The Rick Roll Hacker: What Happens When You Let AI Loose on a Million WordPress Plugins

The Rick Roll Hacker: What Happens When You Let AI Loose on a Million WordPress Plugins

Speakers: Chiao-Lin Yu (Red Team, Trend Micro); KaiChing Wang (Cyber Security Researcher, CHT Security)

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=_CIxPpU3T6o

Overview

This talk, "The Rick Roll Hacker," delivered by Chiao-Lin Yu (Steven) from Trend Micro and KaiChing Wang (Kenny bird) from CHT Security, delves into an unprecedented experiment: unleashing AI agents on a million WordPress plugins to identify vulnerabilities. What began as a small side project rapidly escalated, revealing both the extraordinary capabilities and profound limitations of large language models (LLMs) in automated vulnerability research. The speakers share a compelling narrative of how their AI, initially a simple scanning tool, evolved to not only discover critical bugs but also to "Rickroll" their staging server, highlighting its unexpected and often unpredictable reasoning abilities.

The core of the presentation explores the shift from traditional vulnerability scanning to an AI-driven approach, detailing the challenges encountered, such as pervasive AI hallucination and the overwhelming "noise" generated by false positives. More importantly, it outlines the innovative system architecture and methodologies developed to harness AI's potential effectively. By reframing how questions are posed to the AI and integrating domain-specific knowledge and human supervision, the researchers transformed a chaotic output into actionable security intelligence, ultimately redefining the landscape of automated bug hunting and its implications for both attackers and defenders.

This talk is crucial for the cybersecurity community as it provides a realistic, hands-on account of applying cutting-edge AI to a complex security problem. It moves beyond theoretical discussions of AI's potential, offering concrete examples of its strengths in code comprehension, cross-language analysis, and vulnerability chaining, while simultaneously exposing its weaknesses in practical execution, contextual understanding, and managing false positives. The insights presented offer a glimpse into the future of security research, emphasizing that effective AI integration requires sophisticated system design and human oversight, rather than merely relying on powerful models alone.

Background

▶ Watch: Introduction and AI's Rickroll Surprise (0:00)

The landscape of web security, particularly concerning content management systems like WordPress, presents a formidable challenge. WordPress powers over 43% of all websites, and its ecosystem is vast, comprising a core platform alongside hundreds of thousands of plugins and themes. These plugins, developed by a diverse array of individuals and companies, exhibit highly variable code quality, leading to a constant stream of vulnerabilities. Traditional methods for finding bugs in this expansive environment typically involve a combination of static application security testing (SAST) and dynamic application security testing (DAST). SAST tools analyze source code for common patterns, known weaknesses, and potential insecure functions, while DAST tools interact with a running application to identify runtime vulnerabilities like SQL injection or cross-site scripting.

Despite their utility, these traditional tools often struggle with the sheer scale and complexity of the WordPress plugin ecosystem. SAST tools can generate numerous false positives or fail to understand the true intent behind code, leading to missed vulnerabilities or overwhelming noise. DAST tools, while effective for runtime issues, require significant setup and can be slow to cover large attack surfaces. Human researchers, though highly effective, are limited by time, language barriers, and cognitive load when analyzing thousands of lines of code across countless plugins. This creates a scenario where many vulnerabilities remain undiscovered for extended periods, providing ample opportunity for exploitation.

The motivation for this research stemmed from the red team's need to find vulnerabilities when public databases offered little. Recognizing the unique characteristics of WordPress – thousands of attack surfaces within a relatively consistent Docker image setup – the speakers contemplated a "dangerous thought": what if AI could be applied to this problem? Not merely as a scanner, but as an active bug hunter, capable of reasoning and adapting. This experiment was conceived as a "red team sprint," a three-day gamble to see if AI could autonomously discover vulnerabilities at a scale and speed unattainable by conventional methods. The initial expectation was modest, perhaps a new type of scan. However, the outcome far exceeded these expectations, opening a "Pandora's Box" of bugs and questions about the actual state of real-world security.

