Latest / Wpfavs - Your favourite WordPress news / WordPress Security Realities and the Rise of AI Agents

Transcript

WordPress Security Realities and the Rise of AI Agents · Wpfavs - Your favourite WordPress news

• 0:13
  Welcome to Wpfavs, your favourite WordPress news.
• 0:16
  Today's pain point is simple.
• 0:18
  GuardingWP published its first State of WordPress Security 2026 report,
• 0:23
  and the headline number is that 52.8 percent of scanned sites were running at least
• 0:28
  one plugin with a known vulnerability at scan time.
• 0:31
  More than half.
• 0:32
  And that's the number I can't stop thinking about, because the same week those
• 0:36
  numbers landed, we're all excited about AI agents that can touch the server.
• 0:40
  Novamira CLI now lets a terminal coding agent like Claude Code,
• 0:45
  Codex CLI or Gemini CLI run commands against a WordPress site.
• 0:50
  Angie from the Elementor team has a Super Admin Mode that can read and write the
• 0:54
  file system, query the database, execute PHP, and do what you'd normally need WP CLI
• 1:01
  for.
• 1:01
  That's powerful.
• 1:02
  I'm excited about it.
• 1:03
  But it lands on a foundation that looks shaky.
• 1:06
  I'll push on that a little, Ido.
• 1:07
  The report doesn't say those agent tools are the problem.
• 1:10
  It says the basics are neglected.
• 1:12
  55.9 percent of sites leak their WordPress version through the generator meta tag.
• 1:17
  93.2 percent are missing at least one modern security header,
• 1:21
  and the report names HSTS, CSP and X Frame Options.
• 1:26
  The line that stuck with me is, defaults from a 2015 web are still the default in
• 1:31
  2026.
• 1:32
  Right, and let's separate fact from interpretation.
• 1:35
  The fact is those percentages.
• 1:37
  My interpretation is that the leaked version and missing headers aren't a breach on
• 1:41
  their own.
• 1:42
  They're a signal of how much attention a site gets.
• 1:45
  When it comes to security, a site that never had a header review probably never had
• 1:49
  an update review either.
• 1:51
  I'd go further.
• 1:52
  If I were an attacker, or an attacker's script, a leaked version number is a free
• 1:57
  hint.
• 1:58
  It tells me where to start.
• 2:00
  Hiding it won't save you, but leaving it out in the open tells me nobody's looking
• 2:03
  after the place.
• 2:04
  Hold on, though.
• 2:05
  Is that fair to agencies?
• 2:06
  A version tag takes one line to remove, sure, but headers like CSP can break a site
• 2:11
  if you rush them.
• 2:12
  Maybe that's why 93.2 percent haven't touched them.
• 2:15
  That's a fair point, and it's an explanation, not something the report states.
• 2:20
  Still, I'd call it a reason, not an excuse.
• 2:23
  You can roll out headers gradually, test them, and in just a few clicks in many
• 2:28
  hosting panels you can set the simple ones.
• 2:31
  The hard ones need a plan.
• 2:33
  The problem is that most agencies don't have a line item for it.
• 2:36
  And then core reminds us what's at stake.
• 2:39
  WordPress 7.0.2 shipped as an update everyone should install immediately.
• 2:43
  It addressed a REST API batch route confusion and SQL injection that could lead to
• 2:49
  remote code execution, reported by Adam Kues at Assetnote and Searchlight Cyber.
• 2:54
  There was also a related SQL injection issue reported by TF1T,
• 2:58
  dtro and haongo.
• 3:00
  If you're one of the 52.8 percent, or you're just late patching core,
• 3:04
  that's the week you find out.
• 3:06
  So here's my sharper version of the question.
• 3:08
  Are we over indexing on the shiny agent layer and under investing in the boring
• 3:12
  layer?
• 3:13
  Because an agent with PHP execution on an unpatched site is a very short story.
• 3:18
  I'd answer that carefully.
• 3:20
