VulnerabilityBleeping Computer
7.5 — HIGH
We built a vulnerability vending machine: AI tokens in, zero-days out
Intruder built an AI-powered "vulnerability vending machine" that combines code slicing with LLMs to automatically discover complex software vulnerabilities. The company explains how the system found and exploited a previously unknown WordPress plugin zero-day, with additional discoveries already under responsible disclosure. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A vulnerability vending machine using AI and code scanning frameworks was used to discover a high-severity SQL injection vulnerability in the Creative Mail plugin, affecting over 300,000 users.
⚙️Technical Details
CVEs
CVE-2026-3985
Affected Systems
WordPress plugin Creative Mail
Attack Vectors
NETWORK
💥Impact Assessment
Severity: HIGH
Who Is at Risk
Users of the affected WordPress plugin, including those with WooCommerce installed
🛡️Recommended Actions
1Disable the Creative Mail plugin until a patch is available
2Regularly update and patch WordPress plugins to prevent exploitation
3Monitor for signs of exploitation and report any suspicious activity
📦Affected Products
Creative Mail plugin
🔐NVD Verified DataVERIFIED
CVE-2026-3985 ↗CVSS 7.5 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeaknesses
CWE-89
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.