Security Researcher Found $500K-Class WordPress RCE Using GPT-5.6 Sol Ultra for $25

What happened

Searchlight Cyber published a research post on July 19-20, 2026 documenting how a researcher used GPT-5.6 Sol Ultra for under $25 to autonomously discover the 'wp2shell' vulnerability chain in WordPress core — a type of exploit that exploit brokers pay up to $500,000 for.

Context and impact

The research dramatically illustrates how advanced AI models are reshaping the economics of cybersecurity. Discovering such vulnerabilities previously required teams of experienced researchers and weeks of work. The case raises fundamental questions about the democratization of offensive security research.

Details

• Model: GPT-5.6 Sol Ultra (OpenAI); compute cost: ~$25
• CVE-2026-63030: REST API batch-route path confusion (pre-authenticated)
• CVE-2026-60137: SQL injection in WordPress core ('author__not_in' parameter in WP_Query)
• Chain achieves RCE on default WordPress 6.9.0+ with no plugins required
• Patches: WordPress 7.0.2, 6.9.5, and 6.8.6 with automatic update push
• Affected: 500M+ WordPress installations worldwide