OpenAI's latest GPT-5.6 Sol Ultra model has demonstrated a troubling new capability: it can autonomously discover and chain together critical security vulnerabilities faster and cheaper than human researchers. A security researcher at Searchlight Cyber used the model to develop a complete exploit for two severe WordPress Core flaws in just over 10 hours, spending approximately $25 in compute costs. The exploit, dubbed "WP2Shell," chains together a critical REST API vulnerability and a SQL injection flaw to achieve unauthenticated remote code execution on default WordPress installations.

What Makes This WordPress Exploit So Dangerous?

The two vulnerabilities at the heart of WP2Shell are severe because they affect WordPress Core itself, not a plugin or theme. This means any WordPress site running versions 6.9.x or 7.0.x before the July 17 patches is vulnerable, regardless of what plugins are installed. The first vulnerability, tracked as CVE-2026-63030, is a REST API batch endpoint route confusion issue with a critical severity score of 9.8 out of 10. The second, CVE-2026-60137, is a SQL injection flaw with a high severity rating of 5.9.

What makes the AI-discovered exploit chain particularly alarming is its complexity. The model didn't simply find one vulnerability and stop. Instead, it constructed a multi-stage attack that exploited cache poisoning through fake oEmbed entries, manipulated WordPress customize changesets to grant itself temporary administrative privileges, and triggered hooks to bypass authentication entirely before uploading a backdoor plugin. This level of sophistication would have taken a human security researcher weeks or months to discover.

"No security researcher could have found and completed this exploit chain in 10 hours without AI," stated Adam Kues, security researcher at Searchlight Cyber.

Adam Kues, Security Researcher at Searchlight Cyber

How Did the Researcher Use GPT-5.6 Sol Ultra to Find the Exploit?

The approach was methodical and deliberately designed to prevent the model from taking shortcuts. Kues adapted a prompt that OpenAI had previously used to solve a complex mathematical conjecture, then stripped version history from clean WordPress source code to prevent the model from "cheating" by pattern-matching against known fixes. He then instructed GPT-5.6 Sol Ultra to run up to four agents for at least six hours hunting for a pre-authentication remote code execution path.

The model's performance was striking. Within minutes, it flagged the REST API batch route confusion vulnerability and realized that a desynchronization between validation and execution allowed it to bypass input sanitization and trigger the SQL injection. Within minutes more, it used the SQL injection to extract the administrator email from a fresh installation. The real breakthrough came over the next four hours, when the model constructed the incredibly complex multi-stage chain that ultimately achieved full remote code execution.

Steps to Protect Your WordPress Installation

• Update Immediately: Ensure your WordPress installation is running version 7.0.2 or version 6.9.5, which patch both CVE-2026-63030 and CVE-2026-60137. WordPress took the rare step of forcing automatic updates for affected installations.
• Verify Your Version: Manually confirm that your site is running a patched version by checking the WordPress dashboard or using the free scanning tool at wp2shell.com, released by Searchlight Cyber.
• Monitor for Exploitation: Be aware that security firms including PatchStack, Hexastrike, and WatchTowr have already observed in-the-wild exploitation attempts of these vulnerabilities, making swift patching critical.

What Does This Mean for AI Security Economics?

The cost and speed of this AI-powered vulnerability discovery has profound implications for cybersecurity economics. Exploit brokers reportedly pay up to $500,000 for zero-day remote code execution vulnerabilities in WordPress Core. The fact that an off-the-shelf AI model found one for $25 in compute costs represents a fundamental shift in how security vulnerabilities will be discovered and monetized.

This is not a theoretical concern. The exploit was discovered and published on July 20, and within days, multiple security researchers released proof-of-concept exploits. The barrier to entry for finding critical vulnerabilities has collapsed. Any attacker with access to GPT-5.6 Sol Ultra through ChatGPT Work Pro or Enterprise plans can now attempt to discover zero-day exploits autonomously, running the model for hours at a time to hunt for security flaws.

The implications extend beyond WordPress. If GPT-5.6 Sol Ultra can discover complex exploit chains in widely-used open-source software, the same capability applies to any codebase the model can access. This raises urgent questions about how security researchers, software vendors, and AI companies should coordinate to prevent the weaponization of frontier AI models for vulnerability discovery.

WordPress responded by forcing automatic updates, a rare step that underscores the severity of the threat. For enterprises and site administrators, the lesson is clear: the window between vulnerability disclosure and active exploitation is shrinking, and AI-powered discovery means that window may close faster than traditional security practices can accommodate.