I currently work for a federal contractor including the DoD as their customer, using Wordpress as their main website. You would think there’s no sensitive information there, but some times all it takes is enough information about someone and their team to impersonate that person and gain access to an email thread, file sharing system or even an access card to a building. Never underestimate incompetence.

Bulk reply to all the people replying.

bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a browser or a mobile. Browsers and mobiles are the only things that are perennially useful to an intelligence agency. Those two are reliable access vectors for the vast majority of things that interest government organisations.

Remember the Panama papers? That was a Wordpress hack.

Compromising a crappy wordpress site means compromising mailbox credentials.

https://lolware.net/blog/2020-09-02-autodiscover-circus/

Surprising amount of gov use WP as a CMS on their websites. So it's not that far off.

There’s a server running behind a Wordpress site. If you have RCE, you can run whatever arbitrary code you like there - mine crypto, run a botnet, all sorts of fun and profitable stuff. Hey, you can even make the site make the site’s users your unwitting hosts, too. You don’t go hack a Wordpress site, you go grab a few hundred thousand of them and do industrial scale crimes.

>There's absolutely nothing of value on any Word Press site.

I would hope not, but I’d be surprised if that were true across the millions(?) of Wordpress sites?

> There's absolutely nothing of value on any Word Press site

This is just 100% an incorrect assumption. Even just an e-commerce site running Woo has troves of potentially valuable customer data. Not to mention whatever else might be on the server, or what that server is connected to...

Is there anywhere currently buying that you can approach without a pre-existing relationship?

Of course it is. It just no longer exists.

Why would you reply with something completely unsubstantiated that anyone in security at that time worth their salt would be able to call you out on and then in subsequent comments call people liars for insisting it did, in fact, exist?

I’m just baffled.

Because if they don't other people will hear they don't pay and won't sell them 0days

I can't answer that, did you have something you'd like to sell?

I actually found a 1999 iMac set out for a special rubbish pick up day. The owner of the house was there so I chatted a bit, asked her if she minded if I took it.

It had last been booted on it, complete with working hard drive an; MacOS X 10.3. So $1.299 -> $0.

Even just introducing emulation layers for the old parts and making the new parts opt-in would be better than just giving up and keep on going. Plugin authors can choose the new subsystem as they publish updates or new plugins and themes, and in return they get speed and security guarantees.

And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.

they broke tons of stuff with Gutenberg/block editor and didn't seem to be bothered by backwards compat

If the existing at-risk functionality is a security issue I feel like that’s a good time to throw the proverbial flag on the play and make it an issue. Letting consumers play host to malware and phishing portals is the worse move.

This isn’t some problem that has developed over time. It was shit from day one.

Vogon Poetry [1]?

[1] https://hitchhikers.fandom.com/wiki/Vogon_poetry

If code is poetry, WordPress was written by William McGonagall <https://en.wikipedia.org/wiki/William_McGonagall>.

They could just go a bit more honest and migrate to "Code is pasta". WP is also closer to a pizza slice than Michelin star fine dining experience.

They never said it was good poetry

Ask an old English teacher whether "poetry" implies anything favorable about quality.

php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).

I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.

I never really understood these complaints about the standard library, that's not what makes a language really. Yes, it's ugly, yes, it carries 30 years of baggage, but it's PHP the language that allows you to interact with a much more convenient abstraction layer provided by Laravel.

PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements. It has runtime reflection APIs that are so cheap that you don't really have to think about using them. You can do OOP or FP with PHP, or even procedural HTML-interleaved-with-PHP if that's your thing. It has late static binding, so you can defer to child classes from their parent class. There are generators and fibres as first-class language constructs now. Property hooks are an extremely clear pattern, way better than in many other languages.

Generally, there have been tons of new syntax extensions over the years, and they all slot in gracefully. With PHP 8.6, we're going to get partial application for functions, which will make PHP 8.5's match expressions one of the most ergonomic implementations I have seen yet!

Ecosystem? The JS/TS ecosystem approach is to use as many libraries as possible for the sake of it, exposing you to a massive supply chain risk. PHP doesn't suffer from that because there are barely any libraries for it.

Yeah; the common idea of dignity and self-respect is to replace the duct tape with proper engineering once you're successful though, instead of just taping ever more of it on top and pretending SQL injections aren't really a problem.

I think PHP came right at the time that every man and his dog was a "web developer" and writing absolute unknowledgable stuff. And PHP allowed for it.

ASP had a bit of a barrier to entry because it required all the MS. Whereas PHP was everywhere.

Let me convince you! :-)

There are match expressions and arrow functions:

  $slug = $title
      |> trim(...)
      |> (fn($str) => str_replace(' ', '-', $str))
      |> (fn($str) => str_replace('.', '', $str))
      |> strtolower(...);

  final class PostsController
  {
      #[AccessControl(fn(Request $request, Post $post)
          => $request->user === $post->getAuthor()
      )]
      public function update(Request $request, Post $post): Response {
          // ...
      }
  }

  enum Status
  {
      case Draft;
      case Published;
      case Archived;
  }

  class Data
  {
      public string $fullName {
          get => "{$this->firstName} {$this->lastName}";
          set(string $value) {
              [$first, $last] = explode(' ', $value);
              $this->firstName = $first;
              $this->lastName = $last;
          }
      }
  }

> Nope.

Beauty is in the eye of the beholder, and I'll disagree kindly with you on that "Nope".

One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.

That could as well just be a complete new product then, right?

It would definitely be a breaking change and unmigratable.

A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/

Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.

Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.

Who is they? automaticc?

It went from a blog, to an entire CMS. Which is bonkers

Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always

They do: https://portal.anthropic.com/programs/cvp

There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.

I think anyone willing to pay $500k is well aware that LLMs can be used to find vulnerabilities.

[citation needed]