Security researchers at Hacktron AI recreated the WordPress pull requests behind two disclosed vulnerabilities — CVE-2026-63030 and CVE-2026-60137 — to determine whether modern code review practices and static application security testing (SAST) tools would have flagged the issues before they reached production. The experiment, published under the name “wp2shell,” raises broader questions about the reliability of automated and human-led code review in open-source projects.
The research approach involved reconstructing the original pull requests as they would have appeared at the time of submission, then running them through contemporary review tooling and human analysis. The goal was to simulate real-world conditions and assess whether current defenses represent a meaningful improvement over whatever review process existed when the vulnerabilities were originally introduced.
The two CVEs at the center of the study affect WordPress, the content management system that powers a significant share of the public web. Vulnerabilities in WordPress core or its ecosystem can have outsized impact given the platform’s widespread deployment. By anchoring the research to specific, documented flaws, the Hacktron AI team aimed to ground their findings in concrete, reproducible cases rather than hypothetical scenarios.
The study touches on a recurring tension in software security: whether SAST tools and code review workflows, which have grown considerably more sophisticated in recent years, are advancing fast enough to keep pace with increasingly subtle vulnerability patterns. Static analysis tools can reliably catch certain classes of bugs, but more complex logic flaws or context-dependent vulnerabilities often require deeper semantic understanding that automated scanners may still lack.
The findings contribute to an ongoing industry conversation about where human review remains essential and where automation can be trusted to carry the load. For open-source projects in particular, which often rely on volunteer reviewers and asynchronous contribution workflows, understanding the limits of available tooling carries practical significance for maintainers and security teams alike.