AI WordPress plugins and the security risk nobody's talking about

Here's the AI WordPress plugin security risk nobody seems to be talking about: a lot of the new AI plugins flooding the market are vibe-coded by people who are not developers, and every one you install is code running on your live website with access to your site and often your data. That's an unknown exposure, and 'unknown' is the word that should worry you.

'Vibe-coded', if you haven't met the term, means built by prompting an AI to write the code and shipping whatever comes out, without the author necessarily understanding it. It's a real and useful way to build things fast. It is a genuinely risky way to build something that sits on your live server handling your business.

Why a plugin is different from an app you just use

When you install a WordPress plugin, you're not using someone's software at arm's length. You're installing their code directly into your site, where it can read your database, touch your files, and act with real privileges. A dodgy plugin isn't a bad experience you can close the tab on. It's a door into your website that stays open.

That's always been true of plugins. What's changed is the volume and the origin. AI has made it trivial to produce a plausible-looking plugin in an afternoon, so the market has flooded with tools built by people who can prompt an AI but can't necessarily spot the security hole the AI left in. The plugin works, it does the thing on the tin, and nobody involved has checked whether it also quietly created a vulnerability.

You're not using their software. You're installing their code inside your business.

The honest problem: I don't know what I don't know

I want to be careful here, because it would be easy to fearmonger and I don't want to. I'm not a security specialist. I can't look at most plugins and tell you they're safe or unsafe. And that's precisely the point: neither can you, and neither can the person who vibe-coded it. When nobody in the chain can vouch for the code, you're not making an informed risk decision - you're guessing and calling it a decision.

'I don't know what I don't know' isn't a cop-out. It's the correct starting posture for anything touching security. The dangerous person is the one who feels confident here without the expertise to back it. The safe move is to assume there are failure modes you can't see, and to act accordingly.

What acting accordingly looks like

You don't need to swear off plugins - WordPress runs on them. You need to be deliberate about which ones you let into your site.

• Prefer plugins from established developers with a track record, real support, and a history of patching issues.
• Be sceptical of brand-new AI plugins with big promises, few reviews, and no clear author behind them.
• Install the minimum you actually need - every plugin is another door, and fewer doors is a safer building.
• Keep everything updated, and remove anything you're not using.
• For anything touching payments, customer data, or admin access, get someone who genuinely knows security to look before you trust it.

The wider principle

This is really one example of a rule I try to live by: use AI for the mechanical work, but bring in real expertise for the judgement calls, rather than winging it because a tool made winging it feel easy. That's the same logic behind keeping a human in the loop across all of my SEO work - AI does the lifting, a human who actually knows the domain makes the call. Security is just a domain where the cost of a wrong, unsupervised call is unusually high.

It's also part of why I'm cautious about the whole category of autonomous 'set and forget' AI SEO tools, a lot of which arrive as - you guessed it - WordPress plugins. The convenience is real. So is the code you're now trusting with your site.

So my honest advice is unglamorous. Assume the flood of AI plugins contains real risk you can't personally assess. Lean on genuine expertise where the stakes are high. And treat 'I don't know what I don't know' not as an admission of weakness but as the sentence that keeps you out of trouble. I'd be happy to be proven overly cautious. I'd rather be that than the case study.