Systems Team Lead at Maine Office of Information Technology. Certificated Paralegal and Mediator. I am not an attorney and my posts are not legal advice.
Maine
Joined October 2024
- Tweets5.5K
- Following124
- Followers346
- Likes878
Watching Margin Call.
The most unbelievable part of this movie is company execs actually heading the warnings of a junior analyst.
Please let it be known that I will also accept payment in return for platitudes about how great a person Matt Mullenweg is.
Wild
Two days ago, Rank Math closed about a dozen security issues in 1.0.277. This plugin runs on over 4 million sites.
In that same update, group[.]one (who also owns WP Rocket) now gets administrative privileges to your site.
Last time, I classified something like this as a backdoor. This time, you may decide.
The file: vendor/groupone/wap-client/includes/class-app-password-manager.php.
What it does:
When a site administrator whose site is connected to a (free) rankmath[.]com account opens "Help & Support," the plugin immediately creates a WordPress Application Password for that user. It sends that password to group[.]one's servers. Their AI agent can then act on your behalf on your site.
The plugin never asks first. There is a "Terms & Conditions" box, but it does not stop the password from being created or sent. The transfer starts before the box even appears.
What they can do with it:
WordPress Application Passwords have no capability scopes; that password gives administrator powers. Their servers can install and activate plugins from WordPress[.]org, change settings, create admin users, and edit or delete content. They cannot immediately log into wp-admin in a browser, but they do not need to.
For example, they can install a snippets plugin and then inject PHP into its settings. That is remote code execution. "WPCode — Insert Headers and Footers" by Syed Balkhi exists to do just that. The password group[.]one holds can install it and write those settings.
Will they do this? Probably not. But their servers are now a hot target: they are collecting administrator passwords from a plugin on over 4 million sites. A hacker who gets that pile can hijack every site that already minted one.
The password shows up on your profile as "WAP – Rank Math Support Agent". Closing the "Help & Support" tab does not revoke it. This Application Password does not expire. You cannot turn the "Support Agent" off.
What you should do:
If you opened "Help & Support" while connected, revoke the Application Passwords immediately.
Go to "WP Admin -> Users -> Profile -> Application Passwords, and revoke anything starting with "WAP –".
Extra context:
I'm the founder of The SEO Framework plugin, a competing plugin to Rank Math, but without CVEs.
Its been a year and a half since this thread and @Cloudways is still completely incapable of handling basic billing issues.
I have over $150 in affiliate payouts, and a sub $60 bill, yet somehow my account has been repeatedly locked for nonpayment.
Two days ago, @Cloudways shut off my fully-paid-up account for an unpaid invoice. Now they are threatening to do it again.
On Monday of this week, my employee was trying to connect to our Cloudways account to setup some new environments for us to start contributing to Five for the Future.
Unfortunately, when he went to go access the account, he was not allowed to access the control platform. He was given an error by the system saying that there was an unpaid invoice.
The only issue is that the invoice had already been paid.
I spent a good amount of time on with Cloudways support and they eventually restored our access.
Now, this morning, I once again have a threat from Cloudways that they are going to shut off my servers for non-payment.
This is completely inappropriate and uncalled for. I have paid all of my invoices, and furthermore, Cloudways currently owes me more than the amount of my last invoice in unpaid affiliate contributions.
It's unfortunate what is happening to Cloudways with the @digitalocean acquisition. I don't think I can recommend this service to my clients anymore, and we are looking to move our own servers now.
Blackrock values Automattic at $17.20 per share as of Q1 2026. It invested at $85 per share in 2021.
The fact that someone can write this article and then claim with a straight face that Woo doesn't have scaling issues is genuinely mind blowing.
I've seen a Shopify site get a million hits and 50k sales in an hour. No outages, no impact on performance.
gridpane.com/blog/how-to-pro…
We need to call out AI slop service more.
26 years is a massive landmark, and you should be able to rely on complete clarity when upgrading a device. I definitely understand the frustration of receiving a much higher bill than expected and am here to help turn this around. I have sent you a DM to ensure that everything is fully addressed with your billing. -Sean
Michael Willman retweeted
Back in 2019 I gave a talk at WordCamp Grand Rapids about theme support and documentation. One section was about mental health and touched on succession planning and I remember standing there thinking — a few slides aren't enough for this.
That talk was born out of a loss that stunned our entire community and has stayed on my mind since.
I submitted that talk a couple of times to other WordCamp's but was turned down.
So I finally built something people can actually use.
"Succession Planning Toolkit for WordPress Freelancers, Small Businesses & Agencies".
When I worked at WP Engine I took calls from family members who had none of this written down. They were grieving and scrambling at the same time. That stuck with me.
This toolkit also includes a glossary of terms in plain English — because your family shouldn't have to Google "what is a nameserver" in the middle of a crisis.
It's not about expecting the worst. It's about being the kind of person who prepares for it anyway — just like you have insurance, just like you have a will.
