WordPress plugin quirk resulted in UK Gov OBR Budget leak [pdf]

Plugin behavior and WordPress ecosystem

• The “quirk” was that the Download Monitor plugin created a public “clear” URL to the live PDF that bypassed WordPress’s scheduled‑publish/authentication logic, and server‑level protections weren’t configured to block direct access.
• Several commenters argue this isn’t really a WordPress bug but expected behavior plus misconfiguration; others say WordPress’s lack of a built‑in private file system is itself a serious design flaw.
• Broader criticism of the WP plugin ecosystem: weak governance, volunteer moderation, ownership changes, upselling, and plugins silently changing behavior on update.

Misconfiguration and predictable URLs

• By default, WordPress uploads go to a public directory with guessable filenames; the OBR’s filename pattern was trivial to predict.
• Logs show repeated failed requests to the final URL before the file existed, implying some actors were polling for it in advance, likely via automated scripts.
• Commenters note this pattern is common for scraping economic releases, central bank minutes, etc.; some see no need for an insider to explain it.
• Cloudflare/WP Engine caching may explain the very low reported number of unique IPs directly hitting the origin.

Government use of WordPress and open source

• Some see nothing inherently wrong in using WordPress to publish documents that are ultimately public, provided access control is correctly implemented.
• Others call it reckless to host market‑moving data on a generic WordPress stack with third‑party plugins, especially when better‑engineered gov.uk tooling exists.
• There is tension between: (a) gov policy to use open source and keep costs low, and (b) the need for robust, bespoke workflows for “go‑live at exact time” publications.

Human vs technical error

• One camp insists this was human/configuration error: staff assumed safeguards existed but never verified them.
• Another stresses that “human error” is only the starting point: good systems make misconfiguration hard or impossible, e.g., private file stores, UUID URLs, or time‑based access controls (S3‑style policies).

Market and political significance

• Commenters debate how serious the leak was: some downplay 40 minutes as minor; others highlight the potential for lucrative trades on early access.
• Discussion branches into UK political fallout, media framing, and whether the resignation of the OBR chair matches the actual scale of the technical failure.