upvote

points

by ahartmetz1 days ago |
comments
upvoteby denysvitali1 days ago|
next
[-]
I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching.

I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

reply
upvoteby muvlon1 days ago|
parent|
next
[-]
In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.
reply
upvoteby marysol523 hours ago|
parent|
[-]
It went from a blog, to an entire CMS. Which is bonkers
reply
upvoteby CM301 days ago|
parent|
prev|
next
[-]
People like having a WYSIWYG editor, being able to update their posts in the browser, having comments and being able to use plugins. They're also not particularly skilled with the terminal/commands, and a lot of hosts provide a one-click install setup for scripts like WordPress.
reply
upvoteby mewpmewp21 days ago|
parent|
prev|
next
[-]
Like you said. It is a product for people who are not technical and don't code. A product that you would have to use git for, wouldn't be used by the 90 percent in the first place. And there are such products. There is a reason WordPress is the most popular platform. Most people are not technical.

And people like to be able to extend from Blogs to various other non static features which WordPress allows for.

reply
upvoteby thenthenthen1 days ago|
parent|
[-]
Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always
reply
upvoteby acomjean1 days ago|
parent|
prev|
next
[-]
The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..
reply
upvoteby 11235813211 days ago|
parent|
prev|
next
[-]
- Anyone can edit it

- Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.)

- In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.

reply
upvoteby pwillia71 days ago|
parent|
prev|
[-]
WPE tried to make Faust.js a thing so you could use WP CMS but generate a modern static site but I don't think it really took off much
reply
upvoteby gorszon1 days ago|
prev|
next
[-]
Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?
reply
upvoteby blauditore1 days ago|
parent|
[-]
...or was just looking for a clickbait title.

Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.

reply
upvoteby slim1 days ago|
prev|
next
[-]

  WordPress is one of the most hardened targets of all time
that obsolete code did not change for decades. all the bugs have been discovered and patched
reply
upvoteby lyu072821 days ago|
prev|
[-]
some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me
reply
upvoteby addedlovely1 days ago|
parent|
[-]
I've got it at 38.32%. I'm looking at the 'front-door' of the web, active sites, no subdomains, from Crux user experience data.

Will be publishing a report on www.theweb.report soon - if you're interested.

That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail.

( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).

reply