An account of the 22nd WordUp Gdynia - What was it really like?

#WordUp Gdynia #22 report, April 2025 at Gdynia City Museum

Date: 5 April 2025
Venue: Gdynia City Museum (foyer + auditorium)
Participants: ~100 people

The 22nd edition of WordUp Gdynia is behind us. The spring meetup at the Gdynia City Museum brought together both seasoned developers and those just starting their WordPress journey. As always, there was no shortage of inspiring conversations, practical talks, and a fantastic atmosphere encouraging the exchange of experience. This event proved that the WordPress community in the Tri-City is vibrant and eager to share knowledge. Every presentation was packed with practical advice and inspiration, from security, through SEO, to legal issues and UX. Participants could ask questions, share their thoughts, and immediately implement new ideas into their projects.

Formally this was the 22nd meetup in the WordUp Trójmiasto series, which the #wptrojmiasto crew runs on the WordUp Gdynia website. Entry was free with registration, and the announcement went out on 18 March 2025 on the Polish WordPress.org news site under the title “Po zimowym rejsie” (After the winter cruise).

#Friday before party and networking in Gdynia

The weekend kicked off already on Friday evening (4 April, 19:00) with a relaxed before party at PifPaf pub on 10 Lutego Street.

#WordUp Gdynia #22 talks and speakers schedule

The conference opened right at 12:00. Although Karolina Czapla and Filip Sroka couldn’t appear due to health reasons, we quickly filled the gap with a short lightning networking session. Here’s the full schedule with the essence of each talk:

The XSS share in the table comes from Patchstack’s November 2024 summary, covered below.

#Open mic panel on AI, soft skills and GPL

Moderated by Kasia Tadaszak and Mariusz Szatkowski. The audience discussed:

• The future of WordPress with AI assistants in Gutenberg (42% enthusiasts, 29% sceptics).
• The importance of soft skills for developers, negotiation & assertiveness when dealing with clients.
• GPL licenses vs SaaS model, a heated debate continued later at PifPaf.

#What the official WordUp Gdynia #22 programme announced

The event page on wpgdynia.pl listed the speakers “in random order” and gave a short description for most talks. Those announcements show the question each speaker brought on stage.

Maciej Palmowski announced a story titled “How we removed 1000 plugins from the repository in a month”. His description noted that the number of closed plugins looks frightening and once again suggests that WordPress is full of holes, then asked whether that is really true, promising a look at the consequences and the lessons.

Aleksandra Grygiel built “Hosting without secrets” on her work in hosting customer support: more than 4,000 chats answered and several thousand email replies. The scope ran from exceeded account resources to virus attacks.

Magdalena Paciorek was to show step by step how to prepare a demo in WordPress Playground, whether for training or for presenting your own theme or plugin.

Tomasz Dziuda announced the mistakes that put off or even block potential clients, some of them caused by actions that look like proven practice.

Piotr Mońka, Tech Lead at Ambiscale, described accessibility as a set of invisible barriers that affect not only people with disabilities but every visitor to a site.

Tomasz Skupny came with the title “Don’t ask what a lawyer can do for you, ask what you can do without one”. The description covered the client contract, what to agree at the start of a project, requirements when building websites, and checking whether a client will vanish without paying, combining OSINT, GDPR and the Polish Electronic Communications Law.

Paweł Gontarek, owner of the agency semgence.pl, announced in Na SEO mi to SEO? (a Polish pun, roughly “Why would I need SEO?”) that SEO treated as the main sales channel may simply not pay off.

Max Matłoka, in “How many times do you have to be hacked to learn something?”, promised to show what happens after ignoring good practice and leaving your own account unprotected.

Rafał Chrzan announced the methods for getting unauthorised access to digital products through the WordPress REST API, plus the most common mistakes of file sellers.

The programme also had two talks that did not happen. Karolina Czapla was to speak about five ways to research the market yourself before you start coding a plugin. Filip Sroka planned “How we test our plugin: merge, automation and challenges”. The list closed with Marcin Andrzejewski as “Smooth operator” and Mariusz Szatkowski as co-organiser, and the networking at PifPaf was announced under the line “Does your WordPress hurt?”, with an invitation to bring your own problems.

#How many plugins were closed after the Patchstack bug bounty in October 2024

Maciej Palmowski’s talk was based on an event Patchstack described on 13 November 2024 in the article Nearly 1000 Plugins Closed During WordPress Security Cleanup. The author is Palmowski himself, at the time Security Community Manager at Patchstack.

October 2024 was Cyber Security Month and Patchstack loosened the rules of its bug bounty programme. Plugins and themes with fewer than a thousand active installs earned the same points as those with a thousand, and the limit of three years since the last update was removed. Both exceptions applied only to reports with a CVSS score of at least 6.5.

The result according to Patchstack:

The number does not mean 1571 easily exploitable holes. The most common CVSS scores were 7.1 (755 reports) and 6.5 (426), and 164 reports scored 9.0 or more. In the same breakdown, 976 reports (62.13%) listed no login as the prerequisite, 416 required the contributor role and 148 the subscriber role. Many of the reported plugins and themes had not been updated for 6 to 11 years. Researchers received more than 17,000 dollars in rewards in total.

