-era attacks, threaten WordPress's survival. > - It matters because the author frames plugin insecurity not as a technical nuisance but as a business and market-share threat — the ecosystem's greatest strength turned into its biggest liability. > - Key stakeholders: WordPress leadership (Matt Mullenweg by name), plugin developers, hosts, the .org plugin repo team, security vendors (Patchstack), and competitors (Emdash, Loveable, static-site tooling). > - Risks and tradeoffs: the author admits he's not a developer, so the piece asserts the threat and a leadership gap without proposing technical solutions; his suggested fix (AI-hardened repo review) he concedes may be too costly. > - Bottom line: WordPress is at an "inflection point." Without real leadership on plugin security in the AI era, the author predicts continued market-share loss — and he's personally moving simple sites to static and AI-native hosts. > ## 📖 Main Content > - The core argument is a business case, not a code case. The author repeatedly disclaims technical expertise ("I'm not a developer") and positions himself as someone who recognizes "business threats and opportunities." > - Premise 1 — plugins are WordPress's chronic security weak point. Even his own company (LearnDash) had "security scares." No plugin is immune. > - Premise 2 — historically the community handled this well, with "reasonable speed and minimal negative outcomes." That's the load-bearing concession: the system *worked* until now. > - Premise 3 — AI changes the threat model. He cites the SEJ article (Roger Montti) and Patchstack's claim that high-impact vulnerability exploitation now takes "just five hours." AI lets attacks "adapt, optimize, and move forward" beyond old automated scripts. WordPress 7.0's AI API keys add a fresh attack surface. > - Premise 4 — the response is inadequate. He sees the issue still "punted to hosts and plugin devs" and the project treating it as "business as usual." He wants "real leadership," "think tanks resulting in coded solutions," and floats tightening repo listing criteria with AI-based code verification (while conceding cost). > - Conclusion — without change, WordPress keeps losing market share and its "insecure site" reputation worsens. He nods to competitors (Emdash) for at least trying, and to his own migration to SimplyStatic Studio and Loveable. > - Contested/uncertain claims: the "five hours" figure is second-hand (SEJ → Patchstack); the market-share causation is asserted, not evidenced; "business as usual" is the author's perception ("from my perspective"). He hedges throughout ("I'm not sure," "maybe they are already"). > - Terms to define: *Patchstack* (a WordPress vulnerability database/security vendor); *the repo* (the WordPress.org plugin directory); *static site* (pre-rendered HTML with no server-side execution, shrinking the attack surface); *Loveable* (an AI app-building/hosting tool); *Emdash* (a competing platform that publicly criticized WordPress). > ### 🗒️ Notes > - Opening hook reframes plugin security as the platform's "biggest 'black eye'" and potential "downfall." > - Author credibility move: five years out of the WordPress product space, ex-LearnDash, so he speaks as an operator who lived the security pain, not a current insider. > - The historical-competence concession is genuinely important — he's not claiming WordPress was always broken, he's claiming the AI era breaks a previously-working model. > - "Five hours" exploitation window is the single hardest data point and it's twice-removed from source. > - The fix he most wants isn't a specific fix — it's *leadership and forums* ("these are the types of conversations I'd like to see happening"). > - Repo-gate proposal: assess listing criteria; AI hardening to "monitor and verify the code of any plugin submitted and hosted there." He immediately discounts feasibility on cost. > - Competitor framing is double-edged: he praises Emdash for trying while admitting their approach "isn't really the 'WordPress way'." > - Personal-exit signal: he "won't host another WordPress site in the traditional sense," preferring static (SimplyStatic Studio) or AI-native (Loveable). This is the lived-behavior evidence behind the market-share thesis. > - Closing is hedged-optimistic ("cautiously optimistic"), pins priority-setting on Matt, references the WP Engine lawsuit as a distraction risk, and promises a one-year revisit for "clear market signals." > ## 📚 References > - [Justin Ferriman — Plugin Security Will Sink WordPress](https://justinferriman.com/plugin-security-will-sink-wordpress) > - [Search Engine Journal — Roger Montti (WordPress 7.0 AI API keys, stated inspiration)](https://www.searchenginejournal.com/) > - [Patchstack (WordPress vulnerability intelligence, cited via SEJ)](https://patchstack.com/) > - [Simply Static / SimplyStatic Studio](https://simplystatic.com/) > - [Lovable (AI app builder, "Loveable" in source)](https://lovable.dev/) > ## 🗣️ Paraphrase > - WordPress's longstanding plugin-security problem used to be manageable because the community patched fast — but AI-driven attacks (faster, smarter, and aimed at new surfaces like 7.0's AI API keys) break that old equilibrium, and treating it as "business as usual" will cost the project market share. > - The author, openly a non-developer, can't prescribe the technical fix; what he wants is leadership that funds real solutions (even AI-assisted repo code review) instead of punting to hosts and plugin devs — and absent that, he's personally migrating to static and AI-native hosting. > ## 📰 Newsletter > - Heads up, WordPress folks: ex-LearnDash founder Justin Ferriman dropped a sharp opinion piece arguing plugin security — our beloved ecosystem's superpower — could become the thing that sinks the ship in the AI era. > - His worry isn't theoretical: he points to Patchstack data (via Search Engine Journal) suggesting high-impact vulns now get exploited in roughly five hours, and to WordPress 7.0's new AI API keys as fresh bait. > - He's refreshingly honest that he's not a dev and can't hand you the patch — his ask is *leadership*: real working groups and coded mitigations, maybe even AI-assisted code review for the plugin repo, instead of forever punting to hosts and plugin authors. > - Worth a read if you sit anywhere near plugin review, hosting defaults, or .org security policy. Pair it with Patchstack's annual state-of-WordPress-security report for the hard numbers behind his vibe-check. > - Community angle: he's quietly voting with his feet (SimplyStatic Studio, Lovable) — a useful signal for anyone tracking why builders drift off the platform. > ## ✅ Action Items > #### DevRel > - Developer advocacy: publish a clear, current "what WordPress is actually doing on plugin security in the AI era" explainer to counter the "business as usual" The biggest “black eye” in WordPress will be its downfall if things don't change.  