1. Trevor Nelmes

    Sadly, whilst major economies have laws to punish this type of abuse, doesn’t stop it from happening, regardless if the (ex) employee knew the consequences or not.

    Your tagging example is a case in point. Most people know that, when stopped by a police officer, punching them in the face is not going to end well, but this happens every day.

    Judicial consequences have never been proven to be a deterrent to improper action, at least not to all the population. If, for example, the perpetrator was severely depressed, judgement will not enter into the decision to do the act. In many jurisdictions, that is no defense.


  2. Craig Simpson

    “The idea that a former employee who is known to the company would risk performing these illegal actions is difficult to grasp, even in the case of someone who was fired and may have been acting in retaliation. The risks of being caught seem too great.”

    People are caught for poorly thought out crimes of passion all the time.


  3. Miroslav Glavić

    This is what I did when I fired an employee at my company…

    1) I called security to cancel his security card/access card
    2) I cancelled his @companyname.com e-mail address
    3) I cancelled his access to everything in the company
    4) I called him and asked him to come to the office right away.
    5) When he arrived, security escorted him to my office.
    6) I took his cell phone (company cell phone).
    7) I asked him to sit down
    8) I cancelled the cell phone
    9) I told him that he was fired, explained the reason
    10) I gave him all his personal belongings from his office
    11) I called security to escort him out of the building
    12) Security escorted him out

    By security I mean 1 staffer that sits in the front desk of the first floor.

    WPML should of cancelled his access to the server and any company e-mail and so forth THEN fired him


    • Ciprian

      This sounds extreme.

      What about the notice period? Weren’t you supposed to let the employee know in advance?


    • Marc

      Seeing as they used an old SSH password, I would add to your list: audit all passwords to make sure there’s nothing lying around they could use.


    • Rafa

      And you still have employees in your “Company”? Treating people as criminals. What is it, a branch of KGB?


      • Miroslav Glavić

        How is this a branch of the KGB? All I said is an hour before you fire an employee, you cut off their access to the system/server and so forth.

        I had admin access to many companies I worked for over the years, even 3 years after I stopped working for those companies. THAT is a HUGE security problem.


    • Gerhard


      It is funny that you always know best and that your situations always apply to the rest of the world somehow.


  4. Ryan Hellyer

    This is a rather common scenario.

    I often have to contact companies to remind them to disable my access to their internal systems. I often discover I still have access many years later.


  5. Miroslav Glavić

    Apparently not in WPML.

    I wonder if what I said above applies in Automattic/WP.com.


  6. Thomas Senecal

    I don’t buy this. Why would someone risk their freedom for no financial gain. This isn’t a hacker it’s a whistleblower. If it was a backdoor exploit then why this statement:

    ‘We updated wpml.org, rebuilt everything and reinstalled everything. We secured access to the admin use 2-factor authentication and minimized the access that the web server has to the file system.’

    Why not just remove the backdoor if everything was already perfectly fortified?

    If a bank teller steals they don’t rebuild the bank…


Comments are closed.

%d bloggers like this: