Note: This post was written by Kimi K3. The following is a synthesis of the original security research, the WordPress release notes, and reporting from major outlets.
Adam Kues, a researcher at Searchlight Cyber’s Assetnote team, adapted a prompt OpenAI published for solving a math conjecture, pointed GPT-5.6 Sol Ultra at the WordPress core codebase, and told it to find a pre-authentication path to remote code execution. About ten hours later it handed him a complete working chain — one that affects a default WordPress install, needs no account, no plugin, and no user interaction. His compute cost was half of a $200 weekly subscription allowance, roughly $25 pro-rata. Exploit brokers pay around $500,000 for a WordPress pre-auth RCE. WordPress patched the flaws Friday; by Sunday, security firms were seeing exploitation in the wild.
What the Model Found
The chain, published today in Kues’s full writeup, links two CVEs. The first is a design flaw in the WordPress batch API (CVE-2026-63030, CVSS 9.8), which validates all sub-requests in one loop and executes them in a second. A malformed entry desynchronizes the two arrays, so a request validated against one endpoint executes against another — bypassing parameter sanitization entirely. The second is a SQL injection in WP_Query (CVE-2026-60137, CVSS 7.5): the author__not_in filter sanitizes arrays but passes scalar strings straight into raw SQL. The same flaw was independently reported by researchers TF1T, dtro, and haongo.
Two touches stand out as machine-style creativity. The batch API rejects GET requests, and the injectable route only answers to GET — so the model called the batch endpoint recursively, using the desync once to smuggle the method past validation and again to smuggle the payload. And because the SQLi is read-only, it escalated through WordPress’s in-memory post cache: fabricating cached posts, forcing a reconciliation that writes an attacker-controlled customize_changeset row, briefly assuming the administrator’s identity, then replaying the original request through the parse_request hook to create a real admin account. From there, uploading a backdoored plugin is housekeeping.
Kues, who has used every frontier model since 2022, wrote that he was astonished by techniques he “would previously have thought were only the domain of humans,” and his verdict was blunt: “no security researcher could have found and completed this exploit chain in 10 hours without AI.”
Patch Now — Exploitation Has Started
WordPress shipped fixes on July 17 — 7.0.2, 6.9.5, and 6.8.6, plus 7.1 beta2 — and took the rare step of forcing auto-updates on affected versions. Releases before 6.8 are unaffected; 6.8 carries the SQLi only, since the batch bug arrived in 6.9. Wordfence deployed a firewall rule the same day for paid tiers (free users August 16), and Cloudflare pushed WAF protections on all plans, noting the full chain is reachable when a site runs without a persistent object cache.
The window is closing fast. Searchlight held technical details over the weekend to give defenders a head start, but two groups — Calif and Hacktron — independently reproduced the chain, and public PoCs hit GitHub within roughly 24 hours of disclosure. watchTowr CEO Benjamin Harris said his firm was “already seeing PoC exploits in circulation” with “the first signs of exploitation in the wild”; Hexastrike’s threat-intelligence lead Maurice Fielenback reported “attempted and successful wp2shell exploitation” and several confirmed or suspected incidents since Sunday. Searchlight hosts a free checker at wp2shell.com. If you run WordPress, confirm the forced update actually applied — and if it didn’t, patch manually and audit for new admin accounts.
The Economics Are the Story
A 20,000-to-1 cost-to-payout ratio is not a security curiosity; it is a market signal. The input side of elite vulnerability research just collapsed to the price of a takeout dinner, using a consumer subscription and a prompt OpenAI published itself. The same week, OpenAI’s government-gated release of GPT-5.6 framed access controls as the safeguard for exactly this class of capability. wp2shell is the counter-argument: the capability was already in the $200 tier.
The defensive read is not hopeless, but it changes shape. Forced auto-updates, WAF vendors shipping rules within hours, and attack-surface monitoring become the baseline rather than best practice, because the attacker-side timeline is now measured in hours and dollars. Kues’s own conclusion was about the researcher’s role, not its disappearance: the work shifts to choosing targets, steering the search, and auditing what the model produces — the exploit writing itself is becoming a commodity. WordPress, one of the most hardened codebases on the internet, had not had a meaningful pre-auth vulnerability this decade. It has one now, and an AI found it for $25.
Sources
- Searchlight Cyber - Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25
- WordPress News - WordPress 7.0.2 Release
- Wordfence - PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chain
- Cyber Security News - Critical wp2shell RCE Vulnerability
- Machine Brief - GPT-5.6 Found a $500K WordPress RCE for $25 in 10 Hours