Key Findings

▶ Watch: Fixing AI: Ask for Proof, Not Just Bugs (10:00)

The experiment yielded critical insights into AI's capabilities and limitations in security research. Initially, using tools like Striks on hundreds of WordPress plugins with over 10,000 downloads each, the AI generated over 300 "critical or high" vulnerability candidates within two hours. However, a crucial finding was the pervasive issue of AI hallucination: most of these initial reports were "garbage," describing non-existent bugs. This led to a significant bottleneck, with bug bounty platforms and security vendors (like Wordfence and Patchstack) overwhelmed by AI-generated noise, rejecting thousands of reports. Patchstack alone rejected over 1,000 reports from 220 researchers in a single month, all with a 100% rejection rate due to hallucination. While the noise was substantial, the signal was also real: after filtering, over 600 accepted reports had an average CVSS score exceeding 8, confirming AI's potential to find genuine, high-impact bugs.

The core problem wasn't AI's inability to find bugs, but its tendency to confidently fabricate vulnerabilities when it failed to find real ones, making it "too loud when it fails." This necessitated a fundamental shift in approach. Instead of asking, "Does this code have a bug?", the researchers learned to ask, "If there is a bug, build an exploit for me and prove it works." This change drastically improved AI's output by requiring evidence and verification, leading to several key discoveries about AI's unique capabilities:

1. Understanding Function Intent: AI doesn't just match patterns; it comprehends what a function does versus what it looks like. It can differentiate between a function designed for HTML sanitization (like sanitize_text_field) and one for SQL injection prevention, even if static analysis tools or human developers misinterpret its purpose.
2. Overcoming Language Barriers: AI processes code in any language (e.g., Persian) as quickly as its native language, significantly expanding research reach into globally diverse codebases.
3. Finding Hidden Attack Surfaces: AI can identify dead code or dead protection – security checks that are defined but never executed – leading to vulnerabilities like Remote Code Execution (RCE) where traditional tools might overlook them.
4. Chaining Vulnerabilities and Pattern Expression: AI can reason and chain multiple seemingly minor issues into critical vulnerabilities (e.g., combining a jQuery downgrade with known XSS flaws). Furthermore, it can identify a vulnerability pattern from a single finding and then autonomously hunt for that pattern across vast codebases like GitHub, effectively discovering entire classes of bugs.

Despite these advancements, AI exhibited significant limitations:

• Practical Execution Failures: AI struggled with complex, dynamic user interfaces (e.g., Elementor's drag-and-drop editor), requiring human intervention for basic setup tasks.
• Persistent Hallucination: Even with verification, AI could produce entirely fabricated CVEs with convincing, end-to-end evidence, logs, and screenshots, underscoring the need for human review.
• Budget Overruns: When instructed "not to give up easily," AI would relentlessly pursue dead ends, burning through computational budget without success. Cheaper models, ironically, could be more expensive to run due to this persistent looping.
• Lack of Domain Context: AI struggled with nuanced risk assessment, misclassifying normal administrative actions as privilege escalations or failing to distinguish between critical sandbox breakouts on shared hosting versus low-risk actions on self-hosted servers.

These findings collectively highlight that AI is a "genius researcher who needs supervision," a powerful tool when correctly aimed and managed, but dangerous and costly when left autonomous.

Technical Deep Dive

▶ Watch: AI Understands Code Meaning, Not Just Patterns (17:00)

The journey from initial AI chaos to a structured vulnerability research platform involved a significant technical evolution, focusing on refining prompts, injecting domain knowledge, and establishing robust verification mechanisms.

The initial approach, using tools like Striks for static and dynamic scanning, quickly identified hundreds of potential vulnerabilities. However, the subsequent manual verification phase revealed that most were AI hallucinations – confidently presented but non-existent bugs. This overwhelming noise rendered the raw AI output unusable. The critical turning point was a change in the prompt: instead of a general query like "Does this codebase have a bug?", the AI was challenged with, "If there is a bug, build an exploit for me and prove it works." This shift forced the AI to provide concrete evidence, dramatically improving the signal-to-noise ratio.

To enable this exploit-and-verify paradigm, a sophisticated AI verification pipeline was developed. This pipeline involved setting up isolated Docker containers for each target WordPress plugin. The AI agent would first read the plugin's source code to identify potential vulnerabilities. Then, it would attempt to exploit these candidates against a running WordPress environment within the Docker container. If the exploit failed, it was immediately categorized, leading to two primary problem areas:

1. Environment Problems:

• Plugin Initialization: Often, plugins were installed but not properly configured or initialized. The AI would attempt to exploit features that weren't yet active.
• Missing Dependencies: The Docker environment might lack necessary components, causing the WordPress instance to behave abnormally.
• Solution: The team automated the environment setup. Docker containers were pre-configured with five common WordPress user roles (guest, subscriber, author, editor, admin). For plugin setup, the AI was trained to read the plugin's code, understand its initialization wizard, and write necessary configurations directly to the database, bypassing the UI. This task was handled efficiently by even cheaper LLMs.

