AdultZone

Archives

bbPress: bbPress 2.6.15 is out!

bbPress 2.6.15 is a security and maintenance release that fixes five security issues and includes a few compatibility improvements. Everyone running bbPress should update as soon as possible. This release strengthens authorization around topic and reply editing, topic splitting and merging, user profile updates, and private or hidden forum visibility. It also hardens imported password verification, avoids PHP warnings on some forum requests, and improves compatibility with modern WordPress UTF-8 handling. All of these fixes have already been merged into the 2.7 development branch. Thank you to mickey_cyberkid, itznullbyte, eldoniis, and tristaninsec for reporting issues through HackerOne, and to Ananda Dhakal at Patchstack for reporting CVE-2026-74010. Thank you for helping keep bbPress communities safe! Download bbPress 2.6.15 from WordPress.org, or update directly from your WordPress dashboard.

How to Improve INP in WordPress (Interaction to Next Paint Guide)

Clicks that feel stuck have a name: INP. Learn what Interaction to Next Paint measures, how to test it on your WordPress site, and the fixes that work! The post How to Improve INP in WordPress (Interaction to Next Paint Guide) appeared first on Themeisle Blog.

#232 – Aaron D Campbell on Navigating WordPress Security in the AI Era

Transcript [00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, navigating WordPress security in the era of AI. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there. So on the podcast today we have Aaron D. Campbell. Aaron is a seasoned veteran in both the internet and WordPress space. With over 25 years of experience spanning agency work, security products, hosting giants like GoDaddy and Newfold, and now his role at Monarx, a company focused on malware detection and remediation, particularly for web hosts. He’s led, the WordPress Security Team, has been involved deeply in shaping security practises, and remains tightly connected to the WordPress ecosystem. We talk about the rapidly changing landscape of WordPress security, specifically how the advent of AI has escalated the speed, scale, and complexity of attacks, moving the security game from a battle of wits to a battle of compute power. Aaron discusses how attacks that once required human ingenuity are now orchestrated by AI agents, capable of chaining vulnerabilities that humans would struggle to conceive. We get into the shift from a reactive to a proactive security posture across the WordPress ecosystem. Aaron explains how both attackers and defenders are now deploying AI leading to an arms race, where AI is used to combat AI, and where collaboration among security teams is just as crucial as information sharing among adversaries. Which chat about the motivators behind attacks, spoiler, it’s almost always money. And the specific vulnerabilities WordPress faces as the most popular CMS on the web. Of interest is the narrowing window between when vulnerabilities are discovered and when they’re exploited, how supply chain attacks are on the rise, and what the WordPress “Protect the Shire” innovation means for plugin security. Towards the end of the episode, we explore practical security advice for everyday WordPress users, with Aaron, recommending actionable tips on updates, choosing security minded hosts, and monitoring for Compromise credentials. If you are concerned about how AI is reshaping the WordPress security landscape, and want to know how the community is responding, this episode is for you. If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well. And so without further delay, I bring you Aaron D. Campbell. I am joined on the podcast by Aaron Campbell. Hello, Aaron. [00:03:43] Aaron D Campbell: Hello, nice to be here. [00:03:44] Nathan Wrigley: Yeah. Thank you for joining me. We’re in a corridor. I should say that at the very beginning. We’re in a corridor at WordCamp US, and so if background noise becomes a problem, we’re just going to have to cope with it. So apologies. But thank you for joining me in a corridor. [00:03:57] Aaron D Campbell: Absolutely. [00:03:58] Nathan Wrigley: We’re going to talk today a little bit about WordPress security, and particularly about the advent of AI, and the way that certainly in the more recent past, it appears to have upended what once was normal, I think it’s fair to say. I think things are happening at a rate of knots that perhaps a year or two ago we wouldn’t necessarily have predicted. Do you want to just give us a little bit of background about yourself in terms of where you have worked, where you currently work, and what it is that you do for a living? [00:04:25] Aaron D Campbell: Sure. So I guess I have worked in the internet space for a very long time at this point. I guess 25 years-ish. Ran my own agency for a long time and then into security product in the WordPress space, and over into hosting at GoDaddy, at Newfold, at hosting.com. During that time I ran the WordPress security team for a couple years, have continued to be involved with it along the way, and now I am over at Monarx. We do malware detection and remediation, and have some security tooling for web hosts. So I’m still very tightly tied into that space on a few fronts. [00:05:09] Nathan Wrigley: Is Monarx a new company? Because it’s not one that may necessarily come into mind when we talk about security online, WordPress security specifically. So if you’re willing, could you just give us a little bit of a potted history of Monarx and what specifically you do in the WordPress space? I think it’s perhaps more related to hosting companies than it might be to end users. Just flesh that out a little bit. [00:05:33] Aaron D Campbell: Yeah. Monarx has been around probably longer than you expect, six or seven years. The name’s may be not as recognisable, because a lot of times we are a white label in the background. Hosts run us, and you may not know that. We protect more than just WordPress, but obviously WordPress is a big part of that. And we help hosts keep their users, their end users, safe and secure and malware free by monitoring the files, the runtime, having a WAF layer, protecting it several different layers along the way. [00:06:08] Nathan Wrigley: So is this kind of like a white label solution? You are in talks with hosts, many of which I’m sure we’ve heard of, but their purchase of the products and services that you sell is white labelled. [00:06:20] Aaron D

