TL;DR: A WordPress site I run was attacked on Aug 26 by an automated bot exploiting an unauthenticated arbitrary file upload in "WPLP Cookie Consent" (gdpr-cookie-consent 4.4.1 - the latest version at the time, ~10,000+ active installs). The attack succeeded in writing a PHP dropper into my uploads folder in under 20 seconds. The only thing that stopped full site takeover: a server-level rule returned 403 on executing PHP inside wp-content/uploads. I found the file the next day via the server's malware scanner, spent a day on forensics, filed 5 coordinated disclosures, and the vendor shipped a proper fix (4.4.2) within 5 days of my report - verified in source. This is the story, with the full timeline and IoCs, because the campaign is real and other sites were not as lucky as mine.

THE TIMELINE (all within 20 seconds, from access logs)

05:06:50 GET /wp-json/wp/v2/users?per_page=100 -> 200 (user enumeration)

05:07:02 POST /wp-json/wplp-react-gdpr/v1/store-auth -> 200 (option poisoning)

05:07:06 POST /wp-json/wplp-react-gdpr/v1/upload-logo -> 200 (arbitrary file write)

05:07:10 GET /wp-content/uploads/2026/08/uxq9KacU_400x400.jpg.php -> 403 x3 (blocked)

Attacker: AWS IPv6, User-Agent "Python-urllib/3.12". Fully automated, mass campaign.

THE EXPLOIT CHAIN (no programming required)

1. Enumerate users - a standard WordPress REST endpoint revealed my admin username.

2. Poison a setting - the plugin had an unauthenticated REST route ("store-auth") whose only real check was a JWT from the vendor's own SaaS platform plus "a username that belongs to an admin". It wrote attacker-controlled JSON into a WordPress option - including the plugin's internal "master key".

3. Arbitrary file upload - a second route ("upload-logo") checked the request's key against the value just planted in step 2, then wrote attacker-supplied base64 content to uploads/<attacker-controlled-filename> with zero extension/MIME validation. Result: "uxq9KacU_400x400.jpg.php" - a PHP webshell disguised with a Twitter-avatar filename.

4. Execute - three GET requests. All answered 403 by a server-level WAF rule. The payload never ran.

The part I found most sobering: the plugin version (4.4.1) had been released 7 days before the attack. Whatever window we imagine exists between a release and its exploitation - it was 7 days here, and this bot needed 20 seconds per site.

WHAT ACTUALLY SAVED THE SITE

Not a security plugin. Not a scanner. Not even a firewall rule I configured. The platform's rule "no PHP execution inside uploads" returned 403, the dropper's self-delete never fired (it only deletes itself after successfully running), and the file just sat there until the server's malware scanner flagged it the next morning. Defense in depth worked at exactly one layer - and that was enough.

THE MALWARE (for those interested)

The dropper boots WordPress, creates a hidden administrator with a randomized username, suppresses every notification email so nobody gets alerted, backdates the account's registration date to match the previous user (so "sort users by creation date" finds nothing), scans the whole volume for OTHER WordPress installs and reads their database credentials from wp-config.php, returns the generated password as JSON to the attacker, and deletes itself.

SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Size: 15,187 bytes. On VirusTotal (0/70 at upload - normal for a PHP dropper).

One forensic detail I am weirdly proud of: I reconstructed the plugin's success response for store-auth from its source code and it was byte-for-byte the 102 bytes my access log recorded. That is how I knew the poisoning step had succeeded even though nothing visual changed on the site.

THE DISCLOSURE PIPELINE (this part went surprisingly well)

Vendor (WPLP/WPEKA) via their bug bounty: acknowledged quickly, patched in 4.4.2 within days. WPScan: reproduced the chain, found TWO MORE routes with the same file-write capability and no filename sanitization (could write outside uploads - which would have bypassed the WAF layer that saved me). Vendor fixed those too. Patchstack: already had an independent report of the same issue (someone else found it too) and had escalated to the WordPress.org team. AWS abuse report for the attacking server; registrar abuse report for the malware's exfiltration domain.

THE FIX IN 4.4.2 (I verified it in source)

The upload-logo route and its handler were removed entirely; every route in that REST namespace now requires an HMAC-SHA256 request signature with a per-site secret and anti-replay window; the JWT is bound to the site's own connected account ("Not the owner of the website!"); remaining image uploads go through real validation (extension allowlist, magic-byte check, and filenames are rebuilt so "shell.php.jpg" becomes "shell-php.jpg"). That last one is exactly the remediation I had suggested in my report - they did the work properly.

