Hacker News Reader

the reason why so many plugins and templates are insecure is precisely because they have access to that global scope and misuse it

View on HN

You're missing the point.

You're criticising 'plugins and templates' that make use of the global scope, while giving the WordPress core a free-ride for not just using global scope, but placing objects there that can be exploited.

That's exactly my point - the core is at fault for handing over global exec to the plugins and templates. It's a horrible design, and it appears there is little motivation to fix it but rather pass blame onto plugins.

Wordpress shouldn't be using any globals at all. That code doesn't just smell, it reeks.

Reply on news.ycombinator.com