Taking Responsibility for WordPress Security

Matt MedeirosOct 19, 2026

Take it easy.
We'll cache you outside.

Pressable is proud to support the WP Minute. We had a whole pitch ready about how Pressable MCP makes everything you do easier, but take care of you first. Go drink some water. Have another cup of coffee. Take a deep breath. Go for a walk. (We're ready to chat managed WordPress hosting when you're ready.)

Eric's Notebook: Taking Responsibility for WordPress Security

I don’t comment on WordPress-related news as much as I used to. Why? I think it’s a combination of fatigue and being focused on everyday work/family stuff. However, something of interest comes along every so often. This is one of those times.

WordPress Executive Director Mary Hubbard recently sent an email to 30+ companies and asked them to fund the project’s security program. I encourage you to read The Repository’s stellar coverage to get the full picture.

Long story short: AI has fueled a rise in reported security vulnerabilities. The program’s bug bounty program, funded entirely by Automattic, has paid over $90,000 in 90 days – nearly half of the program’s all-time payout. Hubbard is now asking the biggest companies in the WordPress ecosystem to contribute by donating cash or human resources to keep up with demand.

This is perfectly sensible on the surface. Web hosts, agencies, and plugin developers all play a role in security. The stakes couldn’t be higher, as malicious attacks become more sophisticated. Bringing the best and brightest minds together will benefit everyone.

Classified Listings (Buy yours)

WP Client TrainingWP Client Training is a course designed specifically for WordPress experts who need to prepare clients to maintain a WordPress website.

Omnisend Ask ChatGPT or Claude things like "What drove revenue this week?" or "What's my campaigns missing?" - it'll answer using your real, live data. No exports, no tab-switching. Just ask.

Pressable MCP Managed Hosting just entered the chat. Ask your AI to create sites, pull & analyze logs, automate reports or run WP-CLI commands. With just a prompt. Weeks of work, done over a cup of coffee.

Kuztek Searched the plugin directory and came up empty? Kuztek builds the WordPress plugin that doesn’t exist yet.

There are many opinions on Hubbard’s request, but most recipients seem to be open to contributing. Once again, governance is at the center of the discussion.

I’d love to see an independent security alliance where contributors can carry out their mission with transparency. It should include not only the WordPress project, but the entire ecosystem. Plugins, themes, and hosting must be rock solid to keep WordPress at the top. After all, a weak link in the chain impacts users and stakeholders alike.

The obvious benefit is better website security. But there’s also something to be said for collaboration. Wouldn’t it be nice to see people work together across whatever business and philosophical differences we have? This sort of cooperation for the greater good is something our community needs.

Perhaps I’m naïve, but I believe this is an opportunity for something good to happen. Here’s hoping Hubbard’s outreach is the first step.

What we published this week

AI Built the Plugin. Now What?

Eric joins Matt to talk about Karks CRM, an open-source CRM and invoicing plugin he built to replace his aging QuickBooks Desktop workflow. Claude did much of the coding, but Eric provided the direction, testing, revisions, and real-world business requirements.

Watch or Listen

Improve Your WordPress Skills for Free

Here at The WP Minute, we’re all about helping you level up. That’s why we keep expanding our course library. Each course is designed to teach you valuable skills in bite-sized pieces. In other words, we built them for busy WordPress professionals like you!

We encourage you to check out our latest free courses:

How to get started contributing to WordPress: Topher DeRosia guides you on the journey from being a user to becoming an active member of the global WordPress community.
JetHost for Agency Owners: Ben Meredith provides an honest look at how to make hosting a true partner in your agency through a combination of AI and UI tooling and fast (human) support. JetHost is a Pillar Sponsor of The WP Minute.
Omnisend for Agency Owners: Follow along with Ben Meredith as he shows you how to deliver high-value email marketing services, automate cart recovery, and use AI-powered workflows to audit and manage Omnisend accounts for your clients. Omnisend is a Pillar Sponsor of The WP Minute.

Stay tuned for more course announcements in the near future!