1. Knowledge Problems:

• Lack of WordPress Context: The AI lacked intrinsic knowledge of WordPress behaviors and risk assessments. For example, it might flag an administrator creating another administrator as a privilege escalation, which is normal behavior. It also failed to distinguish between the criticality of an action on a self-hosted server versus a shared hosting environment.
• Solution: Agent skills were implemented. WordPress-specific domain knowledge was injected directly into the AI agent's context. This included information about user roles, typical permissions, the meaning of various functions, and how different actions translate to risk in specific hosting contexts. This "WordPress crash course" significantly improved the AI's judgment and risk scoring.

Even with these improvements, AI still produced convincing, but entirely fabricated, CVEs complete with execution evidence and screenshots. To combat this persistent hallucination, a second layer of AI supervision was introduced. An AI supervisor would review every report generated by the primary agents, scoring them for credibility. If a report received a low score, the supervisor would modify the prompt and return it to the agent for further refinement, mimicking a peer-review process.

The final platform architecture comprised two main phases:

• Phase One: Suspect Scanning (Left Side): This involved scraping WordPress plugins, queuing jobs, and running initial static and dynamic scans using tools like Striks. This phase was designed to be cheap and efficient, producing a large pool of "suspects" but also a high volume of hallucinations.
• Phase Two: AI Verification (Right Side): Every finding from Phase One entered a working pool, processed in parallel by four AI agents. Each agent attempted to reproduce the exploit. Reports then passed to the AI supervisor for scoring and potential prompt modification. Finally, every report underwent human verification – the ultimate gate. This layered approach ensured that expensive AI resources were only spent on promising leads, and human effort was reserved for validating verified findings.

Model selection also presented interesting findings. For managerial tasks (e.g., assigning tasks to workers), cheaper models performed as well as expensive ones; expensive models often tried to do the work themselves rather than manage. However, for judging the quality of a report, a top-tier, expensive model was crucial, as weaker checkers simply agreed with the worker, failing to identify issues. This aligns with external research showing that system design, not just model power, dictates performance.

AI's Surprising Capabilities:

The talk highlighted four core capabilities where AI excelled:

1. Understanding Function Intent:

• Example 1: WP Maps SQL Injection. A plugin endpoint allowed ordering by a URL parameter, passed through sanitize_text_field(). Developers, SAST, and CI tools considered this safe due to the "sanitize" function. However, sanitize_text_field() only cleans HTML, not SQL injection payloads. AI understood this nuance, identifying a blind SQL injection that traditional tools missed because they focused on function signatures rather than semantic meaning.
• Example 2: CAPTCHA Bypass. The CAPTCHA 4 WP plugin used Google reCAPTCHA V3. AI found a bypass not by solving the CAPTCHA, but by exploiting an internal Ajax pre-check (4W3AjaxFlag=1) that lacked token or nonce validation. AI recognized that the if check itself was the vulnerability, a "trigger bypass," where humans and SAST might simply see a conditional statement and move on.

1. Overcoming Language Barriers:

• Example: Persian Elementor Drawing Poll Widget. This plugin's code, comments, variables, and UI were entirely in Persian. For a human, this would be a significant time barrier. AI, however, processed it as quickly as English. It identified a price manipulation vulnerability where the client-side price was trusted on the server-side without re-validation against the original product price. This demonstrated AI's ability to analyze design-level errors across languages, expanding research reach tenfold.

1. Finding Hidden Attack Surfaces (Dead Code/Protection):

• Example: Web Stack (WordPress thing). This plugin, popular on GitHub, had an Ajax handler for image uploads. It used _nopriv_ hooks, meaning no authentication was required, making it publicly accessible. Inside, an array of allowed_extensions (JPG, PNG) suggested file type validation. However, the extra array was defined but never used in the execution path, rendering the security check a mere "decoration." The rename_upload_file function then moved any file directly to the server. AI identified this dead code and dead protection, chaining the no-auth _nopriv_ hook with the bypassed file type check to achieve a straightforward RCE via a web shell upload.