HeroPress: Building Beyond the Screen: My WordPress, Accessibility, and OZD Katalog Story – Ekranın Ötesinde Üretmek: WordPress, Erişilebilirlik ve OZD Katalog Hikâyem

Bu makale Türkçe olarak da mevcuttur. WordPress has never been merely a content management system for building websites to me. As a blind web developer, it showed me that I could create my own field of work, solve real problems, and contribute to the same open-source community as people around the world. The publication of my OZD Katalog plugin in the WordPress.org directory became one of the most visible results of that long journey. Exploring The Web Without Looking My name is Sadık Özdoğan, and I live in Ankara, Türkiye. I studied Web Design and Coding at Anadolu University in Eskişehir. Literature, poetry, and music are important parts of my life, but over the years web technology has also become a powerful means of expression and production for me. Because I am blind, I use my computer with the NVDA screen reader. Instead of seeing the visual layout of a screen, I follow the structure of pages, headings, links, form fields, and text through synthesized speech. This way of working means that a seemingly small accessibility error can become a complete barrier. An unlabeled button, an incorrectly built form, a message that is understandable only through color or imagery, or a control that cannot be reached with a keyboard may look like a minor imperfection to others, yet prevent me from completing a task. I did not want these barriers to distance me from technology. Instead, they encouraged me to understand how systems work and to create my own solutions. Discovering WordPress Discovering WordPress was an important turning point in that search. During my early years with it, I was mainly a user. I built websites, published articles, customized themes, tried plugins, and searched for solutions whenever something failed. The fact that much of the administration experience followed a recognizable structure and used text, headings, links, and standard form controls was valuable to me. WordPress was not perfectly accessible in every situation, but it gave me an open space in which I could publish my own content and gradually improve my skills. At first, I worked with existing themes and plugins. When I encountered a problem, I experimented with settings, read documentation and tutorials, and tried to understand the solution. In time, I realized that using tools was no longer enough for me. I wanted to know why a theme behaved in a certain way, which file controlled a function, and how an existing feature could be changed. That curiosity, which began with small code edits, gradually carried me from the user side of WordPress to the development side. Building Without Looking Customizing GeneratePress was one of my first serious learning experiences. I began by developing my own website and later built a radio website for a friend. I worked on themes for news, blogs, companies, and radio projects. Every project introduced a new problem that I had to break down and solve. Each detail I managed to fix increased not only my technical knowledge but also my confidence. My working method as a blind developer is different in some respects. I cannot inspect indentation or the visual appearance of a page simply by looking at the screen. I move between files, lines, and components with the keyboard and turn the information spoken by my screen reader into a mental model. I ask people I trust for visual feedback when necessary, while relying on standards, testing tools, and repeated trials for technical validation. This has taught me that accessibility is not an optional feature added at the end of a project. Clear code, accurate labels, understandable language, and predictable behavior make technology easier for everyone. A First Plugin For a long time, I wanted to publish a plugin of my own. However, there was an obstacle greater than my technical limitations: I did not trust myself enough. Questions such as “What if I cannot do it?”, “What if my code is not good enough?”, and “What if the plugin is rejected?” kept me at the starting line. Sometimes people wait for their work to become perfect and therefore never share it. My real change began when I accepted that I could start before I was perfect and continue learning along the way. Artificial intelligence tools also supported my learning process. They helped me examine questions in greater detail, understand pieces of code, identify possible mistakes, and turn ideas into more systematic plans. They did not imagine the project on my behalf or create it independently. I was the person who recognized the need, decided which features mattered, tested the result, and accepted responsibility for it. Artificial intelligence, my screen reader, and my development tools all served the same purpose: helping me turn an idea in my mind into a working product that other people could use. The idea for OZD Katalog emerged while I was building a website for a chair company. The company needed a clear and organized way to present its products. I initially created a catalog structure inside the theme. It could have remained a solution built only for that single project. As the work progressed, however, I asked myself: “Why should I leave this inside one theme? Why not turn it into an independent plugin and allow other people to use it?” That question was the true beginning of OZD Katalog. My aim was to help businesses display products in a catalog without requiring the full complexity of an e-commerce system. Administrators needed to be able to add product names, images, descriptions, categories, and relevant details in the dashboard, while visitors needed a clear way to browse the information. A need I had encountered in a real client project was becoming a general solution that could help others. I prepared the earliest version of the plugin about a year before its release. Along the way, I learned that there is a major difference between code that works and a plugin that is ready for the WordPress.org directory. Security checks, capability controls, nonces, sanitization, and output