@Jeffro What are you talking about? Checkmarx creating an automated tool that scanned the plugins in their report. Doesn’t that prove it’s possible?

Nope.I already said this but I will be blunt this time, unless you provide an actual poc, no one cares about automated scanning, period.

Providing a poc has been a standard for decades because it's the only thing that actually provides proof.

For example here is the poc for the DDOS 3.5.2 update: https://vndh.net/note:wordpress-351-denial-service