Listen to this Post
Introduction: The Moment AI Became a Real Cybersecurity Force
For years, artificial intelligence has been described as a future technology that would eventually transform cybersecurity. That future may have arrived sooner than expected. A new incident involving WordPress Core vulnerabilities demonstrates that advanced AI systems are no longer limited to assisting security researchers — they are becoming capable of independently discovering complex attack paths that previously required months of human expertise.
Security researchers at Searchlight Cyber used OpenAI’s GPT-5.6 Sol Ultra model to create a complete exploit chain against two critical WordPress Core vulnerabilities. The discovery, named WP2Shell, demonstrates how AI can analyze millions of lines of code, identify hidden weaknesses, and combine multiple flaws into a powerful pre-authentication remote code execution attack.
The research highlights a major turning point: AI is not only helping defenders find vulnerabilities faster, but it is also lowering the barrier for attackers who want to discover and weaponize security flaws.
WordPress Core Under Attack: A Rare and Dangerous Vulnerability Class
WordPress powers a significant portion of the internet, making security issues within its core software especially dangerous. Unlike plugin or theme vulnerabilities, WordPress Core flaws affect the foundation of the platform itself.
The WP2Shell exploit chain combines two separate vulnerabilities:
CVE-2026-63030: Critical REST API Route Confusion Vulnerability
The first vulnerability, tracked as CVE-2026-63030, is a critical WordPress REST API batch endpoint route confusion flaw.
The vulnerability received a CVSS score of 9.8, placing it among the most severe security issues.
Affected versions include:
WordPress 6.9.x before 6.9.5
WordPress 7.0.x before 7.0.2
The flaw allows attackers to exploit inconsistencies between security validation and actual request execution. This creates a situation where malicious requests can bypass intended protections.
CVE-2026-60137: SQL Injection Opens the Door
The second vulnerability, CVE-2026-60137, affects the author__not_in parameter inside WordPress’s WP_Query functionality.
This vulnerability allows SQL injection attacks.
Affected versions include:
WordPress 6.8.x before 6.8.6
WordPress 6.9.x before 6.9.5
WordPress 7.0.x before 7.0.2
Although rated lower than CVE-2026-63030 with a CVSS score of 5.9, it became extremely dangerous when combined with the REST API weakness.
Individually, each vulnerability creates risk. Together, they become a complete attack chain capable of achieving remote code execution.
WP2Shell: Turning Two Bugs Into Full Remote Code Execution
Searchlight Cyber named the chained exploit WP2Shell because the attack ultimately allows attackers to gain shell-level control over vulnerable WordPress servers.
According to researcher Adam Kues, the attack requires no authentication, special configuration, or vulnerable plugins.
A completely default WordPress installation can be targeted.
The attack chain works by:
Exploiting REST API route confusion
Triggering SQL injection through WP_Query
Extracting administrator information
Manipulating WordPress internal systems
Escalating privileges
Uploading a malicious backdoor plugin
This makes WP2Shell significantly different from many previous WordPress vulnerabilities.
GPT-5.6 Sol Ultra Discovers an Exploit Chain Normally Requiring Months
The most remarkable part of this research was not only the vulnerability discovery, but the speed at which AI completed the entire process.
Searchlight Cyber researcher Adam Kues used GPT-5.6 Sol Ultra to analyze a clean copy of the WordPress source code.
The researcher intentionally removed version history to prevent the AI from simply identifying known changes between releases.
The AI was instructed to operate multiple agents and search for a pre-authentication remote code execution pathway.
The process continued for more than ten hours.
How AI Built the WP2Shell Attack Automatically
The AI model first identified the REST API route confusion vulnerability.
It then recognized that the flaw could bypass input validation and connect with the SQL injection vulnerability.
Within minutes, the model successfully extracted administrator information from a fresh WordPress installation.
However, the most impressive part came afterward.
The AI discovered a complex escalation path involving:
Cache poisoning through fake oEmbed entries
WordPress customization changeset manipulation
Temporary administrator privilege escalation
Authentication bypass techniques
Malicious plugin upload mechanisms
The result was a complete remote code execution chain.
Deep Analysis: How Attackers Could Use Similar AI Techniques
Understanding the New AI-Powered Exploit Model
The WP2Shell discovery represents a fundamental change in vulnerability research.
Traditional exploitation often requires:
Manual source-code review
Reverse engineering
Testing multiple attack theories
Understanding application architecture
Writing custom proof-of-concept code
AI systems can now perform many of these steps simultaneously.
Example Security Research Workflow
A simplified AI-assisted vulnerability research workflow may look like:
git clone https://github.com/WordPress/wordpress-develop.git
cd wordpress-develop
grep -R REST API .
grep -R WP_Query .
grep -R authentication .
grep -R permission .
