[TimTheTinker]

Third-party plugins are subject to WordPress's security model and implementation.

Automattic could create a PluginV2 system with tightened security and new requirements for plugin developers, then put a plan in place to deprecate and remove support for v1.

[gwern]

Yes, after 18 years of WordPress development, the architects' excuse of blaming bad actors in plugin ecosystem has begun to wear thin, especially when contemporaries or predecessors like Firefox or Debian never had remotely the same level of problems with their users being hacked constantly by plugins/packages.

[JimDabell]

“No Way To Prevent This,” Says Only CMS Where This Regularly Happens

[lmm]

Firefox has had the converse problem of constantly breaking all their plugins by changing their APIs etc..

[kmeisthax]

They were able to fix this by moving to the WebExtension model instead of letting extensions directly interface with XUL/XPCOM[0]. Of course, then everyone got angry that they couldn't do ridiculously invasive changes to the browser with an extension anymore.

[0] which were then massively refactored, twice.

[Karunamon]

...and face a fully justified user/dev revolt that makes Mozilla's worst day look like a single angry tweet. Remember that there's a massive paid ecosystem around WP plugins & themes, not to mention the stuff Automattic sells (hosting, their own plugins, etc.)

They can't afford it, and most people don't want it. I think history shows that taking flexibility away from something popular because of its flexibility is not good business. At least you can install a plugin now and completely sidestep this awful 'site builder'. If that goes away, hoo boy.

[BarryMilo]

Death by a thousand cuts it is then.

[aksss]

Wish Microsoft put some thought into this before completely kneecapping the start menu customization and capability in Windows 11.

[schroeding]

Honest question, how would that work?

PHP code is not sandboxable (ignoring the ability to disable functions), AFAIK. Is it? So plugins do have complete (read) access over the entire code, the secrets in the config files, the database etc.?

Not allowing plugins to directly execute PHP code would either fundamentally break the wordpress plugin model or require an interpreter for a turing-complete "wordpress plugin programming language", right? That would kill any performance, especially on uncached wordpress instanced, even on PHP 8, wouldn't it?

[pwdisswordfish9]

Maybe run it on Peachpie (which should already give perf gains) and go with the new plugin model.

[paulryanrogers]

WP doesn't control where folks host it. Limiting its support to one .Net implementation would severely limit its market.

[TimTheTinker]

> PHP code is not sandboxable

People said the same about JavaScript, and yet smart people figured out ways to do it. For example: https://github.com/googlearchive/caja

PHP may be particularly challenging to sandbox, but it's not too much for talented engineers to figure out.

As a near-last resort, a secure PHP subset language could be developed.

[withinboredom]

You can sandbox php by changing the context the thread is running in before entering the plugin code. The issue is that there’s (currently) no delineation between internal code and plugin code (actions / filters) and changing back out of that context without a plugin doing the same to escape the sandbox.

[Gigachad]

I think it's probably too late to save wordpress. Squarespace and such are just better products for the average company. It would require a fundamental redesign of wordpress to solve its issues and at that point it just becomes a clone of the existing products.

[noahtallen]

You might be surprised to learn that:

> WordPress is used by 65.3% of all the websites whose content management system we know. This is 43.3% of all websites. [1]

And these numbers have been growing for years. In other words, WordPress is and will be widely used for a long time. So I’m not sure WordPress really needs saving. :p The number of OSS contributors has also been growing. So the project itself hasn’t been stagnating either.

Disclaimer: I’ve been a WordPress contributor and work for Automattic.

1: https://w3techs.com/technologies/details/cm-wordpress

[Gigachad]

Sorry, I didn’t mean in a popularity way. But security wise, I don’t know how it would be possible to make Wordpress secure when the average user installs a bunch of plugins / themes and then leaves never to update it again. I just can’t see how this can work without becoming a fully managed platform.

[cblconfederate]

They should never do that. People who want walled gardens should go with a rented solution from one of those website builder companies