WordPress 7.0 Launch Exposes AI API Keys to Theft Risks

• •WordPress 7.0 exposes AI API keys through browser autofill in the integration setup form.
• •The vulnerability could lead to significant financial losses, with stolen keys valued at tens of thousands of dollars.
• •WordPress co-founder claims most sites are secure, despite the new risks introduced by AI integrations.

On May 20, 2026, WordPress released version 7.0, which introduced an AI infrastructure that inadvertently exposed API keys due to a security vulnerability in the AI integration setup form. This flaw allows browser autofill to visually reveal sensitive API keys, potentially leading to significant financial losses as these keys can be worth tens of thousands of dollars. Security experts, including Patchstack founder Oliver Sild, warned that the combination of this vulnerability and existing plugin weaknesses could result in a surge of API key theft. WordPress co-founder Matt Mullenweg defended the platform, asserting that most sites remain secure. The issue highlights the increased risks associated with AI integrations in widely used platforms like WordPress, affecting approximately 43% of websites globally. The vulnerability is distinct from server-side breaches, as it exploits client-side rendering and form handling. As of now, no patches or fixes have been announced for this specific issue.