-
·
With Abilities, the last filter decides who gets in
Abilities don’t give a plugin one new attack surface. They give it several, and some belong to other plugins. Which doors are left open depends on whichever filter runs last.
-
·
In WordPress 7.1, a “public” ability is not a permitted one
WordPress 7.1 added a public flag to the Abilities API. It determines whether an ability can be seen and reached externally, not whether a caller is allowed to run it.
-
·
I didn’t build a 2FA plugin. I filed bugs, then built around the best one.
WordPress’s canonical Two Factor plugin is a solid workhorse with a minimalist design. It has no policy and onboarding features, so when I needed those, instead of writing yet another 2FA plugin, I got more involved with Two Factor and created my own add-ons.
-
·
WordPress security backports: quiet by design
Since WordPress 3.7, security fixes for older branches have been delivered quietly and automatically. The historical record explains the approach — and why a manual patch option could help keep older sites secure and moving forward.
-
·
What I’d do differently next time: studying WordPress patch uptake
Reflecting on October’s WordPress patch uptake study, here’s what I’ll change if I do it again with a bigger sample: the timing, the sample (multiple bands), the backport-versus-upgrade counts, and the aggregated data that’s retained.
-
·
Sudo’s tests agreed with Sudo. WordPress didn’t.
Sudo passed 1,663 tests while missing seven ways to bypass its reauthentication prompt. Its code and tests shared the same mistaken model of WordPress requests. The lesson: check the assumptions against core, use independent review, and prove that tests fail when the guard is removed.
-
·
Who actually gets WordPress security backports?
Today, WordPress sends new security patches all the way back to the 4.7 branch, and they install by default unless blocked. Ten hours after 7.1.3 shipped on October 6, 93% of sampled 7.1 sites had the latest patch or the one before it. Nine days later, most of the sites furthest behind still hadn’t moved.
-
·
Why I retired my own security plugin
Sudo was a plugin that asked WordPress administrators for their password before they did something dangerous. An AI audit found seven ways around it with an active admin session. That points to a fundamental architectural problem that only WordPress core can address.
-
·
Is your old WordPress site still getting security updates?
If you stay on an older WordPress release line, check how security backports reach it and whether your site’s settings allow automatic installation. Here’s how to check your update policy and find the nearest patched version.
If you don't visit the bad neighbourhoods, the bad neighbourhoods will visit you.
Security
Vulnerabilities, exposure, mitigation, remediation, and hardening. Findings from real life when possible.