[lillesvin]

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

[f311a]

They would not catch it, it requires combining multiple vulns.

[lillesvin]

I just meant the SQLi (which is the basis of the chain), not the full chain.

[StrauXX]

There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.