Open Source Changes, WordPress Vulnerabilities, and WordCampUS Community Conversations

Robert Jacobi:

Good day everyone, another Open Channels News. To prove how live we are, that is a weather warning that’s going on at Open Channels News headquarters. You’ll see that in the replays, but right now we’re very live. Severe thunderstorm warnings aren’t that bad, or watches. I think we’re in a warning or watch now, I don’t even recall. It’s only when we get to, uh, tornadoes that we actually start worrying and covering. Back to the actual programming.

Whoo, it’s been a crazy day. So welcome to OCN, the Open Channels News broadcast. I’m Robert Jacobi, your host. We lead today with WordPress security and the supply chain attack that demonstrates something we’ve been saying for a long time: keeping your plugins updated is important. But sometimes the plugin itself isn’t the problem.

WordPress supply chain attack bypasses the update process. According to reporting today from The Hacker News, cybersecurity researchers have uncovered a supply chain attack affecting 7 WordPress plugins, from BD Themes. And what makes this attack interesting is what the attackers did not change. They didn’t compromise the wp.org plugin repo. They didn’t ship a malicious plugin update. They didn’t need WordPress admins to install anything new. Instead, according to research from Wordfence cited by the Hacker News, attackers compromised a remote JSON data source used by the plugins.

Here’s how it works. The affected plugins contain a component used to display promotional banners inside WP admin. That component retrieves information from an external API with JSON files stored in a DigitalOcean Spaces bucket. Normally, that’s pretty boring infrastructure — fetch some data, display ad, move on, rinse, repeat. Except they discovered that the code processing that data contained a cross-site scripting vulnerability. Attackers apparently obtained write access to the vendor storage bucket and replaced legitimate JSON responses with malicious ones.

Now you have a very different situation. An administrator logs into WordPress, the plugin contacts what it believes is a trusted server, the server returns malicious data, and because of the vulnerability in the plugin, that data becomes executable JavaScript inside the actual admin’s browser. No plugin update required at all.

According to Wordfence, the malicious script could then create a rogue WordPress admin, install a fake plugin containing a PHP web shell, establish all the access it wants to the website. It could even hide the malicious administrator account from the normal WordPress user list. That’s a pretty complete compromise. Compromise? Yeah.

One of the affected plugins, Element Pack Addons for Elementor, has more than 100,000 active installs. The WordPress plugin team has temporarily closed the affected plugins while they undergo review.

But here’s why the story matters. Beyond these 7 plugins, we’ve spent years teaching WordPress users one very simple security rule: keep everything updated. And that’s still good, if not the best advice, but software doesn’t exist by itself anymore. This is the whole supply chain. Plugins connect to APIs, they retrieve licensing information, download templates, download ads, connect to CDNs, call a billion other cloud services, not including AI of course. They retrieve JSON. Every one of those connections expands the trust boundary or the surface area.

Think of it like locking your house. You can have a fantastic lock on the front door, but if you’ve given 7 other people keys, you now have to trust how every one of those people protects their specific key. That’s supply chain security. The plugin can be completely unchanged on the .org repo and still become part of an attack because something upstream has been compromised. In this case, the Hacker News reports that researchers believe the attackers obtained access to BD Themes cloud storage credentials or infrastructure.

And there’s another detail. The vulnerability itself received a CVSS security score of only 5.4, which is medium severity. Yet combine that vulnerability with compromised infrastructure and suddenly attackers can create admins and achieve remote code execution. That’s a good reminder that vulnerability scores don’t exist in a vacuum. A medium vulnerability combined with the right access can become a very big problem.

Security is an onion. The plugin is one layer, the API is another, the cloud infrastructure is another, the admin’s browser is another, and so on and so on. And attackers only need one path through.

And this story was reported by The Hacker News based on research from Wordfence.

And now, what 3,400 WordPress reviews say about building better products. From WordPress security to WordPress products, Matt Cromwell at Roots and Fruit analyzed more than 3,300 1-star and 5-star reviews from some of the most popular plugins on wp.org. And the results should probably make a few product managers uncomfortable, twitchy, something like that, because customers apparently don’t care nearly as much about your feature roadmap as you do.

