WordPress Is Using AI to Find Security Flaws Before Hackers Can Exploit Them

WordPress has launched a new security effort that uses artificial intelligence to identify vulnerabilities in its core software before attackers can abuse them.

The initiative comes as the project receives an increasing number of security reports, driven in part by rapid improvements in AI tools for code analysis and vulnerability research. Over the past year, WordPress said incoming vulnerability reports have increased substantially across its ecosystem.

AI models are making it easier for security researchers to inspect large codebases, trace potentially unsafe data flows, and flag risky programming patterns that could otherwise be missed during manual reviews.

The increase in reports is positive for WordPress security, but it also creates a major operational challenge. Every submission must be reviewed, reproduced, validated, prioritized, fixed, tested, and released.

WordPress Using AI to Find Security Flaws

A report may identify a real vulnerability, a configuration-specific issue, a duplicate finding, or a false positive. The WordPress security team must separate urgent flaws from lower-risk issues while ensuring that security patches do not break millions of websites.

The project discussed the issue during its security team meeting at WordCamp US and has now introduced the Core Security Initiative.

The program is built around three priorities: improving the security release process, reducing the backlog of open reports, and using AI-assisted tools to discover vulnerabilities earlier.

The first area focuses on making security releases more predictable. WordPress plans to strengthen automation and end-to-end testing around security updates so fixes can be delivered reliably.

Better testing is especially important for a platform with a large ecosystem of themes, plugins, hosting environments, and custom deployments. A patch must close the vulnerability without causing unexpected failures for site owners.

The second priority is reducing the queue of unresolved reports and known issues. WordPress is adding team members and volunteers to help review findings, confirm impact, and move valid issues through the remediation process. The stated goal is to reduce the number of open security findings to zero.

The third pillar, described as “Crush vulnerabilities with AI,” is the most notable part of the effort. WordPress intends to use AI-assisted scanning and analysis tools to proactively identify security weaknesses rather than waiting for an external researcher or attacker to discover them first.

These tools can help reviewers search for patterns linked to cross-site scripting, privilege escalation, insecure file handling, server-side request forgery, and other common web application risks. However, AI will not replace human security researchers.

Automated tools can identify suspicious code, but expert reviewers are still needed to verify whether a flaw is exploitable, determine its severity, create a safe patch, and test the fix.

WordPress said its AI work will complement, not replace, responsible disclosure reports from the security community. Recent WordPress releases show why faster discovery matters.

Version 7.0.3 addressed multiple security issues, including cross-site scripting, privilege escalation, server-side request forgery, information disclosure, and CSS injection flaws.

Version 7.0.4 later fixed an authenticated remote code execution issue involving malicious file uploads on sites using Imagick and Ghostscript.

WordPress core vulnerability researchers are encouraged to continue reporting findings through the project’s HackerOne program and to follow its reporting guidelines.

For website administrators, the message remains simple: apply WordPress security updates promptly, maintain tested backups, and keep plugins and themes up to date.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC