I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

▲

f311a a day ago | parent [-]

They would not catch it, it requires combining multiple vulns.

	▲	lillesvin 7 hours ago \| parent [-]
		I just meant the SQLi (which is the basis of the chain), not the full chain.