Intruder's AI vulnerability vending machine uses a pipeline that integrates code scanning (via Joern), program slicing, and LLM-based triage and exploitation agents to automatically identify and exploit complex vulnerabilities without human intervention. The system was tested against the top 200 WordPress plugins and successfully discovered a multi-stage blind SQL injection zero-day in the Creative Mail plugin, which requires WooCommerce. The exploit was fully automated, producing a working proof-of-concept and extraction method. This vulnerability was independently reported and the plugin has been pulled from the store. The pipeline continues to find additional vulnerabilities under responsible disclosure. This demonstrates AI's growing practical role in accelerating vulnerability research and exploitation.

The discovered SQL injection vulnerability (CVE-2026-3985) in the Creative Mail WordPress plugin allows unauthenticated attackers to perform blind SQL injection attacks, potentially extracting sensitive data such as admin password hashes and secret tokens from the database. Exploitation requires WooCommerce to be installed alongside the plugin, a common configuration. This vulnerability poses a significant risk to the confidentiality of WordPress sites using this combination. The plugin has been removed from the WordPress store pending review, mitigating further exposure until patched.

The Creative Mail plugin has been removed from the WordPress store pending review. Users running Creative Mail alongside WooCommerce should disable the plugin immediately until an official patch is released. Monitor vendor advisories for updates and apply patches promptly once available. Since this is a newly discovered zero-day, patch status is not yet confirmed; check the vendor advisory for current remediation guidance.