WordPress Application Passwords: Audit Yours in 5 Minutes
At the end of August, a developer looked inside one of the most widely installed SEO plugins on WordPress and found that opening its help panel handed out a working key to the site. Not a token scoped to one job. A WordPress application password carrying whatever permissions the person clicking already had — which,…