TheModelDesk

Searchlight Cyber researcher Adam Kues used OpenAI's newly released GPT-5.6 "Sol Ultra" model to independently discover a full pre-authentication remote-code-execution (RCE) chain in stock WordPress. Working from a prompt adapted from OpenAI's own "Cycle Double Cover" math-proof prompt, he ran four parallel agents against a stripped-down copy of WordPress core (with git history removed) for over six hours, at a pro-rated cost of about $25 on his $200/month ChatGPT subscription — using roughly half his weekly usage allowance.

The underlying bug sits in WordPress's REST Batch API (added in WordPress 5.6, 2020), which validates all sub-requests in one loop and executes them in a second loop. When a malformed request triggers an error branch, the "matches" and "validation" arrays desync, letting an attacker pair a validated request with a different endpoint's execution handler — bypassing WordPress's parameter sanitization entirely. Combined with an unsanitized author_exclude parameter on GET /wp/v2/posts (which skips absint casting when passed a scalar string instead of an array), this produces a pre-authentication SQL injection. Because the Batch API normally rejects GET requests, Sol found it could recursively nest batch calls to bypass that restriction too.

About four hours later, the model escalated the read-only SQLi to full RCE by chaining several WordPress internals: poisoning the in-memory post cache via UNION-based injection, fabricating oEmbed-cached database rows, exploiting WordPress's parent-cycle-detection logic to force reconciliation between forged in-memory and real database post data, hijacking a customize_changeset post to temporarily assume an administrator identity, and finally abusing the parse_request hook to replay the original request as that admin — creating a real administrator account and enabling a plugin-upload backdoor for full code execution.

Kues says the ten-hour, fully AI-generated chain would likely have taken a human researcher far longer, and estimates such an exploit could sell for up to $500,000 on exploit-broker markets, versus the roughly $25 in AI compute used to find it. WordPress runs an estimated 500+ million sites worldwide. Searchlight Cyber delayed publication over a weekend to let defenders patch; researchers "Calif" and "Hacktron" independently reproduced the chain before public proof-of-concept code appeared on GitHub. Searchlight has published a checker tool at wp2shell.com for site owners to test exposure.