The security researcher Adam Kues from Searchlight Cyber uncovered a critical WordPress core vulnerability with OpenAI’s GPT-5.6 Sol Ultra, allowing unauthenticated attackers to take full control of the server. The analysis cost around 25 dollars and took about ten hours. For a comparable, independently unverified vulnerability, exploit brokers pay up to 500,000 dollars according to Searchlight Cyber.
AI agent chains two flaws into a full takeover
Kues adapted a prompt for the search that he had previously used for mathematical problems. He removed the version history from the WordPress source code and let up to four instances of GPT-5.6 Sol Ultra search for a way to execute code without authentication for at least six hours in parallel. The model found an initial point of attack within a few minutes, and the complete chain was established after about ten hours. GPT-5.6 Sol Ultra is available as an OpenAI model in the ChatGPT Work Pro, Enterprise, and Codex Plus plans.
The result connects two individually known vulnerabilities into an attack path named wp2shell. A confusion of REST API routes (CVE-2026-63030, CVSS score 9.8) initially provides read access to internal database contents. A SQL injection in the parameter author__not_in (CVE-2026-60137, CVSS score 5.9) extends this access through crafted oEmbed cache entries and manipulated customizer change sets to full code execution on the server. According to Searchlight Cyber, the attack requires no prerequisites and works even on an unauthenticated standard installation without additional plugins.
WordPress forces security update, initial attacks already underway
Affected are the WordPress versions 6.9.0 to 6.9.4 as well as 7.0.0 and 7.0.1, in which both flaws can be chained to achieve full code execution. The SQL injection alone is also present in the older versions 6.8.0 to 6.8.5, but it cannot be continued to code execution there. WordPress has closed both vulnerabilities in versions 6.9.5 and 7.0.2 and activated automatic mandatory updates for affected installations, so that a large portion of websites should receive the fix without manual intervention.
Independent researchers reproduced the complete attack chain before Searchlight Cyber made it public; the company deliberately delayed the release to give operators time for updates. After the publication of a proof of concept, the security firm watchTowr already registered initial signs of active exploitation. WordPress powers more than 500 million websites worldwide, which is why experts classify quick patching as the most important immediate measure, regardless of the individual risk. Operators should check their version number in the dashboard if automatic updates are disabled.
AI-powered bug hunting changes the pace of security research
The discovery fits into a trend that beckmann.ai already described in July: AI Bug Hunting Causes the Number of Reported CVEs to Explode. Language models now search source code at a pace and cost that manual audits can hardly match. Traditional security audits for software the size and importance of WordPress usually take days to weeks and cost many times the roughly 25 dollars that Kues spent on his four AI agents.
The cost shift works in two directions. Defensive teams find serious vulnerabilities cheaper and faster before criminals can exploit them. At the same time, the same tools are fundamentally also available to attackers, who, unlike security firms, do not have to adhere to responsible disclosure. For website operators, this primarily means that the time span between a newly discovered vulnerability and initial attacks on the internet tends to become shorter – automatic updates, like those enforced by WordPress, thus become a central protective measure rather than just a recommendation.
It remains to be seen whether providers of commercial AI models will adjust their security filters in the future so that legitimate defensive research is not hindered while the same capabilities remain freely available to attackers. It will also be crucial how quickly operators of affected websites actually implement the enforced updates: in previous WordPress core vulnerabilities, a significant portion of installations remained unprotected for months after the release of a patch.
