Today I had the chance to participate in a WebEx session with Checkmarx to get a better look at the results of their report. I saw how their scanner works and how it reports different vulnerabilities. In one example, a particular plugin had over 150 SQL Injection vulnerabilities in its code base. A Google search later showed about 182 thousand sites using that plugin. Put 2 and 2 together and you've got trouble.

I'm trying to work with Checkmarx and get the appropriate people involved to see if a partnership can be formed between WordPress.org and Checkmarx. I believe once the right people get to see for themselves just how large of a problem this is, that some sort of action will be taken. There is also the issue of just how to go about releasing their work to the public. If they make the scanner available to the public, then it's possible that plugins will be scanned and once all of the vulnerabilities are found, will Google search websites using those plugins and begin their hack fest. This wouldn't make Checkmarx look good too the public. However, going that way may wake up a lot of people and finally demand that something be done about it. Having a secure core is great but why not hold plugins and themes to the same scrutiny.