AI Crafted a WordPress Exploit That Could Have Cost a Fortune
On July 17, WordPress pushed an emergency update. Version 7.0.2 patched two Core vulnerabilities that, when chained, allowed a complete stranger to take over a site. No plugins needed. No special conditions. Just a stock WordPress install, exposed.
What’s more startling? The exploit chain — dubbed WP2Shell — wasn’t discovered by a human. It was built by OpenAI’s GPT-5.6 Sol Ultra, the latest large language model available in ChatGPT Work Pro and Codex Plus plans. Security researchers at Searchlight Cyber used the model to find and assemble the attack path in just over ten hours. The total compute cost? About $25.
Exploit brokers have been known to pay up to $500,000 for a zero-day remote code execution vulnerability in WordPress Core. Suddenly, that economics equation looks very different.
Two Flaws, One Chain: The Vulnerabilities Behind WP2Shell
The first bug, tracked as CVE-2026-63030, is a critical REST API batch endpoint route confusion issue. It carries a CVSS score of 9.8 and affects WordPress Core versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
The second, CVE-2026-60137, is a high-severity SQL injection in the author__not_in WP_Query parameter. Its CVSS score is 5.9. It impacts versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2.
Alone, each flaw is serious. Chained together, they become devastating. An attacker can exploit the REST API confusion to bypass input sanitization, then trigger the SQL injection. From there, they can extract the admin email from a fresh installation — and then escalate to full remote code execution.
“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” said Adam Kues, security researcher at Searchlight Cyber.
How GPT-5.6 Sol Ultra Built the Exploit
Searchlight Cyber’s Kues published a report on July 20 detailing the process. He started by stripping version history from a clean copy of the WordPress source code. The goal: prevent the model from cheating by recognizing known vulnerabilities.
He then adapted a prompt OpenAI had previously used to solve a complex mathematical conjecture. The model was instructed to run up to four agents for at least six hours, hunting for a pre-authentication remote code execution path.
It didn’t take long. The AI quickly flagged the REST API batch route confusion (CVE-2026-63030), recognizing that a desynchronization between validation and execution could bypass input sanitization. That opened the door to the SQL injection (CVE-2026-60137). Within minutes, the model extracted the administrator email from a clean WordPress install.
But that was just the start. The real feat came next.
From Read-Only to Full Takeover
Over the next four hours, the AI constructed a multi-stage chain that Kues described as “absurdly complex.” It used cache poisoning through fake oEmbed entries. It manipulated WordPress customize changesets to temporarily grant itself admin privileges. It triggered hooks that bypassed authentication entirely, finally uploading a backdoor plugin.
The entire automated process took just over ten hours and cost roughly $25 in compute resources. “No security researcher could have found and completed this exploit chain in 10 hours without AI,” Kues said.
For context, a human researcher would likely need weeks or months to piece together such a convoluted path. The AI did it in a single workday.
In-the-Wild Exploitation and the Economics Shift
After the vulnerabilities were publicly disclosed, other researchers released proof-of-concept exploits. On July 17, security firm PatchStack reported active exploitation of both CVEs. Companies like Hexastrike and WatchTowr also observed signs of in-the-wild attempts.
What exactly attackers are doing with the exploit remains unclear. But the window for patching is closing fast.
Kues pointed out the economic implications. With exploit brokers offering up to half a million dollars for a zero-day RCE in WordPress Core, and an off-the-shelf AI model finding one for $25, the cybersecurity landscape is shifting. “It highlights a major shift in cybersecurity economics,” he said.
WordPress Forced Automatic Updates — Here’s What to Do
WordPress took the rare step of forcing automatic updates for affected installations. That’s a strong signal of how serious the threat is.
Security administrators should manually verify that their sites are running WordPress 7.0.2 or 6.9.5. Don’t rely on auto-updates alone — check the version in your admin dashboard or via the site’s footer.
Searchlight Cyber has released a free scanning tool at wp2shell.com so administrators can safely test if their servers remain vulnerable to this AI-crafted attack.
What This Means for the Future of Security Research
This isn’t a theoretical exercise. An AI model found a critical vulnerability chain in a platform that powers over 40% of the web. It did so quickly and cheaply. The implications for both attackers and defenders are enormous.
On one hand, security researchers can use AI to discover flaws faster, potentially reducing the window between a vulnerability’s introduction and its patch. On the other hand, malicious actors could do the same — and they don’t have to follow disclosure rules.
For now, the takeaway is simple: patch your WordPress sites. The AI is already working. Don’t let your site be the next victim.