Let's get the obvious out of the way: I'm not a developer. So, if you're looking for technical solutions in this post, then my apologies in advance. Okay, cool, we're on the same page. I've been out of the WordPress product space for coming up on five years. There are parts of it that I miss, but one thing that I don't miss is the security issues caused by plugins. No plugin is immune to them, either. When I ran LearnDash, we had some security scares. It sucks for everyone. The good news, for years, is that plugin providers have always handled these issues with reasonable speed and minimal negative outcomes. Not all, but most. The community was really proactive about staying on top of such things. I'm not sure if this is as feasible in the AI era of today. Roger Montti from Search Engine Journal [wrote a thought-provoking article](https://www.searchenginejournal.com/wordpress-7-0-faces-security-concerns-over-ai-api-keys/575679/) (and inspiration for this post) related to WordPress 7.0's AI API keys and the rush it will cause for attacks on vulnerable sites. I agree with the threats outlined. It's a very real possibility. At this point it looks like the WordPress space is just treating it as “business as usual”. It's this approach that will ultimately lead to WordPress losing even more market share. AI is fundamentally changing the speed, scale, and sophistication of attacks against WordPress sites. Instead of automated scripts, AI can adapt, optimize, and move forward with attacks in ways that we haven't seen before. By way of example, Patchstack (cited from the SEJ article) suggested that exploitation from high-impact WordPress vulnerabilities is just five hours now. [WordPress already suffers from the “insecure site” reputation](https://dev.to/cifi/43-wordpress-security-data-points-that-should-change-how-you-build-sites-in-2026-fjl). If things continue as they are, it'll only get worse. A lot worse. #### What Should We Do? Remember how I said I'm not a developer? Okay, this is where that matters. I'm not good at providing technical paths forward, but I'm pretty good at recognizing business threats and opportunities. This threat has always existed in WordPress, sure, but not like this. It's going to get worse if nothing is done to improve it. What I want to know is *what is being done* currently? Because from my perspective, it looks like the issue still gets punted to hosts and plugin devs. I'd love to see real leadership in this area. Not just information sharing or “best practices”, but actual think tanks resulting in coded solutions that drastically help mitigate this increasingly embarrassing issue. We could start by assessing the criteria for being listed on the repo. Could we implement AI security hardening to monitor and verify the code of any plugin submitted and hosted there? Yeah, I get it, that's likely not feasible given how expensive it would be, but these are the types of conversations that I'd like to see happening. Maybe they are already, and if so, great! WordPress can't drag its feet here. ##### Learning from Others Say what you want about Emdash, but at least they are attempting to tackle the issue because they know how real it is. [Their way forward](https://emdashcmseverything.com/docs/how-emdash-plugins-work-sandboxed-capabilities/) isn't really the “WordPress way”, I get that. Though I think we do WordPress a disservice by just flippantly dismissing their technical approach and moving on with our heads in the sand. Something I found interesting was reading the comments on their social media when they came after WordPress. The sentiments were largely the same, and leading the way was the growing downside of the plugin ecosystem. What is often cited as WordPress' greatest strength is being seen as its most glaring weakness. #### The Inflection Point The WordPress project is at an inflection point. Over the next year, it is critical that it move deep into AI adoption and enablement, and that includes bolstering things from a security standpoint. For me, I won't host another WordPress site in the traditional sense. Why? Because I'm not trying to be a security pro with my simple websites. No time for that nonsense. I like the static options like [SimplyStatic Studio](https://simplystatic.com/simply-static-studio/) (I transitioned a website to it and love it). Aside from that though, I actually see more benefit in just using something like [Loveable](https://loveable.dev) and hosting everything there for the added AI features. ##### Progress is Being Made The good news is that WordPress is making strides with AI. It's not yet widely known or advertised, but things like Jamie mentioned below are precisely what the project needs.  Let's hope that things keep going in this direction, and that more [emphasis on security](https://wordpress.org/news/category/security/) starts to emerge. To date, it's not very user friendly, at least not compared to tools like Loveable. I anticipate that this will change over time. #### Cautiously Optimistic Overall, I'm optimistic about WordPress evolving in the ways that matter. The community voices are loud and clear. It's up to Matt to set the priorities. Hopefully, he's not too distracted with [his WPEngine lawsuit](https://justinferriman.com/matt-vs-wp-engine-too-far) to do what is right (and needed) for WordPress as a whole. I'll revisit this in a year to see where things have landed. By that time, I think there will be some clear market signals one way or another. [#WordPress](https://justinferriman.com/tag:WordPress), Plugin Security Will Sink WordPress, justinferriman.com, 01kw1y8ey7eapwqr314tps3nc8.