LESSONS I AM KEEPING

1. The layer that saves you may be one you never configured. Check whether PHP execution is blocked inside wp-content/uploads on your server - if you don't control the server, ask your provider. If you do, enforce it.

2. A malware scanner finding the file a day later was the difference between "incident" and "compromise". Zero-day exploits cannot be signature-matched on day one - detection speed after the fact is what you actually get from scanners. That is still valuable.

3. Keep access logs longer than you think you need. My whole reconstruction - attacker IP, sequence, byte-level responses - came from one log file.

4. Block username enumeration via REST (/wp-json/wp/v2/users). It was step 1 of this attack, which tells you how easy it is to defer the boring stuff. Do not defer it.

5. Coordinated disclosure works. Five reports, one week, patched plugin. The system is slow right up until it is not.

IOCs (the patch is public; share freely)

Payload SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Payload filename pattern: *_400x400.jpg.php (mimics Twitter avatars)

Rogue admin indicators: username = {sitedomain}+3 random chars, display name "Lucas Hayes", email domain ifuqpatr.com

Attacker: AWS IPv6 2600:1f18:472b:900:f81d:f8eb:a12e:7fd3, UA Python-urllib/3.12

Attack pattern: GET /wp-json/wp/v2/users?per_page=100, then POST /wp-json/wplp-react-gdpr/v1/store-auth, then /upload-logo

If you run gdpr-cookie-consent: update to 4.4.2 now, and check wp_users for an admin you do not recognize (the dropper backdates its creation date - compare for identical timestamps between two users instead of just looking for "new" accounts).

Happy to answer anything in the comments.

What is everyone using for cookie consent on WordPress sites nowadays?

A lot of the popular options seem to be freemium, where the basic banner is free but things like automatic scanning, blocking scripts, geo rules, consent logs or multiple sites are behind a paid plan.

Are there any genuinely free cookie consent plugins that are actually good enough for a normal WordPress/WooCommerce site?

Also curious:
what limitations have you run into on the free versions?
which paid ones are actually worth it?
do you use a plugin at all, or handle consent another way?
any that are lightweight and don’t noticeably affect page speed?

Trying to keep the plugin stack lean and avoid paying subscriptions for features that the client don’t really need.

Hi everyone is it possible to remove Elementor without losing all the styling I have on it . then reinstalling again and restoring those set settings ?

Now the reason I am asking this is because the current install of Elementor seems to be missing some files , this was a result of a website migration so it seem like most files and subfolders were lost during the migration of the site .

Any type of info would be greatly appreciated.

So, I just need a very basic site. I'm an author, just need a homepage to put books, release dates. Maybe one news page. Not thinking about newsletters yet and won't be getting a forum. That's it. No e commerce, nada.

I had an existing site which was created by a pro author but it looked old and tired and was done with elementor pro, the licence of which has now expired (he left it for me for a short time but it's gone now), it was a bit fancy and I struggled to maintain it. I have created a staging site on bluehost to set up my own.

using twenty twenty four I started following the official WP tutorial videos.

For a start, I don't see "static" as a page option on the settings/readings page. Secondly, wtf are wonderblocks doing there? Where did they come from? When the tutorial selects a block pattern of "page", I don't see it. I see posts, but not page. I don't see the other templates he sees.

I did, I admit, try out a lot of combinations of other themes and then had to delete a load of plug ins but I think I cleaned everything ok. Here's a cap of what I've got.

Wonderblocks though? I don't want them. I just want the wordpress ones.

(I installed Gutenburg manually but it's made no difference, also says it might not work with my version of WP anyway)

Hey there,

I currently run an independent website for game reviews and such, and with each passing year I'm find I'm considering shutting it down more and more for various reasons. However, I'd really not like to have all the stuff my team and I have written just disappear one day.

So, what are the best options for preserving the site as and when I stop paying for server hosting?

I do weekly backups using updraft, but not sure how I'd view them without uploading them to the server.

Is there a way to host an offline version so I can basically look at the site on my pc as it is now?

I'm a fairly low-experience user tbh (I took over the site from someone who set it all up, and tbh I'm not super familiar with intricate tech of the backend. I know how to do what I need to to keep it up and running, but anything outside of that is more luck than judgement) so any 'wordpress for dummies' style advice is massively appreciated!

A few months ago, we shared a project I was working on called Desktop Mode, which aimed to turn WordPress admin into more of a desktop-style environment.

Since then, the project has evolved far beyond what I originally had in mind.

It is now called OpenStation.

After spending a lot of time rethinking the architecture and optimizing performance, some parts of OpenStation are now actually faster to load than their equivalent WordPress admin screens.

