GPT5.6 finds $500K WordPress RCE for $25
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Searchlight Cyber researcher reproduced a pre-authentication RCE in default WordPress using GPT5.6 Sol Ultra for about $25 of API spend on a $200 subscription, consuming 50% of weekly usage — a bug class exploit brokers value at $500,000
- WordPress's batch API, introduced in version 5.6 in 2020, separates parameter validation and endpoint execution into two loops, letting attackers skip the sanitization step and chain a pre-auth SQL injection into admin takeover and full RCE
- GPT5.6 Sol Ultra surfaced the pre-auth SQLi on its first run and escalated it to RCE about 4 hours later, after the researcher pointed 4 agents at the WordPress source tree for at least 6 hours and forbade internet or git-history lookups
- The researcher adapted the prompt OpenAI published for Sol's Cycle Double Cover conjecture solution, repurposing a math-problem methodology for vulnerability discovery and instructing agents to audit underlying libraries from a third_party/ folder rather than search the web
- WordPress was given a weekend head start to ship upgrades before disclosure; security researchers Calif and Hacktron independently reproduced the full chain before proof-of-concept code appeared on GitHub
- Over 500 million WordPress instances run worldwide in default configuration per Searchlight's estimate, and the researcher notes WordPress — 'one of the most hardened targets of all time' — had not seen a meaningful pre-auth vulnerability this decade
Why it matters: For the 500 million-plus WordPress sites in default configuration, a pre-auth RCE chain enables full server takeover without credentials, and the researcher notes WordPress hadn't had a meaningful pre-auth vulnerability this decade. The discovery cost roughly $25 of GPT5.6 usage against a $500,000 broker valuation, using a prompt publicly released by OpenAI for a math problem — meaning the methodology is replicable by any researcher with a $200 subscription.
