WordPress 7.0 Exposes AI API Keys

Search Engine Journal reports a security issue in WordPress 7.0 that can expose AI API keys through the AI integration setup form, where browser autofill may visually reveal a key. The article quotes Patchstack founder Oliver Sild on X: "WordPress 7.0 combined with plugin vulnerabilities = free AI tokens. There will be an absolute rush by hackers to steal API keys," per Search Engine Journal. The report says stolen AI API keys can be worth tens of thousands of dollars and lists attacker uses including running bot networks, scaled phishing, and generating malware, according to Search Engine Journal. The article also notes WordPress co-founder Matt Mullenweg pushed back, telling Search Engine Journal that the "vast majority" of WordPress sites are secure and that he has run some WordPress sites for over 20 years without being hacked.

Search Engine Journal describes the specific issue as arising in the AI integration setup form, where browser autofill behavior can make an API key visible in the browser UI. The report frames this as an exposure vector distinct from server-side breaches because it leverages client-side rendering and form handling. Search Engine Journal attributes the quoted concerns to Patchstack founder Oliver Sild.

Editorial analysis: Companies and plugins that integrate paid AI services such as OpenAI, Claude, and Gemini increase the economic value of credential theft, because stolen keys enable attackers to consume paid compute and to automate abuse at scale. Industry-pattern observations indicate that when attacker ROI rises, exploitation of opportunistic vectors such as autofill or plugin misconfiguration becomes more attractive to large-scale fraud operations.

Editorial analysis: WordPress is a ubiquitous content management system powering a large share of the web; therefore, even a narrow client-side exposure mechanism can have outsized impact when combined with plugin vulnerabilities. For practitioners, the report highlights that credential hygiene, client-side form handling, and plugin vetting are material risk factors when integrating paid AI APIs.

For practitioners: monitor official WordPress security advisories and Patchstack disclosures for a patch or mitigation; watch plugin update notes for changes to AI integration flows; observe public reports of stolen-key abuse campaigns that reference WordPress-sourced tokens. Also track whether browser vendors or plugin developers change autofill behavior for API-key fields.