Researchers Build WordPress Exploit Using OpenAI's GPT

Security researchers at Searchlight Cyber have used OpenAI’s GPT5.6 Sol Ultra to successfully develop a full exploit chain for two critical WordPress Core vulnerabilities.

The first vulnerability, tracked as CVE-2026-63030 is a critical REST API batch endpoint route confusion issue (CVSS rating: 9.8) affecting WordPress Core versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.

The second, CVE-2026-60137, is a high-severity author__not_in WP_Query SQL injection (CVSS rating: 5.9) affecting WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5 and 7.0.x before 7.0.2.

On July 17, WordPress released version 7.0.2 of their content management system (CMS) to address two severe vulnerabilities in WordPress Core.

Chaining exploits for both vulnerabilities can achieve pre-authentication remote code execution against WordPress installations running versions 6.9.x and 7.0.x.

Searchlight Cyber, whose research team is credited for discovery of CVE-2026-63030, dubbed the chained exploit ‘WP2Shell’ in a July 17 advisory.

Unlike most WordPress vulnerabilities, WP2Shell affects WordPress Core, not a plugin or a theme, meaning an unauthenticated attacker can exploit them against a default WordPress installation.

"The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” said Adam Kues, security researcher at Searchlight Cyber.

GPT-5.6 Sol Ultra Uncovers Complex Pre-Auth RCE Chain

Searchlight Cyber’s Kues released a report on July 20 demonstrating how he used GPT5.6 Sol Ultra, OpenAI’s latest AI models, available in ChatGPT Work Pro or Enterprise and Codex Plus plans, to create the exploit.

Kues adapted a prompt OpenAI had previously used to solve a complex mathematical conjecture to discover the exploit chain. He stripped the version history from a clean copy of the WordPress source code to prevent the model from cheating, then instructed it to run up to four agents for at least six hours to hunt for a pre-authentication remote code execution path.

The model quickly flagged the REST API batch route confusion (CVE-2026-63030), realizing that a desynchronization between validation and execution allowed it to bypass input sanitization and trigger the SQL injection (CVE-2026-60137).

Within minutes, the model used the SQL injection to extract the administrator email from a fresh installation.

However, the true display of the model's capabilities was how it escalated this read-only database access into full remote code execution.

Over the course of four additional hours, the AI constructed an incredibly complex, multi-stage chain. It utilized cache poisoning through fake oEmbed entries, manipulated WordPress customize changesets to temporarily grant itself administrative privileges and triggered hooks that allowed it to bypass authentication entirely to upload a backdoor plugin.

The entire automated process took just over ten hours and cost approximately $25 dollars in compute resources, representing only a fraction of a standard premium subscription, according to Kues.

The resulting exploit chain was so absurdly complex that it would have taken a human security researcher weeks, if not months, to discover and piece together on their own.

Kues stated that, “No security researcher could have found and completed this exploit chain in 10 hours without AI.”

With exploit brokers reportedly willing to pay up to $500,000 for a zero-day remote code execution vulnerability in WordPress Core, Kues said that an off-the-shelf AI model finding one for such a low price highlights a major shift in cybersecurity economics.

After the two WordPress Core vulnerabilities were publicly reported, several other security researchers began releasing proof-of-concepts (PoC) exploits.

In addition, on July 17, security firm PatchStack reported exploitation of both CVEs, though it’s unclear what exactly is being observed in the wild.

Other companies, like Hexastrike and WatchTowr, observed evidence of in-the-wild exploitation attempts.

WordPress Forced Automatic Updates to Patch WP2Shell

WordPress took the rare step of forcing automatic updates for affected installations to immediately mitigate the threat.

Security administrators should manually verify that their sites are running version 7.0.2 or version 6.9.5.

Additionally, Searchlight Cyber has released a free scanning tool at wp2shell.com so that administrators can safely check if their servers remain vulnerable to this AI-crafted attack.

Image credits: 19 STUDIO / Primakov / Shutterstock.com