An AI Found an Unauthenticated RCE in WordPress Core for $25. Brokers Pay $500,000 for Bugs Like It.

TL;DR

On July 20, a researcher at Searchlight Cyber did something that should reorder every security team's threat model: he pointed a stock $200-a-month GPT-5.6 Sol Ultra subscription at WordPress core, let four agents grind for just over ten hours, and spent about $25 in usage. Out came wp2shell, an unauthenticated remote-code-execution chain (tracked as CVE-2026-63030 and CVE-2026-60137) that puts the 500 million-plus sites running WordPress one request away from full takeover.

Patches shipped in 7.0.2, 6.9.5 and 6.8.6, public exploits are already on GitHub, so update now. The uncomfortable part for builders is not the vulnerability at all. It is the receipt: the cost of discovering a $500,000-class bug just fell to the price of a large pizza.

What actually happened

Adam Kues, of Searchlight's Assetnote team, has found serious bugs the old-fashioned way for years. This time he handed the job to a model. He fed WordPress core to the AI, ran up to four agents in parallel, and let them read code for just over ten hours.

To keep it honest, he stripped the repository of its version-control history and cut off internet access during the run. No git blame, no CVE database, no Stack Overflow. The point was to force the model to genuinely understand the code rather than pattern-match on a known-bad diff. Think of a cold-case detective handed the raw case file instead of the previous investigator's margin notes.

The bill for all of it came to roughly $25, which he pegs at about half a week of a $200 plan.

The bug: wp2shell, end to end

wp2shell is not one flaw, it is a chain. The novel link, and the one the model surfaced, is a REST API "batch-route confusion" in WordPress's /wp-json/batch/v1 endpoint.

When one sub-request in a batch errors out, the endpoint's parallel bookkeeping arrays fall out of sync, and an attacker can walk past the allow-list that is supposed to gate which routes a request may touch. Picture a coat check where a single misfiled ticket shifts every claim stub down by one: suddenly you are being handed a coat that was never yours.

Past the gate sits the second bug: a SQL injection through the author__not_in query parameter. Chain them and an unauthenticated attacker reads password hashes, poisons the post cache, abuses a customize changeset to reach admin, and finally executes code. On a default install. Without ever logging in.

Why unauth RCE in core is a rare beast

Plugins are a swamp; core is not. As the researchers at watchTowr put it, a highly impactful unauthenticated SQLi or RCE in WordPress core itself is "actually fairly rare." That is what makes this one matter: it does not need a sketchy plugin or a niche theme, only a vulnerable core version shipped after December 2025.

The part that should worry you: the price

Here is the number to sit with. Exploit brokers, by the researcher's own account, pay up to $500,000 for a clean, unauthenticated WordPress RCE. He found one for $25. That is a 20,000x spread, and for once you are on the wrong side of the trade.

This is the real story, and it is not really about WordPress. A commodity subscription, the same one your team probably expenses, just did frontier-grade vulnerability research against one of the most-scrutinized codebases on the planet, on a weekend budget.

What to do right now

• Update immediately to WordPress 7.0.2, 6.9.5, or 6.8.6. WordPress pushed forced automatic security updates for affected branches, but confirm yours actually took.
• Can't patch this second? Block /wp-json/batch/v1 at your WAF, or drop REST API access for unauthenticated users, as a temporary mitigation.
• Assume exploitation. Working proof-of-concept code is already public on GitHub, and the full-chain window (6.9.0-6.9.4 and 7.0.0-7.0.1) covers roughly eight months of releases.

What it means for builders

The asymmetry cuts both ways. If a lone researcher can find core RCE for $25, so can your team, before it ships. Continuous, agent-driven code review against your own repositories is now cheap enough that skipping it is a decision, not a budget constraint.

It also means the floor just dropped for attackers. The bugs were always there; the labor to find them was the moat. That moat is now about $25 deep. Plan your patch cadence, bug-bounty budget, and on-call staffing for a world where novel zero-days arrive faster, and from people who could not have afforded to look last year.

Key Takeaways

• wp2shell is an unauthenticated RCE chain in WordPress core (CVE-2026-63030 + CVE-2026-60137) threatening 500 million-plus sites. Patch to 7.0.2, 6.9.5, or 6.8.6 now.
• It was found by an AI: GPT-5.6 Sol Ultra, up to four agents, just over ten hours, and about $25 of usage.
• The chain is batch-route confusion to bypass the REST allow-list, then a SQLi via author__not_in, then admin, then code execution on default installs.
• Public exploits are already on GitHub. Block /wp-json/batch/v1 at the WAF if you cannot patch immediately.
• The market price for a bug like this runs up to $500,000; the discovery cost was $25, a 20,000x collapse in the economics of finding zero-days.
• The same cheap, agent-driven auditing is available to defenders. Running it against your own code is now the baseline, not a luxury.

Sources: Searchlight Cyber (Adam Kues), The Hacker News, BleepingComputer