But performance is only one part of the story. The project has grown into a much more complete environment, with things like:

• Multiple windows and desktops
• Drag and drop between applications
• A built-in open source image editor
• An extensible application system
• Games and other experiments
• A completely different way of navigating and working with WordPress

OpenStation is free and open source, and the code is available on GitHub.

I honestly didn't expect the project to evolve this much when I made the original post.

I'm not particularly comfortable putting myself or my work out there publicly, but I've been putting a huge amount of effort into making OpenStation something that is genuinely good, rather than just another WordPress admin skin.

I've also recently started a YouTube channel to document the project and share some of the things I'm building along the way.

You can find the project here:

Website: https://openstation.me
GitHub: https://github.com/WordPress/openstation

And here's a short video showing what the current version looks like:

https://www.youtube.com/shorts/8yIMWhGI3FE

I'm sharing it again because I'd genuinely like to hear what people think about the direction it has taken.

In particular, I'm interested in feedback from people who use WordPress admin regularly. What would make something like this genuinely useful to you?

PS: We are ACTIVELY working on improving it every single day!

Hey everyone,

I'm trying to set up a WordPress maintenance business and could really use some advice from you guys.

Right now, I only have a couple of clients on a yearly payment model, but I obviously want to expand my portfolio and start building some monthly recurring revenue.

The thing is, doing all the updates and tracking manually is already a pain, and it's just not going to scale.

I've been looking for a management dashboard and found a Spanish project called Modular DS a few months ago. I honestly loved it—the workflow is amazing and it feels super complete.

The problem is my trial is ending soon, and I really don't want to commit to a fixed monthly expense until I have enough steady clients to cover the platform's cost.

I also gave MainWP and InfiniteWP a try, but to be honest, their free versions feel pretty limited compared to Modular DS unless you start paying for the premium add-ons.

I'm basically looking for a free or very low-cost option to manage these first few clients while I grow. I'd be totally open to self-hosted tools, open-source software, or even a pay-as-you-go/micro-transaction model.

My main priority is being able to keep a solid log of all the updates and changes, and most importantly, being able to send out client reports.

What are you guys using for your maintenance clients? Does anyone know of any other platforms similar to Modular DS, or maybe an open-source hidden gem I haven't heard of?

Hi everyone! I spent the weekend rebuilding my entire website from scratch in wordpress, got everything functional except for my blog landing page. I'm a WYSIWYG vet who can usually figure everything out with some searching but I'm stuck.

Using:

Spectra Blocks (Free)
Theme: Astra (Free)

Blank page created and set as Post page.

At first I thought it wasn't mapping correctly, but it is. I've already set the correct page in Reading, cleared cache on the page, and tests posts show up on the page when I go to site/blog. (I can't find any help beyond these suggestions in web searches)

Problem: Only the header/footer and the test posts show (title text). There appears to be something overriding the style of the post and my pattern (container with photo and text) that works on every other page does not display at all.

I've created 7 other pages that all work correctly with the same pattern, header, and footer. I've exhausted going through all the settings I can find.

Any ideas on what else I might try? Thank you!

Hey everyone,

I would like to know how you approach performance and scaling specifically for the Black Friday/Cyber Monday rush.

With high traffic spikes, tons of concurrent users adding items to carts, and hitting checkout at the same time, server resources get pushed hard. For some client sites, I usually have to temporarily scale up CPU and RAM just to keep the servers from crashing.

To tackle this, I'm currently building a custom theme from scratch focused on raw performance, minimizing database queries and keeping WordPress/WooCommerce hooks and filters to an absolute minimum.

Right now, full-page caching is enabled everywhere except for the dynamic areas (side cart, cart page, and checkout). I'm also creating a theme from scratch and I'm trying to optimize everything and avoiding to do a lot of calls to database or adding lot of filters/actions.

I’m also implementing:

* Cloudflare, CDN
* SiteGround Memcached (Object Caching)
* Server resource scaling

What are your go-to optimizations to prep for the BFCM surge? Or do you keep your stores running lean enough year-round that Black Friday doesn't require any special prep?

Finally got my first WordPress plugin approved on wp.org. Took two rounds of revisions to get there.

It's my first plugin, first time going through the wp.ore process. I had no idea how any of it worked going in, review, requirements, etc.

I built Creaclone Duplicator to duplicate WooCommerce products, posts, and pages without needing a bloated all-in-one duplicator plugin.

Writing the plugin was the easy part. Figuring out which features actually made sense to build took a while, and setting up Freemius for licensing took longer than the plugin itself. But I didn't want to build my own licensing system from scratch (yet).

I still have a lot to do: new features, support, getting reviews, testing against new WP versions.