The second to last row says the most. Almost three quarters of the reports went to the WordPress.org plugin review team because the author’s contact did not exist, was outdated or did not work. Hence the closures: most are temporary and become permanent if the author does not respond. Patchstack also points out that a closed plugin keeps running on the sites that have it, and the user usually sees no warning. The issue is tracked in Trac ticket #30465. Patchstack’s takeaway for plugin authors is simple: publish a vulnerability disclosure programme (VDP) with a working contact, so a report reaches the author before it reaches the review team.

Palmowski gave the same talk in English at WordCamp Kraków on 29 June 2025; the recording is on WordPress.tv.

#What to apply from the WordUp Gdynia talks in WordPress projects

Several talks translate into concrete tasks for anyone maintaining WordPress sites.

From Maciej Palmowski’s talk, the weight of XSS vulnerabilities stays with you: according to Patchstack they made up 67% of reports. It is worth reviewing how the plugins you maintain validate and escape input. The second task is checking whether any plugin you use has been closed in the repository, because the WordPress dashboard may not show it.

Rafał Chrzan showed how to disable user listing in the REST API and protect digital file downloads with URL signatures and tokens. That is a point to check in any shop selling files. The starting point is the /wp/v2/users endpoint, which the REST API reference describes as a collection of users, with the default view context and the who=authors and has_published_posts parameters. The email and username fields only appear in the edit context, so the public response shows less, but it still gives away the list of authors.

Piotr Mońka went through the most common accessibility errors: contrast, focus trap and aria-label. All three can be checked on an existing site by navigating it with the keyboard and using a contrast checker.

Aleksandra Grygiel listed the five hosting problems she sees most often: the iNodes limit, cron spam, antivirus false positives, timeouts and DNS mix-ups.

Tomasz Skupny added the contractual side: OSINT on the client, escrow clauses, an SLA template and a checklist for the disappearing client. It is worth comparing that material with the contracts you already use.

#Where WordUp Gdynia #22 fits in the Tri-City WordPress meetup series

The archive on wpgdynia.pl starts with the WordUp Gdańsk #1 post from December 2012, with a meetup in the Polufka pub in Gdańsk and three topics: WordUps themselves, e-commerce on WordPress and Advanced Custom Fields. Later editions ran under the name WordUp Trójmiasto, and some had their own profile: #11 and #13 were editions for beginners, and #18 celebrated 20 years of WordPress.

Edition #22 is the last one in the archive under the WordUp Trójmiasto banner. From #23 the site uses the name WordUp Gdynia, and the rhythm stayed the same: a Friday meetup at PifPaf, Saturday talks from 12:00 at the Gdynia City Museum and evening networking. That is how #23 (6 December 2025, with a pre-party at the Christmas market in Gdańsk), #24 (28 February 2026) and #25 (19 September 2026) looked. The home page announces edition #26 for 16 January 2027 at the same museum and expects more than 100 participants and more than 12 speakers for it.

#WordUp Gdynia after party at PifPaf

After closing the venue, we moved back to PifPaf. Conversations lasted until late, from REST API bugs to favourite FSE themes.

#WordUp Gdynia #22 sponsors and partners

• White Label Coders, title partner, venue funding, and welcome bags.
• Smarthost.pl, coffee zone and voucher book.
• Planet Pay, payment gateway provider with WooCommerce plugins, listed among the patrons on the event page.
• Kinsta, “Longest Uptime” contest, gadgets.
• cyber_Folks, chill zone & lemonade.
• PAQ-studio, e-commerce SEO helpdesk at the booth.
• relacje.video / relacje.ai, full video recordings (playlist below).

The event partners were Fundacja WWW and WPPoland.

#WordUp Gdynia #22 recordings on YouTube

Full “WordUp Gdynia #22” playlist on the WPGdynia YouTube channel.

The playlist has 10 videos: the nine talks from the table above and a recording of the “free mic” panel. There are no recordings of Karolina Czapla or Filip Sroka, which matches their absence. The same channel has separate playlists for the following editions, #23 and #24, and for WordCamp Gdynia 2024 and 2025.

#WordCamp Kraków and WordCamp Gdynia 2025 dates

• WordCamp Kraków 2025, 27 to 29 June 2025, the next meeting point under Wawel.
• WordCamp Gdynia 2025, 26 to 28 September 2025 at the Pomeranian Science and Technology Park, we’re back at the Baltic Sea with a two-day, multi-track edition, preceded by a Friday Contributor Day.

According to the official site, WordCamp Gdynia 2025 was the first bilingual WordCamp in Poland, with a separate English-language track.

Thank you to all participants, speakers, and partners for the energy, knowledge, and fantastic atmosphere. We hope to see you at the next WordPress Community events. WordUp Gdynia is not just about talks, but above all about people and the energy they bring. From the very entrance, you could feel the positive vibe, and conversations happened not only in the corridors but also during the after party at PifPaf on 10 Lutego Street. That’s where the best ideas were born, and new friendships and collaborations started.

“Gdynia, with its charming seaside location, provides an amazing atmosphere and energy. Such a setting fosters creative thinking and is a perfect backdrop for such an inspiring event as WordUp.”, the organisers on the WordUp Gdynia website (own translation)

#Is WordUp Gdynia worth attending

• A fresh dose of knowledge from top industry experts
• Motivation to implement innovation in your projects
• The chance to meet people who share your passion
• Access to talk recordings, revisit them anytime

If you haven’t been to a WordUp yet, consider joining us next time. It’s the best way to stay up to date with WordPress and meet a truly inspiring community.

WordUps are a good place to see how another team solved the problem that is sitting on your desk right now. Outside the meetups we do the same in practice through our WordPress development services.