WordPress 7.0 Ships With a Security Problem

WordPress 7.0 launched with native AI integration built in. That means plugins and themes can now connect to AI services like OpenAI, Claude, and Gemini directly through the platform. But a security researcher found something alarming. The AI API keys that developers use to connect these services are being stored in ways that make them publicly accessible.

The researcher, who goes by the handle Brain, published findings showing that WordPress 7.0 was exposing AI credentials in configuration files that can be read by anyone with basic access to a site. The keys are worth real money. A single OpenAI API key can cost hundreds of dollars per month depending on usage. Hackers know this.

Why Hackers Want API Keys

API keys are like passwords. They let a program talk to a service on your behalf. When someone steals your API key, they can use your account and pay your bills. For AI services, that means running up your token costs, accessing any data connected to your account, and using your quota for their own projects.

The security researcher said there will be an absolute rush by hackers to steal these keys once the vulnerability is widely known. AI services do not always flag unusual usage patterns fast enough to stop abuse. By the time a developer notices their bill spiked, the damage is already done.

Who Is Affected

Any WordPress site running 7.0 with AI plugins or themes is potentially exposed. This includes sites using AI writing assistants, chatbots, image generators, or any tool that connects to OpenAI, Anthropic, Google, or other AI providers. Site owners who installed AI integrations during the 7.0 rollout did not know their credentials were visible.

The issue is compounded because many small business owners do not check their configuration files regularly. They install a plugin, paste an API key, and forget about it. That key sits there exposed while they assume their site is secure.

How to Check If Your Keys Are Exposed

Log into your WordPress site and navigate to the plugin or theme settings that use AI. Find the field where you entered your API key. If you can see the actual key characters instead of dots or asterisks, your key is stored in plain text and may be accessible.

Check your wp-config.php file and any configuration files your AI plugins created. Look for lines containing API_KEY, OPENAI_KEY, ANTHROPIC_KEY, or similar. If these are stored as plain text rather than environment variables, they are at risk.

What You Should Do Right Now

First, regenerate any API keys that you suspect were exposed. Go to your AI service account, revoke the old key, and generate a new one. Second, move your keys to environment variables instead of pasting them directly into WordPress settings. Most AI plugins support this. Third, restrict which IP addresses can use your API keys if your AI provider offers that option.

WordPress users should also check for plugin updates. Developers are rolling out patches that fix how credentials are stored. Keep everything updated and monitor your API usage for any spikes you did not authorize. Set up billing alerts so you know the moment your bill changes unexpectedly. That early warning can save you hundreds or thousands of dollars.

The Bigger Picture

This incident shows how fast the WordPress ecosystem moves to adopt new technology without proper security review. AI integration is now a core feature of WordPress 7.0, but the security practices have not caught up with the risks. Plugin authors need to treat API keys like they treat database credentials, and WordPress itself could do more to warn users when they are about to expose sensitive data.

Until then, the burden falls on site owners to understand what they are installing and how it stores sensitive information. That is a lot to ask from someone who just wants a working website. But the alternative is losing control of your AI account and watching your bills climb for services you never used.

Sources

Want to improve your marketing results? Visit XerAds for proven strategies that drive real results.