Security reports to WordPress on HackerOne sat at 20 to 30 a month for about a decade, then hit 450 in July and 773 in August, and John Blackbourn posted the graph with the reason attached: people now point Claude and GPT at core and let them read.

Click2Shell is what one of those bugs looks like. Fixed in 7.1.1, found by pwn.ai with Claude Opus 5 and one human in the loop, and the entire attack is a link. An admin who's logged in opens it, WordPress's own JavaScript clicks Install on a theme from the official catalog for them, the

Customizer loads that inactive theme's PHP, and a sloppy AJAX handler inside the theme pulls in whatever the attacker wants. The site's theme never changes. Nothing in the firewall log looks wrong, because every request came from the admin's own browser carrying the admin's own nonce.

So on the day that link went around, the firewall wasn't the variable. The variable was how many people could open it while logged in as Administrator.

I'm going through ours now and I already know the answer on a couple of client sites is going to be embarrassing, because "the client needs admin" was always the easiest ticket to close.

How many Administrator accounts are on the sites you look after? I'm asking because I suspect my number is normal and I don't like that.