Researchers recreated WordPress pull requests tied to two CVEs to evaluate whether today’s code reviewers and SAST tools would catch the flaws.