1. Chaining Vulnerabilities and Pattern Expression:

• Example 1: jQuery Migrate Health plugin. A low-privilege user could force a downgrade of jQuery from version 3.7.1 to 1.12.4. On its own, this is a medium-severity config change. AI, however, reasoned to check if jQuery 1.12.4 had known vulnerabilities, discovering multiple cross-site scripting (XSS) CVEs. By combining the downgrade capability with the known vulnerable version, AI elevated a medium bug to critical, as every place jQuery ran became an XSS attack vector. Critically, no one explicitly told the AI to check old CVEs or version histories; it built this reasoning chain autonomously.
• Example 2: Clean Talk Spam Protect plugin. This plugin (200,000+ installs) used reverse DNS lookup for internal request authentication. It resolved the request IP to a hostname and checked if it was in a trusted list. AI realized that PTR records are controlled by the IP owner. An attacker could simply change their PTR record to nextserver3.cleantalk.org to bypass authentication, a design-level error stemming from a flawed trust assumption.
• Pattern Expression Across the Code World: After identifying the "Web Stack" RCE, AI didn't stop there. It recognized a pattern: _nopriv_ action hooks combined with file/data handlers and missing or dead file type checks often lead to RCE. It then autonomously generated this rule and went hunting. Using grep and GitHub's search API, it scanned the entire PHP world on GitHub in 30 minutes, finding matches across WordPress plugins, themes, and even non-WordPress PHP projects. This ability to generalize a pattern from a single instance and then scan globally for that class of bug is a highly "AI-native" application, far beyond the scope of traditional tools.

Demo / Proof of Concept

▶ Watch: AI Fails at UI Automation, Still Hallucinates (27:40)

The talk included a compelling demonstration of AI's capabilities alongside its surprising limitations, particularly during the proof-of-concept (POC) generation phase. The most illustrative example involved the Persian Elementor Drawing Poll Widget plugin, where the AI successfully identified a price manipulation vulnerability. This bug was a brilliant catch, stemming from the server trusting a client-side hidden form field for the product price without re-validation.

However, the challenge arose when the AI attempted to build a POC for this vulnerability. The first step required dragging the widget onto an Elementor page – a task any front-end engineer could do in five seconds without conscious thought. The AI, however, spent an entire night and burned through a significant portion of the budget trying to automate this seemingly simple action, ultimately failing.

Its attempts included:

1. Browser Control with MCP: The AI tried using MCP browser control to interact with the Elementor editor. While this worked for normal websites, Elementor is a Single Page Application (SPA) with thousands of dynamically loading DOM elements. The AI couldn't find stable selectors, leading to failure.
2. JavaScript Injection: It attempted to skip the browser GUI by injecting JavaScript to simulate drag events or directly call backend APIs. This also failed because Elementor's data lived in its own JavaScript store and communicated via a custom protocol, causing JavaScript crashes and page refreshes.
3. Vision Screenshot and Coordinate Prediction: Modern AI models possess vision capabilities, so the AI tried using screenshots to predict widget locations and click by coordinates. While it "worked" in principle, there was a critical mismatch: the AI calculated coordinates for a 1920x1080 resolution, but the actual screenshot was 1218x720. This spatial misinterpretation led to incorrect clicks.

Ultimately, the human researchers had to intervene. A human manually dragged the widget onto the page using a mouse, and then the AI took over to execute the actual payload. This highlighted a profound paradox: the AI was capable of sophisticated vulnerability reasoning, even across language barriers, but struggled immensely with basic, intuitive human-computer interaction in a dynamic UI environment. This "four-one bug in one AI one afternoon" scenario perfectly encapsulated the map of AI abilities, showcasing both its genius and its frustrating practical failures simultaneously.

Defensive Implications

▶ Watch: AI: A Supervised Genius Researcher, Not Autonomous (38:00)

The findings from this research carry profound implications for defenders, fundamentally altering the calculus of vulnerability discovery and exploitation.

