Latest / Wpfavs - Your favourite WordPress news / Who Will Fund WordPress Security?

Transcript

Who Will Fund WordPress Security? · Wpfavs - Your favourite WordPress news

• 0:13
  Welcome to WPfavs.
• 0:14
  This is the roundup for October 12 to 15, 2026, and the lead story is about money.
• 0:20
  Mary Hubbard, the WordPress Executive Director, has formally asked more than 30 of
• 0:25
  the ecosystem's largest commercial companies to help fund the WordPress Security
• 0:29
  Program.
• 0:30
  Rae Morey at The Repository reported it.
• 0:33
  On the hosting side, the list includes GoDaddy, Newfold Digital,
• 0:37
  and Hostinger.
• 0:39
  On the product side, Elementor, Awesome Motive, Incsub from WPMU DEV,
• 0:44
  Rocketgenius, the Gravity Forms company, Rank Math, Brainstorm Force,
• 0:49
  and Extendify.
• 0:50
  Quick disclosure, I work at Elementor, so I'm on the inside of one name on that
• 0:55
  list.
• 0:56
  What I find interesting is the timing.
• 0:57
  This comes right after the emergency WordPress 7.1.3 release,
• 1:02
  which patched seven security vulnerabilities.
• 1:05
  The ask lands while everyone is still thinking about patching.
• 1:08
  And the data explains why the ask is aimed at commercial companies.
• 1:11
  Patchstack's 2026 report says 11,334 vulnerabilities were recorded in 2025,
• 1:18
  up 42% year on year.
• 1:20
  Around 91 to 92% of them sit in plugins, and core had only two.
• 1:24
  The median time from disclosure to mass exploitation was five hours.
• 1:28
  That's Patchstack's number.
• 1:29
  My reading is that core isn't where the risk lives, so a security program funded by
• 1:34
  the plugin and hosting businesses at least points at the right place.
• 1:37
  I'm encouraged, but I'm also practical about it.
• 1:40
  The open gaps matter.
• 1:42
  We don't know what financial structure these contributions would have,
• 1:45
  we don't know whether contributing companies get any governance influence,
• 1:49
  and we don't know how many will actually commit.
• 1:51
  Until those answers exist, it's a request, not a funded program.
• 1:56
  Right, and the governance question is the one people will argue about.
• 2:01
  If you pay, do you get a say?
• 2:02
  Nobody has said.
• 2:03
  I'd rather hear that answer early than discover it later.
• 2:07
  Now the volume problem, which makes the security story harder.
• 2:10
  Jean Galea counted 14,608 new plugins listed on WordPress.org since January 2026.
• 2:16
  That's more than 2024 and 2025 combined, from 10,532 distinct authors.
• 2:22
  And eight in ten have fewer than ten active installs.
• 2:25
  The source describes that as a flood of unverified AI generated micro utilities.
• 2:30
  Patchstack's report had already flagged vibe coding as a trend,
• 2:33
  so the pieces fit together, but the link is an interpretation.
• 2:36
  The Rivale Diff September report adds a twist.
• 2:39
  Of the top 12,500 plugins, 4,575 haven't shipped an update since September 2025.
• 2:47
  Yet 3,928 of those untouched plugins saw their daily download rate go up in
• 2:52
  September compared to August.
• 2:54
  So downloads are not a health signal.
• 2:56
  When it comes to vetting plugins, check the last update date,
• 3:00
  not the install graph.
• 3:02
  Meanwhile 110 of that top group now carry the AI tag, update far more often,
• 3:08
  and declare WordPress 7.1.x compatibility.
• 3:11
  One more data point for agencies.
• 3:13
  NorthDuty audited 100 live WooCommerce stores showcased in agency portfolios.
• 3:19
  Five had reproducible public Store API or TLS defects, and ten more had dead
• 3:24
  navigation, footer, cart, or product links on production client sites.
• 3:28
  Those are the sites agencies show off.
• 3:31
  I'd run a link check before I'd run a pitch.
• 3:33
  Now the AI side, and this is a direct follow up to our earlier episode,
• 3:37
  the one where we debated isolated core APIs against deep server agents like
• 3:42
  Novamira.
• 3:43
  This week the WordPress Core AI team officially released the MCP Adapter as a
• 3:48
  canonical plugin in the WordPress.org directory.
• 3:52
  It sets the default Model Context Protocol server architecture for WordPress sites,
• 3:57
  so developers can build standardized MCP servers for plugins and core data.
• 4:02
  That's the standardized path, instead of everyone shipping their own fragment.
• 4:07
  And for my corner, AI Plugin 1.4.0 introduced an experimental Markdown Feeds
• 4:12
  feature.
• 4:13
  It serves clean Markdown copies of your content alongside the usual HTML and RSS,
• 4:18
  so language models can read it easily.
• 4:20
  The word to underline is experimental, but the direction is clear.
• 4:24
  Sites are starting to publish for machines on purpose.
• 4:27
  Two more launches worth knowing.
• 4:29
  Matt Mullenweg and Automattic soft launched Spacefast, billed as a home for what
• 4:33
  your agent makes, on WP dot cloud.
• 4:37
  It handles database, auth, uploads, email, and spam protection,
• 4:42
  without making people think in WordPress terms.
• 4:44
  And Riad Benguella at Automattic released Liberate dot sh, a tool that converts Wix,
• 4:50
  Squarespace, Shopify, and Webflow sites into WordPress using local AI agents.
• 4:56
  On business, Andrew Allemann reported that Automattic applied for 16 top level
• 5:01
  domains, including dot matt, dot woo, dot make, and dot wordpress.
• 5:07
  Former ICANN and trademark attorney Kellie Peterson noted the friction.
• 5:11
  The WordPress Foundation, not Automattic, owns the registered WordPress trademark,
• 5:16
  which raises governance questions for a brand domain.
• 5:18
  Community notes.
• 5:19
  Awesome Motive has taken over maintenance of WP Crontrol, a utility many of us rely
• 5:24
  on.
• 5:25
  Themeum sunset Qubely in October 2023 with a three year maintenance commitment that
• 5:30
  expires this month, and Tiger12 LLC released Roobely, a maintained GPL fork with 29
• 5:36
  free blocks.
• 5:37
  And WordPress 7.2 is slated for December 8, 2026, with the NO_BACKSLASH_ESCAPES SQL
• 5:43
  mode disabled by default, Dennis Snell's progress on rebuilding wp kses,
• 5:49
  and a proposed Secrets API.
• 5:51
  For the underrated tools segment, three.
• 5:53
  Ozan Dikici's Sitelemetry Audit plugin runs hosted site audits from the WordPress
• 5:58
  admin, covering security, technical SEO, AI visibility, accessibility,
• 6:02
  and performance.
• 6:03
  The TBC Community App from Two Birds Code wraps FluentCommunity into native iOS and
• 6:08
  Android apps under your own store accounts.
• 6:10
  And FlyWP can generate static HTML mirrors and deploy them to a remote CDN straight
• 6:15
  from WordPress.
• 6:16
  My pick is Sitelemetry, because one audit in one place saves a lot of tab switching.
• 6:22
  In just a few clicks you see where to start.
• 6:24
  Prediction for next week, and this is a guess, not reporting.
• 6:28
  With 30 companies asked and the detail still thin, I think we'll see at least a few
• 6:33
  publicly say they're in, and the governance questions get louder right after.