61–70 of 247 posts
https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
If code is poetry, Wordpress is a new genre of it, probably?
Earlier quoted context omitted.
This might help https://chatgpt.com/cyber ease the guardrails a bit.
Thanks! I wonder if Claude has something similar?
Earlier quoted context omitted.
What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?
WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
It would definitely be a breaking change and unmigratable.
Earlier quoted context omitted.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
The great irony is they still sport their "Code is Poetry" mantra on their website [0]. If code is poetry, Wordpress is a new genre of it, probably? [0]: https://codex.wordpress.org/WordPress_Philosophy
Earlier quoted context omitted.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
The great irony is they still sport their "Code is Poetry" mantra on their website [0]. If code is poetry, Wordpress is a new genre of it, probably? [0]: https://codex.wordpress.org/WordPress_Philosophy
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in…
And people like to be able to extend from Blogs to various other non static features which WordPress allows for.
I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me
Will be publishing a report on www.theweb.report soon - if you're interested.
That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail.
( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).
Earlier quoted context omitted.
The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.
The great irony is they still sport their "Code is Poetry" mantra on their website [0]. If code is poetry, Wordpress is a new genre of it, probably? [0]: https://codex.wordpress.org/WordPress_Philosophy