For a decade, WordPress core received 20–30 security reports a month. In August 2026, it received 773. AI didn’t make WordPress weaker. It made vulnerabilities easier to find, and plugins easier to write and ship.
The WordPress project responded by fighting AI with AI. Every plugin release on WordPress.org now waits through a cooldown while multiple AI models and Jetpack Scan analyze it. In July, that stopped a backdoored update before it reached 20,000 sites. The core security team now uses AI to read, reproduce and triage incoming reports, and to find vulnerabilities in core before anyone reports them. Human researchers still make every final call.
In this lightning talk, we’ll look at how these defenses work, what they don’t cover and how site owners and developers can use the same approach on their own sites: AI reads, humans decide, and you still patch.