GPT-5.6 Finds $500K WordPress Exploit in 10 Hours for $25

On July 16, a security researcher at Searchlight Cyber pointed GPT-5.6 Sol Ultra at WordPress’s source code and walked away with a pre-authentication remote code execution chain in roughly 10 hours, at an API cost of about $25. WordPress shipped an emergency patch the next day—July 17—and force-pushed it to every auto-update-enabled site on the planet. Exploit brokers pay up to $500,000 for pre-auth WordPress RCEs. The math is not subtle. Adam Kues, the Assetnote researcher behind the discovery, put it plainly: “I can say with complete confidence that no security researcher could have found and completed this exploitation chain in 10 hours without AI.”

What the wp2shell Chain Actually Does

The vulnerability—dubbed wp2shell by the community—isn’t a single flaw. It chains two CVEs: CVE-2026-63030 and CVE-2026-60137. Neither is a critical issue in isolation. Together, they hand an anonymous attacker full control of any unpatched WordPress site.

CVE-2026-63030 is a request confusion bug in WP_REST_Server::serve_batch_request_v1(), the REST API endpoint that lets clients bundle multiple API calls into one HTTP request. A malformed sub-request causes subsequent batch items to be routed to the wrong endpoint handler, bypassing both authentication and parameter allow-lists. CVE-2026-60137, meanwhile, is a SQL injection in WordPress’s WP_Query class, triggered when the author__not_in parameter receives a string instead of the expected integer array—a type confusion error that skips the sanitization path entirely. Chain the two together and an unauthenticated attacker can inject arbitrary SQL, forge admin-level objects through WordPress’s oEmbed and post cache mechanisms, create a new administrator account, install a malicious plugin, and achieve code execution. The attack requires no credentials, no user interaction, and works against default installations. According to Rapid7’s technical analysis, a public proof-of-concept was essentially inevitable given the detail of the public disclosure—and one appeared on GitHub the same week.

Related: AI Code Is Shipping Vulnerabilities at Scale: The 2026 Data

GPT-5.6 WordPress RCE: Four Agents, Six Hours, Twenty-Five Dollars

Kues’s methodology was deliberately straightforward. He adapted a mathematical reasoning prompt originally designed for problem solving into a vulnerability research directive, stripped version control history from the WordPress repository to prevent the model from reading changelog hints, and instructed GPT-5.6 to run four parallel agents for at least six hours with the task: find pre-authentication code execution paths on a typical production server. The model returned a pre-auth SQL injection path. Kues then spent about four more hours manually verifying the finding and escalating read-only database access into a full site takeover.

The ability to do this in a day matters because GPT-5.6 Sol Ultra is—by OpenAI’s own assessment—rated “High capability” in cybersecurity under its Preparedness Framework. OpenAI defines that rating as models that provide “meaningful uplift to actors attempting cyberattacks against critical infrastructure.” OpenAI staggered GPT-5.6’s commercial release after the Trump administration formally requested controlled access on national security grounds. That the flag was raised before a discovery like this one is, frankly, the more unsettling data point. The original Searchlight Cyber write-up includes enough detail on the methodology that this research is repeatable—against other open-source projects, on other codebases, by researchers with far less experience than Kues.

When the Cost Floor Drops, the Market Shifts

The Hacker News discussion that followed the disclosure—352 points and climbing—produced the predictable counterargument: the exploit broker market will reprice. If AI lowers the cost of finding a $500,000 vuln to $25, the brokers will pay $25. However, that market correction takes time, and the more pressing concern is on the attacker side. The barrier to entry for sophisticated vulnerability research has dropped significantly. A task requiring elite researchers and weeks of work now takes a capable developer an afternoon. During the adjustment period—which could last months—that asymmetry favors attackers.

WordPress’s code quality is part of the story too. The SQL injection in CVE-2026-60137 is a textbook type confusion error, the kind that persists when a codebase carries years of backward-compatibility constraints and avoids breaking changes. That said, the wp2shell chain does not require any specific plugin—it lives in WordPress core, which powers roughly 43% of all websites. If you run a default install on 6.9.x or 7.0.x, it’s vulnerable. Security coverage from The Hacker News confirmed active exploitation in the wild, with one commenter reporting live admin accounts and backdoors on their own site.

Related: VulnHunter: Capital One’s Open-Source AI Security Tool

Patch Now: WordPress 6.9.5 and 7.0.2 Are Available

If you maintain a WordPress site, the action items are straightforward. The full RCE chain affects versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The patched releases are 6.9.5 and 7.0.2. WordPress 6.8.x is only exposed to the SQL injection component, not the full RCE chain, but a 6.8.6 patch is available and worth applying.

• Update to WordPress 6.9.5 or 7.0.2 immediately
• If you cannot update right away, block /wp-json/batch/v1 at your WAF (Cloudflare, Wordfence, or similar)
• Check for indicators of compromise: unexplained admin accounts, unknown plugins, unusual REST API traffic in access logs
• A public PoC exploit (0xsha/wp2shell) is circulating—assume active mass scanning is underway

Key Takeaways

• GPT-5.6 Sol Ultra found a pre-authentication WordPress RCE in 10 hours for $25—a task previously requiring elite researchers and weeks of work
• The wp2shell chain (CVE-2026-63030 + CVE-2026-60137) affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; update to 6.9.5 or 7.0.2 immediately
• Public PoC code is available and active exploitation is confirmed—unpatched sites are being compromised now
• The vulnerability economy is shifting: AI doesn’t eliminate the value of expertise, but it compresses timelines and lowers the entry barrier in ways that matter