REGEXSS Demo: How Hackers Exploit Regular Expressions in WordPress | Matthew Rollings (Stealthcopter)

WordPress Plugin Supply Chain Attacks: Hunting for Backdoors with AI | Austin Ginder (Anchor Host, WP Beacon)

Supply chain attacks against WordPress plugins are difficult to spot because they often hide behind legitimate update processes that users trust every day. In this episode, Austin Ginder, Founder of Anchor Host and WPBeacon, shares how investigating compromised sites across a large managed WordPress environment led him to uncover multiple examples of plugin supply chain abuse. He explains the techniques involved, how AI accelerated the investigation process, and what the WordPress ecosystem can do to improve software integrity. Key topics discussed: • How plugin supply chain attacks operate through trusted update channels • The attack patterns Austin investigated, including expired domain takeovers, redirected update infrastructure, and version number manipulation • How Claude Code accelerated timeline reconstruction and forensic investigation • WPBeacon and its role in identifying indicators of supply chain compromise • WPRegistry and the vision for a community-driven plugin integrity database • The challenges surrounding abandoned plugins and ecosystem governance • The growing impact of AI on both attackers and defenders 🎙Guest: Austin Ginder [https://www.linkedin.com/in/austinginder/], Anchor Host [https://anchor.host/] & WP Beacon [https://wpbeacon.io/] 🎙️Host: Robert Abela [https://www.linkedin.com/in/robertabela/], Melapress [https://melapress.com/]

AI in WordPress Core: Connectors, Abilities & How to Stay Secure | Jonathan Bossenger (Automattic)

In Episode 51 of the Melapress Show, Jonathan Bossenger, Developer Advocate at Automattic, joins Robert Abela to break down how WordPress is being rebuilt from the ground up to work with AI and what that means for the people who build and manage WordPress sites. The conversation covers the four Core AI building blocks that shipped with WordPress 7, why the Abilities API could change how developers structure their plugins, and the real security considerations involved in connecting your site to an AI provider. Whether you're a seasoned plugin developer or just getting started, this episode gives you a clear picture of what's happening now and where things are heading. Key topics include: * The four WordPress Core AI building blocks: Abilities API, AI Client, MCP Adapter, and Connectors * How the user-controlled model means site owners decide how AI is used on their site * Why connecting to AI providers makes API key security more critical than ever, and what to do about it * How to get a feature request or idea into the hands of the right WordPress Core contributors * What the Abilities API does, why it matters for plugin developers, and how to start registering abilities * What the WordPress AI plugin is, how it mirrors the Gutenberg/performance plugin model, and where it's heading * How AI is reshaping the developer role and why experienced developers blogging and sharing more matters now more than ever 🎙 Guest: Jonathan Bossenger [https://www.linkedin.com/in/jonathanbossenger/], Developer Advocate at Automattic [https://automattic.com/] 🎙️ Host: Robert Abela [https://www.linkedin.com/in/robertabela/], Melapress [https://melapress.com/]

Building Modern WordPress Products in the AI Era | Vova Feldman (Freemius)

In this 50th episode of the Melapress Show, Vova Feldman, Founder & CEO of Freemius, joins Robert Abela to explore how AI is transforming the way WordPress products are built, maintained, and supported. While AI is making development faster than ever, many plugin vendors are discovering that speed alone doesn't solve the harder problems: technical debt, support at scale, product quality, and the growing complexity of modern SaaS-connected WordPress products. This conversation goes beyond the hype, offering a grounded look at where the ecosystem is heading and which skills and processes still matter in an AI-assisted world. Key topics include: - How AI is accelerating WordPress plugin and product development, and where the risks are emerging - Why technical debt is a growing problem as building speed outpaces engineering discipline - The evolution from standalone plugins to modern, SaaS-connected WordPress products - How to maintain product quality and reliability as operational complexity increases - Scaling support effectively without sacrificing the user experience - What engineering skills and development practices remain essential in the AI era 🎙️ Guest: Vova Feldman [https://www.linkedin.com/in/vovafeldman/], Founder & CEO at Freemius [https://freemius.com/] 🎙️ Host: Robert Abela [https://www.linkedin.com/in/robertabela/], Melapress [https://melapress.com/]

REGEXSS Demo: How Hackers Exploit Regular Expressions in WordPress | Matthew Rollings (Stealthcopter)

In Episode 49 of the Melapress Show, Matthew Rollings, application security professional and bug bounty hunter, joins Robert Abela to break down RegexXSS: a vulnerability class hiding in the regex code of WordPress plugins. Mat explains how post-sanitization regex manipulation can reintroduce cross-site scripting even after WordPress has done its job, and demonstrates how an attacker can leverage it to take over a full admin account. Many developers are unaware that using regex to parse or modify HTML, even after WordPress's built-in KSES sanitization, can introduce fresh XSS vectors. With over 70,000 WordPress plugins in existence, and regex used heavily throughout PHP development, this vulnerability class is both widespread and chronically under-reported. Mat has earned £20–30k in bug bounties from this single class alone. Key topics include: * The definition of RegexXSS and why it's distinct from conventional cross-site scripting * How WordPress sanitizes input by default and exactly where that protection ends * Why regex is fundamentally context-unaware and therefore unsafe for HTML manipulation * A step-by-step demo of abusing a regex deletion to smuggle a JavaScript payload * How XSS can be escalated to silent admin account creation in WordPress 🎙 Guest: Matthew Rollings [https://www.linkedin.com/in/mat-rollings], Application Security Professional 🎙️ Host: Robert Abela [https://www.linkedin.com/in/robertabela/], Melapress [https://melapress.com/]

Developer Advocacy, Enterprise WordPress & The WP Community Collective | Chris Reynolds (Pantheon)

WordPress powers nearly half the web, but the people doing the actual core work are often underfunded, under-supported, and contributing on their own time. Chris Reynolds has seen this firsthand as a long-time contributor, hosting team lead, and now as president of the WP Community Collective, an organization building a new model for independent, community-funded contributions to WordPress. In this conversation, Chris breaks down how the contribution pipeline actually works, why it's so hard to get started, and what WordPress could learn from Drupal's approach to community, governance, and funding. He also explains the three models the WP Community Collective uses: fellowships, projects, and individual sponsorships, and how businesses can support core work without taking on the overhead of hiring. Key topics include: * The WP Community Collective: what it is, how it works, and why it was founded * Why most WordPress core contributions come from a small number of companies * The real experience of trying to break into WordPress core development * How DrupalCon's governance model and mentored contributor days compare to WordPress * Commercial competition vs open source collaboration: where WordPress struggles * How businesses can sponsor contributors through the WP Community Collective 🎙 Guest: Chris Reynolds [https://www.linkedin.com/in/chrissreynolds/], Senior Developer Advocate at Pantheon [https://pantheon.io/] & President at WP Community Collective [https://www.thewpcommunitycollective.com/] 🎙️ Host: Robert Abela [https://www.linkedin.com/in/robertabela/], Melapress [https://melapress.com/]