Cromwell analyzed 1,500 1-star reviews and 1,800 5-star reviews. The number one reason people left a bad review? Reliability. 42% of the 1-star reviews were primarily about reliability problems. The plugin just didn’t work, an update broke something, the site became slower, or the plugin simply didn’t do what the customer expected it to do.

The second biggest complaint was monetization at 29%. But even there, the problem wasn’t necessarily that companies were charging money. That’s not an issue. Customers understand that software costs money. The problem was surprise. People install the free product, yay, they configure it, yay, yay, they invest their time, AAA, and only then do they discover that the thing they actually need requires an upgrade. That’s not really a pricing problem, that’s an expectations problem.

Now look at the 5-star reviews. The number one reason people loved a plugin was ease of use, 21%. Number 2, it just works, 20%, very close. And number 3 was great human support. Human at 17%.

Roots and Fruit continues, notice what’s missing from that list — features. In fact, missing features accounted for only about 2.5% of the 1-star reviews Cromwell analyzed. Dead last among the meaningful categories. We spend enormous amounts of time in tech talking about features. What’s on the roadmap? What’s shipping next quarter? What does our competitor have that we don’t? Customers are apparently asking something much, much simpler. Does it work? Can I figure it out? And if something goes wrong, will somebody at least help me? That’s product strategy in 3 questions.

And there’s an important AI angle here as well. Code is becoming cheaper to produce. AI can help developers build features faster than ever, which means simply having more features becomes less of a competitive advantage. Experience becomes the moat. Reliability, ease of use, support, trust — those things are much harder to generate with a prompt.

Cromwell’s conclusion is essentially that companies should spend more time listening to customers and less time assuming they already know what customers want, which sounds obvious and certainly easy to say, but you have to do it. And 3,300+ reviews suggest we still aren’t doing it particularly well. The story and research came from Matt Cromwell at Roots and Fruit.

Now for the fun. WordCamp US starts next week. The WordPress community is heading to Phoenix. WordCamp US 2026 begins Sunday, August 16th at the Phoenix Convention Center and runs through Wednesday, August 19th. The event starts with Contributor Day on Sunday, followed by Showcase Day on Monday and 2 full conference days Tuesday and Wednesday. Ah, more than 50 talks and workshops are scheduled covering development, design, accessibility, security, content strategy, performance, business, and a lot of AI. Surprise, surprise!

And I’ll be there. In fact, I’m going to have one of the last conversations of the conference on Wednesday afternoon. I’ll join WordPress co-founder Matt Mullenweg on the main stage for the closing keynote fireside chat. And we’re going to talk about open source. That’s right, open source. Not just WordPress, open source. Because WordPress is changing alongside of artificial intelligence, changing expectations about the web, and changing ideas about how open source projects should operate.

There are some fundamental questions worth asking. What do we need to preserve? What needs to change? How does open source compete in a world where AI can generate software almost instantly? And what does community mean when the technology underneath that community is changing this quickly?

This format is deliberately simple. 2 chairs, conversation, no 30-slide PowerPoint stuff like that. And importantly, the conversation doesn’t belong entirely to us. The final 30 minutes are dedicated to audience questions. So if you’re attending WordCamp US and there’s something you’ve wanted to ask Matt about WordPress, open source, AI, community, or where all this goes next, you’ll have an opportunity to ask it directly.

I think that’s important because conferences are at their best when they aren’t simply people standing on stage telling audiences what they already know. They’re places where communities actually have conversations, sometimes uncomfortable ones, sometimes unexpected, and occasionally ones that change where things go. WordCamp US begins August 16th in Phoenix. I’ll see you there.

And that’s today’s edition of OCN, Open Channels News. Today we started with a compromised WordPress supply chain. We looked at what thousands of WordPress customers say actually makes a good product. And next week, uh, we’ll get a chance to talk about where WordPress and open source, more importantly, goes from here.

Thank you for joining us. For continuing coverage of open source hosting, cybersecurity, AI, content management, and domain industry, join us again. I’m Robert Jacobi, your host. Be open and stay secure.