"The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” said Adam Kues, security researcher at Searchlight Cyber.
GPT‑5.6 Sol Ultra and an automated hunt for a pre‑auth RCE
Security researchers at Searchlight Cyber used OpenAI’s GPT5.6 Sol Ultra to develop a full exploit chain that links two recently disclosed WordPress Core vulnerabilities. According to a report released on July 20, researcher Adam Kues adapted an OpenAI prompt originally used to solve a mathematical conjecture, stripped version history from a clean copy of the WordPress source to prevent the model from “cheating,” then instructed the model to run up to four agents for at least six hours to search for a pre‑authentication remote code execution (RCE) path.
Within minutes the model identified a REST API batch route confusion issue (CVE‑2026‑63030). Over the next several hours the model escalated a read operation into full RCE by composing a complex, multi‑stage chain; the full automated process took just over ten hours and cost approximately $25 in compute resources, Searchlight Cyber reports.
Two WordPress Core vulnerabilities: CVE‑2026‑63030 and CVE‑2026‑60137
The exploit chain depends on two separate WordPress Core flaws. CVE‑2026‑63030 is a critical REST API batch endpoint route confusion issue with a CVSS rating of 9.8; it affects WordPress Core versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2. The second issue, CVE‑2026‑60137, is a high‑severity author__not_in WP_Query SQL injection with a CVSS rating of 5.9; it affects WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
When chained, the two vulnerabilities allow pre‑authentication remote code execution against WordPress installations running versions 6.9.x and 7.0.x, Searchlight Cyber warned.
WP2Shell: how the AI‑crafted chain achieves RCE
Searchlight Cyber dubbed the chained exploit “WP2Shell” in a July 17 advisory. Kues’ July 20 report explains the technical steps the model assembled: the REST API route confusion produces a desynchronization between validation and execution, enabling the SQL injection to be triggered; the model then used the SQL injection to extract an administrator email from a fresh install within minutes.
Escalation from read access to code execution was achieved through a sequence of manipulations the model composed over roughly four additional hours. Those stages included cache poisoning via fake oEmbed entries, manipulating WordPress customize changesets to temporarily grant administrative privileges, and triggering hooks that bypassed authentication to upload a backdoor plugin. Searchlight Cyber characterized the resulting chain as “incredibly complex” and said it would have taken a human researcher weeks or months to discover without AI.
Kues summarized the shift succinctly: “No security researcher could have found and completed this exploit chain in 10 hours without AI.”
WordPress forced automatic updates and available checks
On July 17 WordPress released version 7.0.2 to address the two severe Core vulnerabilities and, in response to the active threat, forced automatic updates for affected installations to immediately mitigate risk. Security administrators are advised to manually verify that sites are running version 7.0.2 or version 6.9.5.
Searchlight Cyber has published a free scanning tool at wp2shell.com so administrators can check whether servers remain vulnerable to the AI‑crafted attack.
What this means for security teams, WordPress administrators, and exploit brokers
- Security teams and researchers: The case shows how a capable generative model can assemble multi‑stage exploit chains quickly and at low cost; teams should prioritize confirming patch levels (7.0.2 or 6.9.5) and incorporate targeted scanning into incident readiness.
- WordPress administrators: Sites on affected versions should verify automatic updates completed successfully and, where practical, run the free Searchlight Cyber scanner at wp2shell.com to validate remediation.
- Exploit brokers and attackers: Searchlight Cyber noted that exploit brokers have reportedly paid up to $500,000 for zero‑day RCEs in WordPress Core; the low compute cost and short time required to discover WP2Shell may change the economics of acquiring highly valuable Core exploits.
After the vulnerabilities were publicly reported, several other security researchers released proof‑of‑concept exploits and firms reported active observations: PatchStack reported exploitation of both CVEs on July 17, though it said the nature of observed activity was unclear, while Hexastrike and WatchTowr observed evidence of in‑the‑wild exploitation attempts.
WP2Shell is a concrete demonstration that combining a route‑confusion bug and an SQL injection in Core can yield pre‑auth RCE, and that a modern generative model can construct such a chain rapidly. The immediate practical step is simple: confirm your WordPress install is on 7.0.2 or 6.9.5 and run the available scanners. Beyond that, the episode raises a pressing question left by the public record: how many other complex, multi‑stage chains could off‑the‑shelf AI models find in other widely deployed software?
