Wordfence's AI Researcher Is Now Finding More WordPress Flaws Than Any Human

Two days ago, WPWithin covered how a researcher used an AI model to find WordPress’s worst flaw in a decade in about 10 hours. Wordfence, the security firm behind one of WordPress’s most widely used firewall plugins, says that shift is now showing up inside its own bug bounty program.

What happened

Wordfence runs a bug bounty program that pays outside researchers to find vulnerabilities in WordPress plugins and themes before attackers do. Over three years, the program has logged 9,727 vulnerabilities and paid out more than $981,000 to researchers.

Three months ago, Wordfence added a new kind of researcher to that program: an AI system it built called PRISM, designed to search for vulnerabilities on its own instead of waiting for a human to submit one. Wordfence says PRISM has since found 202 vulnerabilities, including 88 in the past 30 days alone, an average of roughly 2.8 a day. By Wordfence’s own count, PRISM is now its single highest-output researcher, ahead of every human contributor to the program.

To keep up with the volume, Wordfence also built an AI-assisted triage tool called Eclipse, which reviews vulnerability submissions from both human researchers and PRISM to speed up the process of confirming a real flaw and getting a fix out.

Why this matters for your site

This is another data point in the same trend WPWithin flagged with wp2shell: AI tools are now finding real, exploitable WordPress vulnerabilities faster and cheaper than manual research alone. That cuts both ways. Faster discovery by defenders like Wordfence means plugin and theme vulnerabilities can get flagged and patched before attackers find them. But the same AI techniques are available to attackers too, so the gap between a flaw existing and someone finding it is shrinking either way.

What to do

Nothing about this changes what you should already be doing: keep WordPress core, plugins, and themes updated, and turn on auto-updates where you can. If you run a security plugin, make sure its vulnerability database or firewall rules are set to update automatically rather than on a manual schedule, since the value of fast vulnerability research disappears if the fix doesn’t reach your site quickly.

End of article