"Every WordPress plugin runs inside the same PHP process as core, with the same access to your database and files. A slider plugin can read your users table. A form plugin can send your data to any server on the internet. There is no permission prompt and no way to limit what a plugin can touch. The amount of sandboxing is zero."
https://hatamoto.dev/post/wordpress-20-years-why-we-built-hatamoto
Joakim Melin
npub18u…vgly7
2026-10-28 11:59:34 UTC
Author Public Key
npub18uwgpcnuy7vtl3zp664hvr73fcpc67jy7rg204axnghnw5hnlcwqjvgly7Seen on
wss://relay.momostr.pinkPublished at
2026-10-28 11:59:34 UTCEvent JSON
{
"id": "fae43c58b4f24d3ad8860c31f4568abd514ecc1b58eb184e803314111e4bc2f1",
"pubkey": "3f1c80e27c2798bfc441d6ab760fd14e038d7a44f0d0a7d7a69a2f3752f3fe1c",
"created_at": 1793188774,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.melin.org/@joacim/117518419547497561",
"web"
],
[
"proxy",
"https://mastodon.melin.org/users/joacim/statuses/117518419547497561",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.melin.org/users/joacim/statuses/117518419547497561",
"pink.momostr"
],
[
"-"
]
],
"content": "\"Every WordPress plugin runs inside the same PHP process as core, with the same access to your database and files. A slider plugin can read your users table. A form plugin can send your data to any server on the internet. There is no permission prompt and no way to limit what a plugin can touch. The amount of sandboxing is zero.\"\n\nhttps://hatamoto.dev/post/wordpress-20-years-why-we-built-hatamoto",
"sig": "637c16b7dbc4c58d4835790c2cb2cb7952131d0ee0f7653f179f4f8a240377872241a0b6de888be9bad6079f1b091badd287681779e29a2cb14bb981741eec6a"
}