#wordpress 2026-07-20

2026-07-20 UTC
jack, visitor, Cucklefuck, [artlung], [niklasfyi], [aciccarello] and lukas joined the channel
#
gRegor Opened a new version of the stale issue since sebsel also reported it happening: https://github.com/pfefferle/wordpress-webmention/issues/619
courtneyr_dev joined the channel
#
[capjamesg] [tantek] it looks like the spam was in here too.
#
[capjamesg] (I don’t have permissions to delete in Slack.)
#
[tantek] thanks for the heads-up [capjamesg]
#
[tantek] did you kick/block the account on Discord?
#
[tantek] I'm on it for Slack + logs
#
courtneyr_dev Hey folks - I've been working on a WP plugin to support Post Kinds in block themes. I've gotten approval to submit it. :D I did a security audit of the plugin, and its dependencies, and found something to disclose. Can you point me to the disclosure policy?
#
courtneyr_dev Actually, I found the maintainer of the dependency in the Make WP Slack and DM'd them inquiring how they'd like me to disclose. If you see a message from Courtney, hi :)
#
courtneyr_dev In the meantime... https://github.com/courtneyr-dev/post-kinds-for-indieweb anyone want to help test? I have one more plugin coming along soon. A PWA for making it easy to publish to your own WP site from a mobile browser, supporting XFN, Post Formats, and Post Kinds.
#
Loqi [preview] [courtneyr-dev] post-kinds-for-indieweb: WordPress plugin extending IndieBlocks with IndieWeb Post Kinds support, external API integrations, and media tracking
#
courtneyr_dev for the plugin repo, I'm appending "Post Kinds for IndieWeb with Block Themes" to ensure it is clear that this brings Post Kinds up to the gutenberg world.
dithernaut joined the channel
#
gRegor what is post kinds plugin
#
Loqi The Post Kinds Plugin is a WordPress plugin that adds support for responding and interacting with other sites to the classic editor WordPress https://indieweb.org/Post_Kinds_Plugin
#
gRegor Is that the plugin you need to disclose for?
#
gRegor If so, I believe GWG maintains that
#
courtneyr_dev I'm hesitant to say given how quickly models these days can find the exploits and wish to be incredibly sure I disclose ethically. I have messaged the maintainer of the specific plugin inquiring how they'd like to get the details. If they don't reply in Make WP Slack, I'l swing back here to find an alternative way to disclose.
#
courtneyr_dev The wp security from Friday took the security researcher less than 15min with a frontier model to find and reproduce. Insane.
#
gRegor Hesitant to say the plugin name?
#
gRegor GWG is David Shanske mentioned in your plugin readme, here in this chat.
#
GWG Just send me a message... I don't use the block editor which is why I never updated it, but if there is a problem with the functionality I handle it rather quickly
#
GWG PRs also welcome
#
GWG I haven't logged into the WordPress slack in ages to be honest...
#
GWG I am on the Slack here, and Discord, and IRC
#
GWG And https://david.shanske.com/contact-me/
#
GWG And I have an old contact form
#
Loqi [preview] You can use the contact form below which will send me an email. [contact] Subscribe Subscribe to receive an email about new posts. [sendy_subscribe list="czcEOgXHWjPrpjspSyZr2w"]
#
GWG The lesson is I need to refresh my plugins regardless
#
GWG Personaly if I knew someone was interested in doing blocks... I would have proposed we split the data part and the presentation parts to allow for both
#
GWG Sent message to Courtney's contact form
#
courtneyr_dev heh, thanks!
#
gRegor Noticed the WP directory shows post kinds hasn't been tested with latest three versions
#
courtneyr_dev To be clear, I'll rule out vulns in the existing post kinds. I didn't build off that one, as it was getting dated.
#
courtneyr_dev prepping the email
#
GWG gRegor: I'm behind on my maintenance.. but I did test it... I should update that
#
GWG courtneyr_dev: Wish I knew someone was interested in pursuing an update.. would have helped if I could
#
courtneyr_dev Email sent. I need to head off for the day, but will check bac in email and can be found in the Make WP Slack if ever needed
#
tantek.com speaking of exploits, heads-up WordPress folks: https://wp2shell.com/
#
tantek.com [edit] speaking of exploits, heads-up WordPress folks: https://wp2shell.com/