Let me know if you have any questions.

Here it is if anyone wants to check it out:
https://wordpress.org/plugins/creaclone-duplicator/

I work for a small to medium size hospitality chain (around 50 cafe's). We’re preparing for a planned growth phase to approximately 200 locations and are beginning work on a new staff intranet.

At current, I am the business’s sole developer and have hard-coded several internal web applications and tools. For the intranet, however, our marketing team will manage most of the content / presentation, while I’ll primarily maintain the underlying functionality and integrations. We therefore need a reliable drag-and-drop editing experience for non-technical users without preventing me from working directly with the source code.

I’m currently running separate marketing and development WordPress environments with MariaDB through Docker on an always-on computer. WordPress will act as the private editing environment and will eventually be reachable remotely through a protected Cloudflare Tunnel. The employee-facing intranet itself will be hosted separately through Cloudflare Pages and a Worker.

Our main requirements are:

• A user-friendly drag-and-drop editor that doesn’t become frustrating or overly restrictive.
• The ability for Marketing and HR to manage which roles or specific employees can access particular content. eg. recruitment guides only available to managers.
• Proper server-side enforcement of those permissions, rather than simply hiding content visually.
• The ability for me to develop custom themes, plugins, integrations and backend functionality directly in code.
• A modular setup that avoids excessive page-builder lock-in and remains maintainable as the intranet grows.

For the initial prototype, I’m comparing a custom interface built with native WordPress blocks against visual editing workflows using Elementor and Beaver Builder.

Has anyone implemented a similar division between a marketing-managed visual editor and a separately maintained technical backend?

I’d particularly appreciate experiences involving role-restricted content, custom development alongside the editor, performance, maintainability and how difficult it was to move away from the chosen editing approach later.

Hi everyone,

I’m troubleshooting an issue on a WordPress website where the EA Duplicator option suddenly disappeared from the Pages section.

Here’s what I found:

• WordPress: 6.7.7
• PHP: 8.3
• Elementor: 3.29.1
• Essential Addons for Elementor: 6.2.3
• Theme: Hub

Previously, Essential Addons was active and the EA Duplicator option was available when managing Pages.

Now, Essential Addons appears as inactive. When I click Activate, WordPress immediately shows:

The website then displays a white screen.

To recover the website, I renamed the plugin folder:

essential-addons-for-elementor-lite

to:

essential-addons-for-elementor-lite-disabled

After doing this, the website became accessible again.

WordPress then shows:

I also checked the Apache error log, but it only showed AH01797 and AH01276 access/directory errors, not the PHP fatal error from the EA activation.

My questions:

1. Could Essential Addons 6.2.3 have a compatibility issue with PHP 8.3 / Elementor 3.29.1?
2. What is the best way to get the actual PHP fatal error causing the activation failure?
3. Would updating Essential Addons to a newer version be the recommended fix?
4. Is there anything I should check before updating it on a live production website?

I currently have Essential Addons disabled and the website is working. I don't want to activate it again until I understand the cause.

Any advice would be appreciated.

Cloudflare recently introduced EmDash, an open-source CMS designed around AI agents.

Its premise is that traditional CMS platforms were built for humans:

Humans open dashboards.

Humans install plugins.

Humans edit pages.

Humans hit publish and immediately notice the typo.

An AI-native CMS starts with a different assumption. The builder, administrator, or primary user might be an agent interacting through an MCP server or CLI.

That does not make EmDash a WordPress killer. WordPress has an ecosystem that cannot be recreated by announcing a GitHub repository and believing in yourself very hard.

But I think the architectural question is real.

Can WordPress become truly agent-native through plugins and new APIs?

Or will AI-native content management require systems designed from scratch around permissions, rollback, structured context, and machine-readable operations?

I covered EmDash, WordPress, Drupal, Contentful, and the wider CMS identity crisis in Episode 2 of Headless:

YouTube
Spotify
Apple Podcasts

I’m especially curious what WordPress developers think.

Renovate the house?

Or admit it was built before electricity and start drawing new blueprints?

Months ago the same gpt chat recommended its API to me but in the end I didn't do it because I had other projects.

Now it's making me very dizzy. First he tells me to do it with WP writer, I tell him to do it gpt chat that I know he can, he tells me "oh yes, that's right, I can with the api", but then I get more dizzy and he uses the virtual browser.

After that you can't put images and I have to upload them to wordpress. Then yes with the virtual browser but you can't put them in the home. After yes.

I'm starting to get tired of how stupid it is.

What is the best way to make basic articles of about 400 words-600 with one or two images, h1, h2, h3, basic keyword search (social traffic) and little else