{"id":108611,"date":"2025-01-03T15:12:39","date_gmt":"2025-01-03T13:12:39","guid":{"rendered":"https:\/\/themeisle.com\/blog\/?p=108611"},"modified":"2025-01-03T15:12:42","modified_gmt":"2025-01-03T13:12:42","slug":"wordpress-ticket-30465","status":"publish","type":"post","link":"https:\/\/themeisle.com\/blog\/wordpress-ticket-30465\/","title":{"rendered":"WordPress Ticket #30465 Was Opened 10 Years Ago – Is 2025 Going to Be the Year It Finally Gets Resolved?"},"content":{"rendered":"\n

Back in November 2014, a WordPress developer named Sergej Mueller raised what seemed like a reasonable concern: users had no way of knowing if a plugin they were using had been removed from the official repository – even if it was removed for security reasons. His ticket – officially #30465 – was closed relatively soon after, but with no resolution. Little did Sergej know that it would be reopened almost ten years later<\/strong>.<\/p>\n\n\n\n

And here we are, at the start of 2025, with me writing an update about it.<\/p>\n\n\n\n\n\n\n\n

Why?<\/p>\n\n\n\n

For a few reasons.<\/p>\n\n\n\n

First, it’s highly relevant to some plugin security events that happened recently – October of last year to be exact. I’ll talk about those shortly. And, second, the will and momentum to resolve the issue has been picking up some serious steam – the last activity on the ticket was less than a month ago:<\/p>\n\n\n\n

\"WordPress<\/figure>\n\n\n\n

So it looks as if Sergej’s patience might finally be paying off soon…<\/p>\n\n\n\n

Let’s start by retracing the development of the ticket. Then, we can move into what’s been happening with it in recent weeks:<\/p>\n\n\n\n\t\t

<\/div>\n\t\t\t
\n\t\t \t
\n\t\t \t\tWill a 10-year-old #WordPress ticket finally be resolved in 2025? \ud83d\ude32 \ud83d\udc1b<\/a>\n\t\t \t<\/div>\n\t\t \t
\n\t\t \tClick To Tweet \n\t\t \t\t<\/span>\n\t\t \t<\/a>\n\t\t <\/div>\n\t\t<\/div>\n\n\n\n

From “won’t fix” to taking the stage at WCEU 2023 \ud83d\ude45\u200d\u2642\ufe0f<\/h2>\n\n\n\n

When the ticket was first opened, it received a few responses but was shut down fairly quickly by WordPress lead developer Andrew Nacin. He closed it and marked it as “won’t fix,” explaining that plugin removals happened for various reasons, not only security issues:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

There was some flurry of commentary after that, but then it died down into a once-a-year<\/em> (sometimes even less than that) comment of someone attempting to revive the issue.<\/p>\n\n\n\n

Then, in March 2023<\/strong>, something interesting happened. Joost de Valk<\/a>, a well-known figure in the WordPress community, officially reopened the ticket<\/strong>. His argument was that WordPress has a responsibility to tell users whether a plugin is maintained or not.<\/p>\n\n\n\n

He also pointed out that WordPress.org was already showing this information on the platform itself, but only after a 60-day waiting period. His suggestion was to bring that same transparency to the WordPress backend where users actually manage their plugins.<\/p>\n\n\n\n

That set off a new wave of enthusiasm<\/strong> across the thread. The ticket grew so popular<\/strong> that Oliver Sild<\/a>, the CEO and co-founder of Patchstack<\/a>, even mentioned it in his WCEU 2023<\/strong> speech:<\/p>\n\n\n\n

\"Oliver<\/figure>\n\n\n\n

Not only did he mention it, but he encouraged the WCEU attendees to leave comments on the thread by using the custom QR code that he added to his presentation. He also used this plug as a delayed alley-oop for a contest that Patchstack would host the following year.<\/p>\n\n\n

<\/div>\n\n\n\n

Patchstack’s October 2024 event \ud83e\udeb2<\/h2>\n\n\n\n

In October 2024, Patchstack launched a Bug Bounty event<\/a> as part of Cyber Security Month. If Oliver’s mention of ticket #30465 in his WCEU speech was the alley-oop, then the results of this event would be its slam dunk.<\/p>\n\n\n\n

Security researchers who participated in the event, ended up discovering a staggering 1,571 valid security vulnerability reports in a single month. These weren’t just minor issues either – we’re talking about:<\/p>\n\n\n\n