Those who have ever delivered actual WP sites know the pain of it. Typical WP setups grow very fast growing towards completely entangled mess of plugins and template hacks as the project matures.
The security issues with WordPress aren’t fake, but they are not nearly as bad as the reputation is. The main reason WordPress gets a bad rap is companies like Patchstack have a financial incentive to abuse CVEs and scare people into buying their products.
For example, we have had numerous CVEs from them stating that they found an RCE in our plugins (!). Oh no! CVE filed. Reproduction steps:
1. Log in as a site admin with full access to the database and file system of the site. 2. Scroll past an input field in our plugin where you can type in arbitrary PHP and have it executed. 3. Do some magical incantation to fire some useless hook.
——
Hello Toyota, I found a security problem- the center console inside the car can be opened by unauthorized users. As some vehicle owners may place valuables there, it exposes them to the possibility of theft.
Steps to reproduce:
1. Unlock the car door and enter the vehicle using your key.
2. Open the center console.
Proposed security fix: Require the vehicle’s key, an RSA fob, and iris scan to open the center console. You have 15 days to recall all vehicles in your fleet that have an unsecured center console. Here are several blog posts that will be going live after the deadline:
• All Toyota Cars Insecure And Anything You Put Inside Can Be Stolen By Anyone Unless You Give Us $50/mo
• Toyota Car Alternatives Because of Vulnerability
• How To Secure Toyota Cars
• Safe Toyota Cars Near Me
• Toyota Car Discount Code Security
——
Their whole business model is to file CVEs, get to them to rank on Google, and then blast out press releases scaring people into paying for their garbage plugin.
There have been real issues, like the Bricks thing, where actual sites did get hacked. But this is a fact of life, if you expose your server/data to the internet at some point it very well may get compromised. I’m sure a few people had a bad day, but if you have a WordPress site and care about security literally all you need to do is put it on a half decent host and they will use a WAF and won’t have to worry about anything.
There are plenty of household names running WordPress at scale like Rolling Stone, Time, the White House, Techcrunch, etc. They aren’t doing much different from what a $5/mo blog on GoDaddy gets in terms of security, and they certainly aren’t running Patchstack (I really hope someone doesn't sniff their sites or tell me they are providing a WAF for them etc and prove me wrong lol).
“Their whole business model is to sign CVEs” - please don’t make up random stuff. We were invited to the CVE program and therefore have an obligation to assign CVEs.
“Get to rank them on Google” - what?
Also, we don’t send press releases about vulnerabilities. There are cases where publications reach out to us and ask for comments when there are severe issues disclosed - but that’s very much different from the picture you’re trying to paint here.
Also, your “get a half decent host with a WAF” argument shows how disconnected you’re from the reality. There are web hosts that say they offer secure hosting when promoting free SSL. We’ve tested the web hosts with independent reviewers and what you’re claiming is a widespread myth that has been debunked: https://patchstack.com/articles/myth-of-secure-hosting-only-...