AI‑Powered “Vulnerability Vending Machine” Yields Remote SQL‑Injection Zero‑Day in Popular WordPress Plugin
What Happened – Researchers at Intruder used large‑language models (LLMs) together with a code‑slicing engine (Joern) to automatically discover and exploit a remote SQL‑injection zero‑day in a WordPress plugin used by over 300 000 sites. The entire workflow—from code ingestion to working exploit—required no human intervention.
Why It Matters for Compliance & Audit Readiness
- The finding illustrates how new AI‑driven tooling can surface previously unknown vulnerabilities, underscoring the need for continuous control mapping and evidence collection to prove that critical assets are regularly tested.
- SOC 2‑aligned programs must demonstrate that vulnerability management controls (CC6.1, CC6.2) are not only documented but also exercised with up‑to‑date, automated testing methods.
- Verisq’s Control Mapping capability can ingest AI‑generated test results, map them to the relevant SOC 2 controls, and store immutable evidence for audit reviewers.
Who Is Affected – Web‑application vendors, SaaS platforms built on WordPress, and any organization that integrates third‑party WordPress plugins (Tech‑SaaS, Media, E‑commerce).
Recommended Actions
- Integrate AI‑assisted code‑scanning into your vulnerability‑management pipeline and map each finding to SOC 2 control CC6.1 (Vulnerability Management).
- Capture and retain the full AI‑generated exploit workflow as immutable audit evidence.
- Validate that patching processes meet the SOC 2 requirement for timely remediation (CC6.2).
Source: BleepingComputer – “We built a vulnerability vending machine: AI tokens in, zero‑days out”
Technical Notes
- Attack vector: remote SQL injection (CWE‑89) discovered via LLM‑driven analysis of plugin source code.
- No CVE assigned yet; the vulnerability is a zero‑day affecting the plugin’s input handling.
- Exploit chain generated automatically by the AI pipeline, demonstrating end‑to‑end code‑to‑exploit capability.
Source: same as above