Tweets From Sybre Waaijer ![rw-book-cover](https://pbs.twimg.com/profile_images/1014545305763811328/WTnirxl7.jpg) ## Metadata - Author: [[@SybreWaaijer on Twitter]] - Full Title: Tweets From Sybre Waaijer - Category: #tweets - URL: https://twitter.com/SybreWaaijer ## Document Notes ## Highlights - Fun fact: WooCommerce collects your sensitive information without asking for consent. Luckily, it merely consists of about 1000 data points. Let's dive into it... 🧵 Disclosure: I'm a WooCommerce Marketplace partner. https://t.co/EvUjAqmkqn ![](https://pbs.twimg.com/media/GgYKotOXoAAEgrW.png) ([View Tweet](https://twitter.com/SybreWaaijer/status/1875230654054752374)) - Joost's data (1, next tweet) proves the WordPress repository is a rigged game that funnels all visibility to the biggest plugins, leaving new, innovative ones to die. But instead of fixing the system that crushes innovation, his solution is to ask the winners, like himself, to ([View Tweet](https://twitter.com/SybreWaaijer/status/1931587478646882384)) ## New Highlights added 2026-04-18 at 10:22 PM - 100,000+ stores run this WooCommerce plugin. I doubt any of them know their payments are broken. Any store with $1M ARR could be missing $700k+ in revenue. If you run WooCommerce Subscriptions, check your store. Yesterday, I reported a bug to WooCommerce that silently broke ([View Tweet](https://x.com/SybreWaaijer/status/2045660722168758336)) ## New Highlights added 2026-08-10 at 10:50 AM - Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites. The file: wpforms-lite/src/SetupWizard/Bridge.php. What it does: It takes over your browser and opens their app on WPForms' servers. It hands https://t.co/tTrA8TuakU ![](https://pbs.twimg.com/media/HPTVttsWgAAoZgn.png) ([View Tweet](https://x.com/SybreWaaijer/status/2086528919394480389)) ## New Highlights added 2026-08-10 at 10:50 AM - Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites. The file: wpforms-lite/src/SetupWizard/Bridge.php. What it does: It takes over your browser and opens their app on WPForms' servers. It hands https://t.co/tTrA8TuakU ![](https://pbs.twimg.com/media/HPTVttsWgAAoZgn.png) ([View Tweet](https://x.com/SybreWaaijer/status/2086528919394480389)) ## New Highlights added 2026-08-11 at 9:01 AM - When WPForms had a real bug — arbitrary file access — I did responsible disclosure via official channels. It landed on WPScan (ID: faa56a23-66bc-4dd7-a5b0-81ea6365d75a). What WPForms added in 2.0.0 isn't a bug — it's deliberate design: mint a privileged token, auto-POST it to https://t.co/eQdU5rFYEy ![](https://pbs.twimg.com/media/HPbd5M1WsAAiokt.png) ![](https://pbs.twimg.com/media/HPbd9q6XwAAk_PP.png) ([View Tweet](https://x.com/SybreWaaijer/status/2087102845107519693)) ## New Highlights added 2026-08-28 at 7:03 PM - Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites. In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site. Last time, I classified something like this as a https://t.co/0TQjY6VFBv ![](https://pbs.twimg.com/media/HQ0vmLmXIAIlkhH.png) ([View Tweet](https://x.com/SybreWaaijer/status/2093382158349951136)) ## New Highlights added 2026-10-08 at 7:57 PM - They should consider their WPScan data before employing any of the listed plugin and product companies for triaging, validation, fixing, or coordinating security releases. Some of them don't follow proper etiquette. Researchers waste days only to be downplayed, without https://t.co/DTOuT8eorS ([View Tweet](https://x.com/SybreWaaijer/status/2108225402531459081))