AI Agent Discovers Critical WordPress Vulnerability "wp2shell" in Ten Hours
Researchers at Searchlight Cyber demonstrated the capabilities of OpenAI's GPT-5.6 Sol Ultra model by using it to discover a critical remote code execution vulnerability in WordPress, tracked as CVE-2026-63030, in just ten hours. The AI setup successfully identified an unauthenticated SQL injection and escalated it to a full remote code execution exploit chain using only source code analysis. This event highlights the rapidly advancing capabilities of AI agents in automated code review and vulnerability discovery, achieving results at a fraction of the traditional time and cost. It signals a shift where both cybersecurity defenders and malicious actors can leverage advanced AI to significantly lower the barrier to finding high-severity zero-day exploits. To prevent the model from referencing pre-existing data, the analysis was conducted in a restricted environment without Git history or internet access. The entire discovery process cost approximately $25 in API usage, employing four collaborative AI agents for six hours of code review followed by four hours of exploit chain analysis.
## BACKGROUND
WordPress is a widely used open-source content management system, making its core vulnerabilities high-value targets for attackers. Remote Code Execution (RCE) is a critical vulnerability class that allows an attacker to run arbitrary commands on a host server, potentially leading to a complete system takeover. SQL Injection (SQLi) is a vulnerability where malicious SQL statements are inserted into entry fields, which can sometimes be chained with other flaws to achieve RCE.