A security researcher used the GPT5.6 Sol Ultra AI model to discover and chain multiple vulnerabilities in WordPress, successfully achieving remote code execution (RCE) in under 10 hours.

Key Points

• The AI identified a pre-authentication SQL injection by exploiting a validation desynchronization bug within the WordPress Batch API.
• Researchers bypassed API method restrictions by using recursive batch calls, allowing the execution of unauthorized GET requests.
• The exploit chain leveraged in-memory cache poisoning and a cycle-detection gadget to temporarily escalate privileges to an administrator.
• By triggering the parse_request hook while holding administrator authority, the AI enabled the creation of a new admin account to upload a backdoor.
• The entire research process, including exploit development, cost approximately $25 in AI subscription usage.

Why it Matters

This discovery highlights a significant shift in cybersecurity where AI models can autonomously chain complex, disparate vulnerabilities that would typically require days of expert human analysis. As these tools become more capable, organizations must prioritize rapid patching and automated security testing to defend against increasingly sophisticated, AI-driven exploit development.