WordPress RCE Vulnerability Discovered on GPT-5.6 For Just $25, Some Brokers Will Pay Up To $500K

Using GPT-5.6 Sol Ultra, a security researcher at Searchlight Cyber discovered a critical Remote Code Execution (RCE) vulnerability in WordPress. Remote Code Execution (RCE) allows an attacker to execute arbitrary code on a remote target without needing any credentials. It took approximately 10 hours to find this vulnerability at a cost of ~$25 (~half a week on a $200/month subscription).

This vulnerability impacts over 500 million websites globally. In the black market, exploit brokers will pay up to $500,000 for RCE vulnerabilities like this in WordPress, which is one of the highest payouts due to WordPress being the underlying technology powering nearly half of all websites.

In order to exploit this vulnerability, GPT-5.6 Sol Ultra was able to identify and combine five different vulnerabilities together. These included a validation desynchronization issue within WordPress’ batch API, SQL Injection via WordPress’ batch API, oEmbed cache poisoning, changing changesets to achieve temporary admin privileges, and abusing hooks to resend requests with higher privileges. None of these individual vulnerabilities are critical by themselves but they can be combined together into a powerful exploit.

Without the help of artificial intelligence, it would be impossible for any specialist to piece together these various vulnerabilities within 10 hours. Previously, tasks such as this would require specialized knowledge and take several weeks to complete. However, with the lowered barrier for entry into complex hacking, we need to shift our thinking when it comes to cybersecurity.