OpenAI's GPT-5.6 Sol Ultra assembled an unauthenticated remote code execution (RCE) chain lurking in WordPress core in roughly 10 hours. On July 17, 2026, WordPress released a fix after receiving a report from discoverer Adam Kues, and given the severity, also enabled forced automatic updates for affected sites. Further, on July 20, New Zealand's National Cyber Security Centre (NCSC) warned that the two related vulnerabilities were being exploited in real attacks. AI-driven vulnerability discovery has entered a phase where it drives fixes and emergency response for public software—not just scores in evaluation environments.
$25 and 10 Hours, But Under Human Direction
Searchlight Cyber researcher Adam Kues placed the source code of the latest stable WordPress release locally, stripped the Git history, and had GPT-5.6 Sol Ultra audit it. The prompt specified searching for a chain leading from pre-authentication to RCE in a typical MySQL environment, using up to 4 agents in parallel, and continuing the search for at least 6 hours. The model first discovered an SQL injection achievable without authentication, and when Kues additionally asked whether it could be escalated to RCE, it returned a complete chain about 4 hours later. The total search time exceeded 10 hours.
The "roughly $25" figure is not an actual expense recorded on an API bill. Kues states that under a $200/month plan, he used 50% of a weekly usage allotment, and the figure was prorated assuming 4 weeks per month. Similarly, the $500,000 figure Searchlight Cyber put in its original headline is not a bounty payment received, but a rough estimate of what exploit brokers might pay for a similar WordPress RCE. While the gap between the low search cost and the high attack value is striking, the two figures cannot simply be compared as a return on investment.
This success was not achieved by the model alone. Kues defined the target and success criteria, provided the search direction, and verified in a separate environment that the discovered SQL injection could actually read out administrator emails. He then spent until the following day decoding the complex RCE chain the model had produced before reporting it to WordPress. While the AI searched a broad codebase for attack paths and connected them, the human designed the experiment, reproduced the results, interpreted their significance, and handled responsible disclosure.
Why Two Flaws Combine to Form "wp2shell"
The entry point, CVE-2026-63030, is a route confusion flaw in which the WordPress REST API's batch processing mixes up the request it validates with the handler it actually invokes. An attacker can have input that would normally be rejected validated via a different route, then pass it to a different handler. This combines with CVE-2026-60137. WP_Query's author__not_in casts each element to an integer when given an array, but fails to properly sanitize scalar values such as strings, leaving a path into the SQL statement.
By nesting batch processing calls, an attacker can bypass validation without logging in and read out database contents. However, stealing a password hash alone does not normally guarantee becoming an administrator. The chain the model discovered exploited WordPress's post cache and oEmbed processing to fabricate fake post data in memory, connecting to behavior where administrator privileges are temporarily used when applying a customize_changeset.
Next, it uses the parent-child relationship of a crafted post to re-invoke WordPress's parse_request hook. Because temporary administrator privileges remain in effect during this second pass, creation of an administrator account—initially rejected—now succeeds. The attacker then installs a malicious plugin using that account, achieving arbitrary code execution on the server. Individually, these behaviors belong to separate features—posts and caching, the customizer, and hooks—but the model connected them into a single execution path.
According to Cloudflare, the RCE succeeds in environments not using a persistent object cache, and requires neither login nor any user action. The fact that this targets WordPress core rather than a plugin-specific flaw also amplifies its impact. However, it has not been confirmed whether the same chain succeeds in configurations that do use a persistent object cache.
Different Scope of Impact Between 6.8 and 6.9+
The two vulnerabilities affect different version lines. WordPress 6.8 contains only the SQL injection, while the full unauthenticated RCE chain is possible from 6.9 onward, where the REST API route confusion flaw is also present.
| Line | Affected Versions | Impact | Fixed Version |
|---|---|---|---|
| 6.8 | 6.8.0–6.8.5 | SQL injection via CVE-2026-60137 | 6.8.6 |
| 6.9 | 6.9.0–6.9.4 | Unauthenticated RCE via chained flaws | 6.9.5 |
| 7.0 | 7.0.0–7.0.1 | Unauthenticated RCE via chained flaws | 7.0.2 |
| 7.1 beta | beta versions | Unauthenticated RCE via chained flaws | beta2 |
The first thing administrators should check is whether the forced automatic update succeeded. WordPress's official announcement urges immediate updating, and as of July 20, the NCSC has confirmed real-world exploitation. Cloudflare deployed Web Application Firewall (WAF) rules for both free and paid plans at 17:03 UTC on July 17, but this protection assumes traffic passes through Cloudflare and that the relevant rule is set to block. A WAF adds a layer of defense until updates are applied—it does not fix the vulnerable core code itself.
Vulnerability Research Is Changing Beyond Benchmarks
OpenAI made GPT-5.6 generally available on July 9, positioning Sol as its flagship model and ultra as a high-capability configuration in which 4 agents collaborate by default. The company states that GPT-5.6's cyber capabilities do not exceed the "Critical" threshold in its safety evaluations, and that it is stronger at finding and fixing vulnerabilities than at autonomously carrying out end-to-end attacks against robust targets. This case, too, is not one in which the model autonomously carried out everything from target selection through disclosure.
Still, the fact remains: in real-world core software, an attack chain spanning disparate features was discovered in a short time and led to a fix from the developer. Code exploration and hypothesis development—work that has traditionally required time from skilled human experts—can now be broadly distributed across multiple AI agents. Rather than reducing human work, this shifts it toward deciding which targets to investigate under what conditions, how to reproduce the model's output, and when and to whom to hand off dangerous findings.
One success does not mean AI will always find zero-days in 10 hours for $25. What is needed next are reproducible trials across different codebases that measure success rates and false positives, while also aligning total token usage and human verification time. However, defenders don't have the luxury of waiting for that tally. In this case, only a weekend separated the July 17 release of the fix from the NCSC's July 20 warning of real-world exploitation. The number WordPress operators need to check right now isn't the model's cost—it's whether their own site has been updated to 6.8.6, 6.9.5, 7.0.2, or later.