Freelance WordPress/Web Developer, Photographer and content creator.
Dortmund, Germany
Joined August 2008
- Tweets2.5K
- Following104
- Followers1.1K
- Likes175
Dumitru Brînzan retweeted
Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites.
The file: wpforms-lite/src/SetupWizard/Bridge.php.
What it does:
It takes over your browser and opens their app on WPForms' servers. It hands that app a one-hour login token for your site. Their app can then act on your behalf on your site.
What they can do with it:
Their app can install and activate plugins. It can also turn on a switch that starts sending your form submissions to WPForms' servers. The plugin never asks first and never warns you.
When it runs:
It kicks in automatically on a fresh install during setup, only for administrators. You won't get a notice. The token expires at the end of setup, or after an hour.
What they can install:
Thirteen plugins from WordPress dot org: WP Mail SMTP, WPConsent, Uncanny Automator, AIOSEO, Universally, Duplicator, Reviews Feed, OptinMonster, MonsterInsights, ActiveLayer. Oddly (probably a bug), also Contact Form 7, Ninja Forms, and Pirate Forms.
They can also pull WPForms addons and WPForms Pro from their own servers. These servers are not moderated and could be used to push malicious code—which ought to be expected, given their track record.
Extra context:
Awesome Motive is employing and has hired WordPress Plugins Team members.
It is crazy to see how petty and unprofessional @automattic (@wordpress) is. Truly disgusting. Blocking comments is the cherry on top. #wordpress
Do you know the joy of adopting the Block Editor (Gutenberg) for your #WordPress website? Discovering months/years later new default CSS code like this: .wp-block-columns { flex-wrap: wrap !important; }
!important is a sure sign of top quality CSS!
Dumitru Brînzan retweeted
Looking for something simpler than Google Analytics? Check out this awesome review of Independent Analytics by @dumitru: youtube.com/watch?v=IzqPhbwt…
Attention @gravityforms users. GF Version 2.9.0 (November 2024) added a new "Image Choice" field. Because of it, there are now 3 custom image sizes. Now you get 3 extra files for every image in your media library. This is NOT good. #wordpress
1,713 new #WordPress themes launched in 2024 in the repository—most are struggling for installs. Automattic, which has flooded the directory with 101 themes, sees many of them barely break 50 active installs.
ilovewp.com/wordpress-org-th…
I use the free SiteGround Speed Optimizer WP plugin on all my personal and client websites. I made a detailed video tutorial about it: youtube.com/watch?v=U4-0_WI2… #wordpress @SiteGround
Would love to see @richtabor work a little on his amazing Merlin WP tool. Implementing it in 2025 is a bit weird and buggy :(
I was today years old when I found out that audio extension cables exist and they cost just a few $.
If you keep your domain names at @namedotcom, you might want to double-check the Junk folders in the email provided by your hosting provider. @SiteGround blocks all of them.
Dumitru Brînzan retweeted
Fun fact: WooCommerce collects your sensitive information without asking for consent.
Luckily, it merely consists of about 1000 data points.
Let's dive into it... 🧵
Disclosure: I'm a WooCommerce Marketplace partner.
The Avada WordPress theme will probably cross the 1 million sales milestone by the end of this year. #WordPress
Since Sept 2024, Matt Mullenweg (@photomatt) has been preaching to the choir—but even they’re tuning out. He hasn’t gained new fans, only lost trust and employees. Meanwhile, @wpengine is winning over people who didn’t care before. #WordPress
Dumitru Brînzan retweeted
The judge in the WPE vs Automattic/Matt ruled this morning on the injunctive relief and GRANTED it. It's a 42 page document that basically says the following:
storage.courtlistener.com/re…
God Almighty! Just stumbled upon a #WordPress church website with a 134 MB HTML homepage.😳
