Dumitru Brînzan

Freelance WordPress/Web Developer, Photographer and content creator.

[Dumitru Brînzan @dumitru]

@ciorici Claude loves using Inter :)

[Sybre Waaijer @SybreWaaijer]

Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites.

The file: wpforms-lite/src/SetupWizard/Bridge.php.

What it does:
It takes over your browser and opens their app on WPForms' servers. It hands that app a one-hour login token for your site. Their app can then act on your behalf on your site.

What they can do with it:
Their app can install and activate plugins. It can also turn on a switch that starts sending your form submissions to WPForms' servers. The plugin never asks first and never warns you.

When it runs:
It kicks in automatically on a fresh install during setup, only for administrators. You won't get a notice. The token expires at the end of setup, or after an hour.

What they can install:
Thirteen plugins from WordPress dot org: WP Mail SMTP, WPConsent, Uncanny Automator, AIOSEO, Universally, Duplicator, Reviews Feed, OptinMonster, MonsterInsights, ActiveLayer. Oddly (probably a bug), also Contact Form 7, Ninja Forms, and Pirate Forms.

They can also pull WPForms addons and WPForms Pro from their own servers. These servers are not moderated and could be used to push malicious code—which ought to be expected, given their track record.

Extra context:
Awesome Motive is employing and has hired WordPress Plugins Team members.

[Dumitru Brînzan @dumitru]

It is crazy to see how petty and unprofessional @automattic (@wordpress) is. Truly disgusting. Blocking comments is the cherry on top. #wordpress

[Dumitru Brînzan @dumitru]

https://t.co/Yb9uzrjvkG

[Dumitru Brînzan @dumitru]

After more than a decade, Gmail is killing POP3 fetching from third-party email accounts in January 2026. Another nudge toward paid ecosystems. Disappointing.

[Dumitru Brînzan @dumitru]

Do you know the joy of adopting the Block Editor (Gutenberg) for your #WordPress website? Discovering months/years later new default CSS code like this: .wp-block-columns { flex-wrap: wrap !important; }
!important is a sure sign of top quality CSS!

[Independent Analytics @AnalyticsForWP]

Looking for something simpler than Google Analytics? Check out this awesome review of Independent Analytics by @dumitru: https://t.co/gEiMkE4HFk

[Dumitru Brînzan @dumitru]

@mattmedeiros @gravityforms Hm, you are indeed correct. I went to the Regenerate Thumbnails dashboard and saw that the 3 custom image sizes are registered. But running the plugin skips them during the regeneration process. Cool! Thank you :)

[Dumitru Brînzan @dumitru]

Attention @gravityforms users. GF Version 2.9.0 (November 2024) added a new "Image Choice" field. Because of it, there are now 3 custom image sizes. Now you get 3 extra files for every image in your media library. This is NOT good. #wordpress

[Dumitru Brînzan @dumitru]

@rossmorsali Correct me if I'm wrong, but the code is OK. The only "mistake" is the comment, but that is somewhat irrelevant.

[Dumitru Brînzan @dumitru]

1,713 new #WordPress themes launched in 2024 in the repository—most are struggling for installs. Automattic, which has flooded the directory with 101 themes, sees many of them barely break 50 active installs.
https://t.co/veqYAx7s4r

[Dumitru Brînzan @dumitru]

@DuaneStorey Me thinks someone's ass is burning.

[Dumitru Brînzan @dumitru]

@ajaymalikpro I would guess that the plugin is simply tricking PSI specifically. CrUX and Debugbear data looks a lot worse than what PSI shows. Trickery might be afoot.

[Dumitru Brînzan @dumitru]

@thekevingeary Is this a joke? Because it is not funny.

[Dumitru Brînzan @dumitru]

I use the free SiteGround Speed Optimizer WP plugin on all my personal and client websites. I made a detailed video tutorial about it: https://t.co/siwPAIJVHD #wordpress @SiteGround

[Dumitru Brînzan @dumitru]

Would love to see @richtabor work a little on his amazing Merlin WP tool. Implementing it in 2025 is a bit weird and buggy :(

[Dumitru Brînzan @dumitru]

@WPTutz The best part is the sheer fear of touching anything once you've finally got your page looking the way you want it. One wrong move, and it's chaos. 🙃

[Dumitru Brînzan @dumitru]

@bbelau @TheCre8tiveDiva @SiteGround Can you please elaborate on the "useless"ness of their caching plugin?

[Dumitru Brînzan @dumitru]

I was today years old when I found out that audio extension cables exist and they cost just a few $.

[Dumitru Brînzan @dumitru]

If you keep your domain names at @namedotcom, you might want to double-check the Junk folders in the email provided by your hosting provider. @SiteGround blocks all of them.