In reply to Plugin Vulnerabilities.

We were curious to see what, if any, security expertise the new team members had, since the team needs more of that. In looking in to that, what we found instead are a couple of issues that raise concern about the change in the team members. Those issues involve the plugin tied for the second most popular coming from the new team member, Easy Forms for Mailchimp.

The first issue is that while the ownership of the plugin changed hand to the team member 9 months ago, the old developer is still listed as being the developer. New developers failing to disclose ownership changes of plugins in the Plugin Directory has been a known issue for some time and it is a security concern. To have a new member of the team not having addressed that issue before being allowed to join the team is troubling.

More troubling is that the plugin contains easy to spot vulnerabilities caused by a lack of basic security. Those security issues should have been caught by a minimal security review of the plugin. That they are still there raises questions about what vetting was done of the new members and whether they have the expertise to be handling security portion of their role.

More details of what we found are at https://www.pluginvulnerabilities.com/2023/07/05/issues-with-plugin-from-new-wordpress-plugin-review-team-member-raises-fresh-concern-about-team/