# The Core Is Fine. We, the People, Are Broken.

> WordCamp Sofia had a quarter fewer people this year. WordPress did not lose them. Our egos, our attitude towards change and our lack of listening did.

- Canonical URL: https://laskov.dev/posts/wordcamp-sofia/
- Published: 2026-10-25T00:00:00.000Z
- Author: Hristo Laskov
- Section: WORDPRESS
- Keywords: wordpress, woocommerce, community, security, opinion
- Tags: wordpress, woocommerce, community, security, opinion
- Site index for agents: https://laskov.dev/llms.txt

---

Yesterday I spoke at WordCamp Sofia after an 8-year pause. Great panels, great speakers, and
organizers who once again did an outstanding job. The core is fine, as it has ever been. Good
things end up here.

About 300 people came. Last year it was 400. **A quarter of the room is gone in 12 months. 
And these are not AI-eliminiated jobs. These are people lost for the cause.**

But I do not think WordPress lost those people. I think we did, for three key reasons:

- our egos
- our attitude towards change
- our lack of listening to end users and clients

## 1. Our egos

People started publishing plugins for the sake of publishing plugins. F\*\*k quality, f\*\*k
security. Ship it, collect the stars, move on.

And now people publish plugins for the sake of giving somebody the finger. Literally. This was
posted in the Bulgarian WordPress community group:

![A Facebook post in the WordPress Bulgaria group announcing a free security plugin on wordpress.org, created to show a middle finger emoji to the developers of paid security plugins.](/assets/images/wordpress-bg-middle-finger-plugin.png)

Translated: *"This security plugin for WordPress rivals all paid (commercial) plugins and is
completely free. Free forever. No 'trial' versions or limited features. I created it to show
one big middle finger 🖕 to the developers of paid security plugins. If you try it, you will
understand exactly what I mean. Enjoy!"*

The proud author has since deleted the post. The plugin is still out there.

Read it again. A **security** plugin. Not built to protect anyone. Built out of spite, aimed at
other developers, and pushed to site owners who will install it because it says "free" and
"security" in the same sentence. That code now sits between real businesses and the internet.
Spoiler alert: I have checked it. It is not so secure itself. The author may contact me if he
wants feedback.

This is ego in its purest form. The plugin is not about the user. It is about the developer, his
grudge and his audience. And this is what freedom looks like in the wrong hands. Nobody stopped
it, nobody had to approve it, and the people who pay for it will be the clients who never saw
the post in the first place. Free is free, with every side effect that comes with it. Clients do
not care about developers who build plugins out of spite. They want fast, reliable and secure
websites.

The numbers say it is not an outlier.
[Patchstack's 2026 report](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/)
counts 11,334 new vulnerabilities in the WordPress ecosystem for 2025, up 42% in a year. About
91% are in plugins and 9% in themes. WordPress core had six (and yes, this year we had [WP2Shell](https://wp2shell.com/), the first
core RCE discovered in a decade or so). Nearly half had no fix at the moment of disclosure, and
the most attacked ones were mass-exploited within about five hours. We have had that experience
ourselves, but I will tell it some other time.

Core is fine. **We are the vulnerability.** The 40-plugin site with no update plan, built by
someone who has never read the code they installed, is not a WordPress problem at its core. But
in the eyes of the client it is **a WordPress problem**.

## 2. Our attitude towards change

Yesterday Lyubomir Rusanov from [JetHost](https://jethost.bg/) said something that stuck with me.
Twenty years ago WordPress gave freedom to the internet. Making a website became easy. Now it has
to reinvent itself to keep that image, because today "a website on WordPress" is associated with
bloat, poor security, and not many other good things.

He is right, and it hurts because it is fair. WordPress is not losing ground because it is poor
technology (well, there is some of that as well, but that is another discussion). It is losing
ground because of what we built with it, and how. Part of PHP's poor image comes from WordPress
and poor developer practices too. And yes, I have been part of those practices. Perhaps somewhere
I still am. But it's not about what you have done. It is about what you have become after taking
your mistakes into account. 

When the world around us changes, we tend to do one of two things. We get defensive: Shopify is
for amateurs, page builders are fine, it has always worked this way. Or we run: rewrite it all
in the new thing, and solve the same old problems again in a newer syntax. Both are ego again,
just dressed differently.

Meanwhile Shopify and the other hosted platforms package exactly the work we keep skipping,
infrastructure, security, accessibility, into one predictable monthly bill. On paper, at least.
Lock-in, transaction fees and an app store full of plugins with a subscription attached are all
part of that deal. But the client who picks it is not stupid. They are tired of us.

Real change looks different. It looks like WooCommerce moving orders out of `wp_posts` and
`postmeta` into their own tables with
[High-Performance Order Storage](https://developer.woocommerce.com/docs/features/orders/high-performance-order-storage/):
slow, careful work on the shared foundation, with a migration path, so that thousands of shops
can grow without starting over. Not a rebrand. A better base.

## 3. We stopped listening

Four days ago we had [PHP2Shell](/posts/php2shell/). My team spent the whole of October 21st, and
the better part of the night and day on the 22nd, on logs, patches and verification.

The clients did not care about any of it, and they should not have to. Patching, backups, a
plugin with a hole in it: that is the part of the iceberg under the water. The client sees the
tip. The site is slow, orders get lost. When the site gets hacked, it is their business that
bleeds. They should not have to care about somebody's middle finger towards somebody else. They
pay us to own everything related to their website.

Every time we make the client deal with our mess, we throw stones into their garden, and into
WordPress's garden too.

And we do it because we stopped listening. A project starts, and ten minutes in we already have
an opinion on the framework, the plugins, the hosting. The person across the table is still
explaining how their orders work and what they want to do next year. We nod. Yes, yes, yes.
That is not listening. That is waiting for our turn to talk about the stack.

Shopify listened. Cloudflare listened. Next.js listened. Others listened. And here we are.

## Where we stand

I am not neutral on this, so I will not pretend to be. This is what my team and I are doing
about it, and why.

- **We invest in infrastructure.** Patching, tested backups, monitoring and the ability to fix
  things without a vendor's panel. Because the work under the water is the work clients actually
  pay for, and the bad day is when it gets tested.
- **We invest in training.** In our own people first. Security, infrastructure, accessibility,
  the business side. Because freedom over the whole stack only turns into value when someone
  understands the whole stack.
- **We solve people's problems, whatever the stack.** WordPress, Laravel, Shopify, something
  else. The client came with a business problem, not a technology preference. Our job is to
  solve it, not to hand them new problems that come with our favorite tool.
- **We treat every plugin and library as a responsibility.** Each one gets a reason to be there and a person
  who owns its updates. Because every plugin we add is a promise to the client.
- **We build accessible by default.** Because a site that some people cannot use is not finished,
  and with the European Accessibility Act in force, for many clients it is also the law.
- **We go out, listen and share.** Conferences, trainings, community events, and not only the
  WordPress ones. We listen to people on other stacks, because they may have already solved our
  problem. And we share what we learn, mistakes included, because that is how all of us started.
  Because we also tened to have lost our hearing. It is well about time to get it back. 

## WordPress is a tool for other people's freedom

In [my talk](https://ux2.dev/wordcamp/index.html#1) I called WordPress a door. I will go further.

WordPress is a tool. Its purpose is to solve other people's business problems and give them the
freedom to grow. Freedom to epxress themselves. Twenty years ago it did exactly that for the whole internet. 
It can do it again, but only if the people holding the tool remember who it is for.

**The core is fine. It is up to us to fix the rest.**