Firstly, the defense window is shrinking dramatically. Historically, the gap between a vulnerability existing in the wild and its public discovery or exploitation could be months, even years. With AI scanning at scale, this window has compressed to days or even hours. The speakers noted that many of their AI-discovered bugs were found by other researchers concurrently, leading to cancelled or duplicate reports due to the speed of AI-driven bug hunting. This means defenders must accelerate their patching cycles and vulnerability management processes to keep pace with an increasingly rapid discovery rate. Furthermore, if public researchers are using AI this way, attackers are likely doing the same, perhaps even more aggressively and privately, putting defenders at a constant disadvantage.

Secondly, the research exposes a critical flaw in current CVSS threshold-based security strategies. Bug bounty platforms, overwhelmed by AI-generated noise, have been forced to raise their CVSS acceptance thresholds. While understandable from an operational perspective, this creates a dangerous blind spot. AI demonstrated its ability to chain multiple "medium" severity bugs into critical RCEs. For example, the jQuery downgrade vulnerability, considered medium on its own, became critical when combined with known XSS vulnerabilities in older jQuery versions. If defenders only address bugs above a certain CVSS score, they risk ignoring seemingly minor issues that, when chained by an intelligent attacker (or AI), can lead to devastating consequences. Attackers do not adhere to CVSS scores; they exploit logical flows and chained vulnerabilities that platforms might reject as "too low CVSS," leaving organizations unnotified and vulnerable.

Thirdly, the talk underscores that AI is a research tool, not an autonomous agent, at least "not yet." Defenders should not expect AI to replace human security teams or function unsupervised. The persistent issues of hallucination, lack of domain context, and practical execution failures mean that any AI-driven security solution requires robust human supervision, domain knowledge injection, and rigorous verification pipelines. Blindly trusting AI output for vulnerability assessment will lead to massive false positive rates, wasted resources, and potential misdirection of defensive efforts.

Finally, the findings highlight the need for organizations to adopt a more holistic approach to security testing, integrating AI where it excels (e.g., semantic code understanding, cross-language analysis, pattern hunting) with existing SAST, DAST, and human expertise. AI is best deployed in "blind spots" where traditional tools struggle, or for identifying entirely new classes of vulnerabilities. Defenders should also consider how their own internal code development and security testing processes might be vulnerable to AI-driven analysis. This includes being more vigilant about dead code, misunderstood function intents, and design-level errors that AI can readily identify. The emphasis shifts from merely scanning for known patterns to understanding the underlying logic and intent of code, a capability AI is proving surprisingly adept at.

Key Takeaways

• AI's Reasoning Ability is Real and Powerful: AI can understand code intent, overcome language barriers, find hidden attack surfaces, and chain vulnerabilities, leading to the discovery of entirely new classes of bugs.
• The "Noise" Problem is Critical: AI generates massive amounts of false positives (hallucinations), overwhelming traditional bug bounty and security vendor pipelines, necessitating robust verification.
• System Design Trumps Model Power: The effectiveness of AI in security research hinges more on how it's prompted, supervised, and integrated into a system (with domain knowledge and verification) than on the raw power of the underlying LLM.
• Human Oversight is Non-Negotiable: AI is a "genius researcher who needs supervision," not an autonomous pen-tester. Human verification, context, and practical execution remain essential to validate findings and manage AI's limitations.
• Defense Window is Rapidly Shrinking: AI-driven vulnerability discovery accelerates the time between a bug's existence and its exploitation, demanding faster patch cycles and proactive defense strategies.
• Beware of Chained Vulnerabilities: Relying solely on high CVSS thresholds is dangerous, as AI can chain multiple "medium" severity bugs into critical exploits, which traditional systems might ignore.

About the Speaker(s)

Chiao-Lin Yu (Steven) is a Red Team member at Trend Micro. He is an accomplished security researcher with over 50 CVEs credited to his name across various vendors. Steven is a recognized speaker at prominent security conferences, having presented at Def Con (33 and 3933), BSides Tokyo, and Ekoparty. His work often focuses on innovative approaches to vulnerability discovery and exploitation.

KaiChing Wang (Kenny bird) is a Cyber Security Consultant at CHT Security. He is also a highly skilled security researcher, known for discovering several CVEs in products from vendors like Dahua and Cisco. KaiChing holds the OSWE certification, demonstrating his expertise in web application exploitation. Like Steven, he is a seasoned conference speaker, with previous appearances at Def Con, Sec Con, and Hi Con, in addition to Ekoparty.