WP Meetup Amsterdam: The Attacker That Never Logged In & Ask Me Anything

October was a rough month for anyone running PHP. The PHP2Shell vulnerabilities had the whole web scrambling to patch, and we all got a fresh reminder of how thin the line between “secure” and “pwned” really is. So you updated PHP, you run a firewall, you enforce 2FA. Job done? Not quite. Because there is a whole category of attacks that doesn’t need a vulnerability or a password at all.

They didn’t guess the password. They didn’t break 2FA, bypass the firewall, or trigger a single alert. The activity log shows no failed attempts, no unusual login times, no new accounts created. And yet, the attacker is inside your WordPress dashboard.

Session hijacking leaves no login trace, because the attacker never logged in. They took an authentication cookie and reused an existing session. To WordPress, every request looks legitimate; the real user’s credentials, their 2FA, their login restrictions: none of it applies. The session was already authenticated. Most WordPress security advice is built around hardening and protecting, but that leaves a critical blind spot: what happens after authentication succeeds?

In this talk, Robert Abela walks through how WordPress creates and validates authentication cookies and session tokens, explores the real-world scenarios where sessions get stolen, and maps out what an attacker can do with a hijacked session before the damage becomes visible. Then it gets practical: session visibility, timeout policies, concurrent login controls, device recognition, and activity logging that captures post-login behaviour. These are the controls that catch what firewalls and 2FA miss. Firewalls, 2FA, and passkeys are essential. This talk covers what comes after them.

Robert Abela is the CEO and Founder of Melapress, developers of user visibility, security, and management plugins for WordPress. With more than 20 years of experience in software development and cybersecurity, Robert has held R&D, product management, and leadership roles at security software companies including Acunetix, where he managed the development of a leading web vulnerability scanner. Today, Melapress plugins are active on more than half a million websites, helping businesses and organizations of all sizes strengthen their WordPress security posture and simplify user management. Some of you may remember Robert from our February meetup on the weakest link in WordPress security. He’s back, and this time the weakest link isn’t the user.

After the break we use the power of the WP community: to share knowledge and to help each other. In the Ask Me Anything you can ask your question to the other attendees. Stuck with a problem on your WordPress site? Were Google and ChatGPT not really helpful? You are a developer but need some design advice? Or vice versa? Still not sure if your PHP is patched? Bring it along.

Schedule

19:00 Walk-in
19:15 Robert Abela: The Attacker That Never Logged In – the Blind Spot in WordPress Security
19:55 Break
20:15 Ask Me Anything: share your WordPress questions
20:45 Open Call 🔔
21:00 Drinks @ the bar