It seems the “mistake” was using plugins without full knowledge of potential vulnerabilities and attack vectors. I might not class this as a personal mistake either, but many in this space would I guess 🤷‍♂️