$20 per zero-day is already the WordPress plugin reality
TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.
A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.
- Agent autonomously chained a downgrade flaw with vulnerabilities in an older plugin version
- One pre-auth RCE was found in a plugin with over 1,000 GitHub stars
- Disclosure triage at 30-60 minutes per finding is the primary bottleneck
- Researchers expect rising zero-day abuse as attackers run similar pipelines
- Vendors
- TrendAICHT Security
- Organizations
- TrendAICHT SecurityZDINIST
From the original article
3 min read at helpnetsecurity.com
Vulnerability researchers have spent the past year arguing about whether AI agents can find real bugs at scale or whether they mostly generate noise. A pipeline built in three days by researchers from TrendAI and CHT Security supplies an answer, along with a price tag that the security industry will have to reckon with.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.