Fact: 90% of all security vulnerabilities are insignificant and will not or cannot lead to a website getting hacked. Insignificant meaning, yes a bug exists and yes it passes exploit/pen tests to qualify it under the very misunderstood terminology/wording - Security Vulnerability.

It sounds like this particular Jetpack bug may fall in the 10% category of significant, but then there is the other important factor to consider - the "exploited in the wild" factor. In laymans terms, is there any evidence (logs, etc) of this attack vector being used by hackers/spammers. Example: A bug exists for 3 years. After 2 years and 11 months a new attack vector starts appearing in security log files that shows a new attack vector is being used for plugin X. The attack vector is tested and is found to be a legitimate attack vector and bug that is exploitable. What this means is the Unknown Security Vulnerability has now become a Known Security Vulnerability to hackers/spammers (typically hacker/spammer groups share exploits within their own groups first, but it does not take long for other hacker/spammer groups to find and use those attack vectors).

In any case, the bottom line and most important factor is there does not appear to be any evidence that this Jetpack bug led to any websites being hacked.

“Fortunately, we have no evidence of this being used in the wild,” Hotchkiss said.

There are Pen Testing tools like Kali and other tools out there, but a simpler solution that would be relatively simple to create would be a WP plugin that grabs all potential vulnerable areas of code such as form text input fields, etc., puts them into a re-usable array and then executes a battery of attack vectors with relative ease. We actually created something like that for our plugin recently (ironically all bugs over the years had already been reported to us through the years and we did not find any new ones after creating this new pen test tool), but it is raw code and not something that is ready for or planned for public use. The concept is a similar concept that is used in most pen testing tools, but focuses more on finding and checking targeted potential vulnerable code instead of running blanket/mass exploit/attack vector tests on all code and is relatively simple to create. The general idea is to first create your code scanner, which matches all code patterns that you want to check, put them into arrays and execute X. X being a remote posting form, etc.