You get the PDF along with a Word document so you can easily edit it.
It's $5.00 (or pay more if you want). Not because I need the money but because free downloads attract spam and fake emails, and I'd rather have it in the hands of people who actually mean to use it. If that's you, it's worth every penny.
payhip.com/b/lbLR3
Go grab a copy. Fill it out. Tell one person where it lives.
There's also a second Succession Planning Toolkit for Designers and Plugin Developers. Here's the link to that one.
payhip.com/b/9txP5
There's a table of contents included in the product images.
I hope you like it.
I hope you share it.
I hope you fill it out.
And, I hope you tell someone you did.
Much love to you all,
❤️❤️❤️❤️❤️❤️
Michael Willman retweeted
Mullenweg sat for 21 hours of deposition. WP Engine wants 5 more hours. That's one of six discovery fights heading to court this week.
therepository.email/wp-engin…
Michael Willman retweeted
100,000+ stores run this WooCommerce plugin. I doubt any of them know their payments are broken. Any store with $1M ARR could be missing $700k+ in revenue. If you run WooCommerce Subscriptions, check your store.
Yesterday, I reported a bug to WooCommerce that silently broke subscription payments after a product switch. Then I got worried: if they missed something this obvious, what else did they get wrong? So I started auditing. Within hours, I had found three more bugs. There were 121 affected subscriptions, and $43,274 in lost revenue.
Here's what I found.
WooCommerce Subscriptions has an internal flag that controls whether a subscription charges the customer automatically or waits for them to pay manually. When a customer checks out with (for example) Stripe or PayPal, this flag should be set to "automatic." If it isn't, subscription renewals silently stop working: no charge is attempted, no failure email is sent, and the subscription goes on hold until the customer notices and pays manually, or doesn't and churns.
Bug 1 (stale cache): After saving subscription dates, the order cache was never cleared. Subsequent saves could serve a stale object with the flag still set to its default: manual. Fixed in subscriptions-core 6.9.0.
Bug 2 (broken HPOS backfill): Missing getter/setter methods prevented subscription metadata from being properly synced to postmeta in HPOS when data sync is enabled. Fixed in subscriptions-core 6.5.0.
Bug 3 (unnecessary re-fetch): wcs_create_subscription() returned a freshly fetched instance from cache/DB instead of the already-configured object. Any unsaved state, including the corrected flag, was silently discarded. Fixed in subscriptions-core 7.1.0.
These three combined accounted for roughly 7% of all subscriptions created at checkout that were silently born broken, despite the customer paying successfully. For 7+ years (we have data from 2017–2024). Automatic payments NEVER fired for these subscriptions. Users never got renewal emails, either. The only way to know they were broken was if the customer noticed they lost access and contacted support, or if the merchant audited their database manually.
Bug 4 (switch): When a customer upgrades or downgrades their subscription, the switcher flags the subscription as manual renewal; it only corrects the flag if the payment gateway changes. A customer switching plans while keeping the same gateway (e.g. Stripe to Stripe) cements the flag stuck on manual. I discovered this two days ago, when I found a happy customer in the store overview that I had just helped upgrade, with multiple valid cards on file, put "On Hold" because of a missed payment.
For years, I've offered to help WooCommerce improve its code quality and performance. I dry-run code: I find bugs by reading. All four of these bugs are clearly visible in the source without needing to use the software. They could have been caught early. They weren't. The incompetence is immeasurable (well, actually, with the diagnostic queries in my next post, it might be measurable). Our store is small. WooCommerce Subscriptions powers hundreds of thousands of stores. If 7% of subscriptions were silently broken across even a fraction of them, we're looking at potentially millions of dollars in spoiled revenue industry-wide that could have been prevented. Perhaps even billions.
None of this was disclosed well or at all. No admin notice. No email. No advisory.
The fixes shipped under vague changelog lines like "Make sure we always clear the subscription object from cache after updating dates" and "Ensure proper backfilling of subscription metadata." One fix was labeled "Dev" instead of "Fix." Two don't appear in the GitHub release notes at all. No remediation tool or diagnostic query was provided. Store owners have NO way to know they're affected unless they manually audit their database. The woocommerce-subscriptions-core repo was archived in May 2025 after the code was absorbed into WooCommerce core — making the fix history harder to trace.
If you run WooCommerce Subscriptions and used HPOS before mid-2024, check your store. Queries are linked in the tweet below.
Michael Willman retweeted
"My first instinct was exactly what such people would delight in happening. To watch the rest of us recoil, then retract, and perhaps even eject. To leave the internet for a while or forever. But I can't do that. We shouldn't do that." world.hey.com/dhh/words-are-…
Michael Willman retweeted
"Brother we need a civil war NOW! We can't live the intolerant left anymore, it's time to crush them once and for all!"
It is insane how bad the partisan hate is getting in America today, and the Charlie Kirk shooting is just the latest example of the fallout.
As long as nothing changes, it will only get worse.