Niluthpal Purkayastha (Dhrupo) is a Senior Software Engineer at WPManageNinja aka authLab in Sylhet, Bangladesh, where he works on large-scale WordPress plugins used by hundreds of thousands of sites. He builds open-source tooling for AI-assisted development and is interested in how teams keep code trustworthy when part of it is written, and reviewed, by machines.
Topic Title
Find It, Fix It, Prove It: AI and WordPress Plugin Security
Topic Description
A WordPress plugin had an arbitrary file upload bug. The developer patched it. It was bypassed. They patched it again. It was bypassed again. The hole stayed open across three releases — not because anyone was careless, but because the code had three ways in and the report only named one. That story is the shape of the problem we now have at scale: over 11,000 vulnerabilities were disclosed across the WordPress ecosystem in 2025, 91% of them in plugins, and the median gap between disclosure and mass exploitation is about five hours. AI has become genuinely good at finding these bugs, and it will happily draft the patch too. This talk is about the step in between that nobody automated. I’ll walk through two real cases — one handled about as well as it can be, one patched twice and still broken — show a scan of my own code including a finding that was completely convincing and completely wrong, and share the small amount of discipline that makes the whole loop trustworthy: reproduce before you believe, turn the exploit into a test, and fix the class of bug instead of the line that got reported.