An LLM agent doing static plus dynamic analysis found 81 log-exposure flaws across WordPress plugins with 250M installs; 79 reproduced by hand

arXiv·medium signalXBlueskyLinkedInCopy link

Researchers built an agentic LLM framework that analyzes WordPress plugins through combined static and dynamic analysis to detect log files that leak credentials and personal data when insufficiently secured. Run against the 300 most-installed plugins — about 0.6% of the ecosystem but over 250 million active installations, roughly 75% of all active installs — it produced 81 findings across 62 plugins, of which manual validation reproduced 79. The team derived a taxonomy of log path and protection patterns, finding that creation-control measures like manual log activation and access-control measures like .htaccess deny rules are each individually insufficient and that multi-layered protection is required but frequently absent. It is a concrete data point that agentic LLM security analysis produces a 97.5% manual-confirmation rate on a real ecosystem rather than a benchmark.