  The agent tools aren't the villain.
• 3:22
  Novamira describes itself as free and open source, and the Ahentic AI preview from
• 3:27
  Benjamin Intal runs on just WordPress and its new APIs, with no external servers or
• 3:32
  MCPs.
• 3:34
  Fewer moving parts is a security story I like.
• 3:37
  But the more power you hand an agent, the more the surrounding hygiene matters.
• 3:41
  Patch first, then give it the keys.
• 3:43
  I'd say the order is the whole point.
• 3:45
  Audit your plugins, fix the headers, hide the version, update core,
• 3:49
  and then experiment with agents on a staging site.
• 3:52
  If you do it the other way around, you're building a faster car on a cracked road.
• 3:55
  Now the second half, because plugin risk isn't just about patching.
• 3:59
  It's about who's actually maintaining the thing.
• 4:01
  Envato announced that from July 1, 2026 it moves to a flat 50 percent author fee and
• 4:07
  ends the exclusive author model, where selected authors paid a lower fee.
• 4:11
  Vova said going independent is inevitable.
• 4:13
  Xaver said the marketplace model feels dated.
• 4:16
  Lawrence Ladomery asked if it's time to sell direct.
• 4:19
  My take is that this changes the economics of maintenance.
• 4:22
  Fewer margins means authors ask whether the marketplace is worth it.
• 4:26
  If they go independent, they own support, updates, licensing and billing.
• 4:32
  That's more work, but also a direct relationship with customers.
• 4:36
  Done well, that's a game-changer for quality.
• 4:38
  Or it makes things worse, Nick.
• 4:40
  Think about the abandonment data.
• 4:42
  A report from WP Goldmine looked at 57,383 plugins in the WordPress.org directory.
• 4:49
  In the 10K to 100K active install band, 24 percent haven't been updated in over two
• 4:54
  years.
• 4:55
  That's 1,209 plugins with real users and no maintainer.
• 5:00
  If more creators pull away from marketplaces and some quietly stop,
• 5:04
  that pile could grow.
• 5:06
  That part is my speculation, not something the data says.
• 5:09
  Fair, but a marketplace never guaranteed maintenance either.
• 5:13
  Those abandoned plugins sit in the official directory, not Envato.
• 5:18
  Independent sellers at least have revenue tied to keeping customers happy.
• 5:22
  If nobody pays you, you stop updating.
• 5:24
  If people pay you directly, you have a reason to patch.
• 5:27
  Then there's the branding side.
• 5:29
  Liquid Web retired the StellarWP umbrella and moved all those products under its own
• 5:35
  name.
• 5:36
  Some plugins keep their names, others are rebranded or merged into other plugins.
• 5:40
  Trust is the real question.
• 5:42
  Does a conglomerate name make me trust a plugin more, or less?
• 5:45
  Honestly, it depends on who maintains it behind the logo.
• 5:48
  A big company can fund security reviews.
• 5:51
  It can also merge a plugin into another and leave you with a migration headache.
• 5:55
  The name changes, but the question stays the same.
• 5:58
  Who answers when something breaks?
• 6:00
  So my checklist is practical.
• 6:02
  Before you install, check when the plugin was last updated,
• 6:06
  who owns it now, and how they handle security reports.
• 6:10
  After you install, track it.
• 6:12
  Streamline your process with a plugin list, an update schedule and a staging test.
• 6:17
  And my closing thought is that AI makes this more urgent, not less.
• 6:22
  Agents can install plugins, edit files and run PHP.
• 6:26
  If we want that future, the unglamorous work of patching, headers and maintainer
• 6:31
  trust has to come first.
• 6:33
  Otherwise the 52.8 percent number just gets more expensive.
• 6:38
  Agreed.
• 6:38
  Fix the boring things this week.
• 6:40
  It's the cheapest security upgrade you'll make all year.