AI Now Finds the Holes in Your Website Faster Than Anyone Patches Them

A client asked me last week how often she “really” needs to update plugins. Quarterly, she figured, same as she’d always done. I didn’t have a comfortable answer for her, because the honest one is: not anymore, and here’s why.

This week, Wordfence reported more than 440,000 blocked exploit attempts aimed at two wildly popular WordPress plugins. Elementor Pro, which runs on millions of sites, had a file-upload bug (CVE-2026-32475, CVSS 9.0) that let an attacker skip the extension checks and drop a PHP file straight into the forms folder. Instant remote code execution, no login required. Super Forms had something even nastier: CVE-2026-14894, a CVSS 9.8 flaw with basically the same trick. Elementor fixed theirs in version 4.2.2. Super Forms fixed theirs in 6.3.314. Both patches exist. Both patches are free. And attackers hit those two plugins nearly half a million times combined in a matter of days.

That’s not a hypothetical “someday a hacker might.” That already happened, this week, to real sites.

The other one is worse, honestly

Here’s the part that made me put my coffee down. A separate flaw in All-in-One WP Migration (a backup plugin, the thing you install specifically to protect your site) got patched on August 20th. SQL injection, CVSS 8.8, the kind of bug that lets someone pull your database secrets and plant a webshell. Kind of a shitty flaw to find in the plugin whose whole job is protecting you. Good news: ServMask shipped a fix fast. Bad news: roughly 65% of the plugin’s install base was still unpatched two weeks later, call it 3.25 million sites sitting there with the door unlocked, patch sitting one click away.

That gap, not the vulnerability itself, is the actual story. The fix exists. Almost nobody applied it.

Why the clock changed

I’ll spare you the CVE-numbers-as-doom-porn routine. What matters here is timing, and the timing changed because of AI, on both sides of the fight.

WordPress itself said as much. Two weeks ago the project announced a Core Security Initiative, and part of the reasoning was blunt: security reports have surged because AI tools have made it dramatically easier to analyze code for flaws. That’s not me speculating. That’s WordPress’s own security team saying the volume of incoming reports has grown enough that they’re restructuring how they triage and ship fixes.

Read between the lines and it’s simple. Finding a bug in a plugin used to take a security researcher days of manual code review. Now a model can chew through the same codebase in an afternoon. That cuts both ways: the good guys find bugs faster, but so does everyone else, and once a vulnerability is public, automated scanners start hammering every install on the internet within hours. Not weeks. Hours.

Which means the old rhythm (someone updates their site “when they get around to it,” maybe quarterly, maybe whenever the dashboard nag finally gets annoying enough) isn’t a maintenance schedule anymore. It’s a bet, and the odds just got worse.

I actually watched this play out from the other side just a few weeks ago, during the whole WordPress 7.1 / WP Rocket mess in August. We hadn’t pushed that core update to any client site yet, because we test on staging first, always, so when the bug reports started rolling in about WP Rocket’s Cloudflare integration fatal-erroring sites, we just… didn’t get hit. Not because we’re geniuses. Because someone was watching the release notes instead of letting an update fire automatically at 3am and hoping for the best. Same principle applies here: it’s not about being clever, it’s about somebody paying attention on a Tuesday.

What to do today

No panic required. Just check three things.

• Run Elementor Pro? Confirm you’re on 4.2.2 or later. Anything on 4.2.1 or earlier is exposed.
• Run Super Forms? Get to 6.3.314 or later, today, not this weekend.
• Run All-in-One WP Migration? You want 7.110 or later. If you’re not sure, check now. This is the one with the two-thirds-still-vulnerable problem, and there’s a real chance you’re one of them.

Beyond those three, the bigger question is who’s watching your site. Not “does it have a plugin that says it updates automatically.” I’ve made the case before about why WordPress sites keep breaking even with auto-updates on, because auto-update doesn’t mean anyone’s checking whether the update caused a new problem three plugins deep.

If you’re paying for hosting or care and genuinely don’t know whether someone’s watching for exactly this kind of thing, that’s worth a real conversation. I broke down what maintenance actually costs and includes in 2026 so you can compare against whatever you’re currently paying for.

And if you already suspect your site’s behind on all three of these, or you just don’t know and that not-knowing is keeping you up at night, we do rescues. No judgment. Every site owner I know has a version of this exact story.