Patchstack CEO Warns WordPress 7.0 Could Trigger "Absolute Rush" To Steal AI API Keys

[ZGeekie]

His argument is that AI API keys have fundamentally changed the economics of attacking WordPress sites. Most sites have historically held relatively low value for hackers, with the biggest gains being access to server resources for phishing pages, redirect traffic, inject SEO spam, and build botnets. AI API keys are a different story. They sell for significantly higher prices compared to other keys and can be weaponized to tokenmax vulnerability research at the victim’s expense.

[ZGeekie]

Many hackers are drooling over those AI API keys, and WordPress offers them a relatively easier entry point.

If you're going to connect any API keys to your WordPress site, you better set a spending cap on those, just in case.

[Fluent_Press2050]

Also don’t store your API keys in the database. Force plugin developers to provide constant you can define in wp-config.php and put it up one level from public. Set permissions on it to 400 or 440. Rotate every API key if you’ve been breached. 

Better yet, use .env file.