GPT-5.6 Sol Ultra has reportedly uncovered a critical pre-authentication remote code execution (RCE) vulnerability in WordPress after approximately $25 worth of AI usage. This highlights how advanced models could reshape vulnerability research.
Researchers at Searchlight Cyber tasked GPT-5.6 Sol Ultra with auditing a local copy of the WordPress source code using four AI agents over at least six hours.
The model identified a complete exploit chain that could allow an unauthenticated attacker to gain administrator privileges and ultimately execute arbitrary code on vulnerable WordPress sites.
The researchers estimated the potential damage from this issue at up to $500,000, reflecting the high value typically assigned to reliable zero-click or pre-authentication RCE vulnerabilities affecting widely used software.
GPT-5.6 Sol Ultra Found a WordPress RCE
Given that WordPress powers over 500 million websites worldwide, any default-configuration RCE is especially significant.
The reported attack begins in WordPress’s Batch API, accessible through the /wp-json/batch/v1 endpoint. This API processes multiple REST requests within a single HTTP request.
According to the report, a misalignment between the validation results and the matched REST handlers, due to an error-handling condition, could allow an attacker to validate one request while executing it against another endpoint handler.
This desynchronization reportedly allows bypassing the parameter sanitization safeguards employed by REST API routes.
The researchers noted a combined issue within the posts endpoint, where an author_exclude value could be sent to a database query without proper escaping when provided as a scalar rather than the expected integer array.
Since the Batch API usually blocks GET requests, the AI model created a nested batch request to bypass method validation, thereby bypassing validation of the SQL-related parameter.
This led to a pre-authentication SQL injection vulnerability that could read data from the WordPress database. The escalation from SQL injection to RCE involved a more complex series of actions.
The researchers explained how the model exploited WordPress’s in-memory post cache and the oEmbed caching mechanism to create controlled database-backed post records. It then converted these entries into special customize_changeset objects.
WordPress changesets can apply configuration changes to a site under the authority of a specified user. By forging a changeset associated with the administrator user ID 111, the exploit temporarily caused WordPress to assume administrator privileges during request processing.
The final phase of the attack leveraged WordPress hooks and a crafted post hierarchy cycle. A forged post caused WordPress to invoke the parse_request hook, replaying the malicious batch request.
At the same time, the process still held temporary administrator privileges. During this second pass, the attacker could create a new administrator account and install a malicious plugin to gain code execution.
Searchlight Cyber delayed public reporting to give defenders time to address the issue. Independent researchers, including Calif and Hacktron, reportedly reproduced the full exploit chain before the proof-of-concept code was published on GitHub.
Administrators are urged to apply the latest WordPress security updates immediately and review logs for suspicious requests to /wp-json/batch/v1. Organizations can also check for potential exposure using the hosted scanner at wp2shell.