An AI agent can analyze these findings and search for relationships between components.
Example Automated Testing Concept
Security researchers may combine AI with testing frameworks:
python3 scanner.py \n--target wordpress-site.com \n--check-rest-api \n--analyze-query-functions \n--test-authentication-flow
The difference is that AI can interpret unexpected behaviors and create new attack hypotheses.
The Cybersecurity Economic Shift
Zero-day vulnerabilities have significant underground value.
A WordPress Core remote code execution vulnerability could potentially be worth hundreds of thousands of dollars on exploit markets.
The fact that AI can discover similar vulnerabilities using relatively low computational costs changes the economics of cybercrime.
Attackers no longer need:
Large research teams
Years of experience
Expensive vulnerability labs
They may only need access to advanced AI models.
AI Creates a New Defender-Attacker Race
The same technology that discovers vulnerabilities can also:
Generate patches
Detect suspicious code patterns
Review software changes
Predict future attacks
The future of cybersecurity will likely depend on who uses AI more effectively:
Attackers searching for weaknesses.
Or defenders eliminating them before exploitation.
WordPress Responds With Emergency Protection Measures
After discovering the threat, WordPress released version 7.0.2 to fix both vulnerabilities.
The project also took the unusual step of forcing automatic updates for affected installations.
Administrators should confirm their websites are running:
WordPress 7.0.2
WordPress 6.9.5
Organizations should immediately review:
Server logs
Administrator accounts
Plugin installations
Unexpected file changes
Security Researchers Observe Possible Active Exploitation
After public disclosure, multiple security companies began reporting exploitation attempts.
PatchStack reported activity involving both vulnerabilities.
Security firms including Hexastrike and WatchTowr also observed indicators suggesting attackers were testing the vulnerabilities.
Although the full scale of exploitation remains unclear, the availability of public research increases the urgency for website owners to patch quickly.
Free WP2Shell Scanner Helps Organizations Check Exposure
Searchlight Cyber released a free scanning tool that allows administrators to determine whether their WordPress installations remain vulnerable.
The tool provides organizations with a way to identify exposure before attackers successfully compromise their systems.
For large organizations running hundreds or thousands of WordPress websites, automated vulnerability checking will become increasingly important.
What Undercode Say:
AI Has Entered the Offensive Security Battlefield
The WP2Shell research is one of the clearest examples of AI moving from theory into practical cyber operations.
The discovery proves that AI models can understand complex software architecture.
The ability to combine vulnerabilities is more important than finding individual bugs.
Modern attacks are rarely based on one mistake.
They depend on chains of weaknesses.
AI is becoming extremely effective at finding those connections.
A human researcher may notice a suspicious function.
An AI agent can analyze thousands of related functions.
A human may test dozens of attack ideas.
An AI system can test hundreds.
The biggest concern is not that AI finds vulnerabilities.
The biggest concern is that AI reduces the expertise required to exploit them.
Previously, advanced exploitation required elite researchers.
Now, powerful AI models could provide similar capabilities to less experienced attackers.
The cybersecurity industry is entering a period where vulnerability discovery speed will increase dramatically.
Companies that rely only on traditional security testing methods may struggle.
Continuous code monitoring will become necessary.
AI-powered defensive tools will become mandatory.
Organizations must assume that attackers are also using AI.
The balance between offensive and defensive AI capabilities will define the next generation of cybersecurity.
WordPress is only one example.
The same approach could eventually target:
Enterprise applications
Cloud infrastructure
Mobile platforms
Operating systems
Open-source projects
The future battlefield is not human versus machine.
It is AI system versus AI system.
The winners will be organizations that integrate artificial intelligence into their security strategy before attackers do.
✅ Confirmed: WordPress Released Security Updates
WordPress released updates addressing the reported vulnerabilities, including versions 7.0.2 and 6.9.5.
The vulnerabilities affected WordPress Core rather than third-party plugins, making the issue more serious.
✅ Confirmed: AI Was Used to Build the Exploit Chain
Searchlight Cyber researcher Adam Kues documented the use of GPT-5.6 Sol Ultra to assist in discovering and developing the WP2Shell exploit chain.
The research demonstrated AI-assisted vulnerability discovery capabilities.
⚠️ Partially Confirmed: Large-Scale Exploitation
Security companies reported exploitation attempts, but the complete impact and number of compromised websites have not been fully confirmed.
Organizations should still treat the vulnerabilities as high risk.
Prediction
(+1) AI-Powered Security Research Will Become Standard
Security teams will increasingly use AI agents to discover vulnerabilities before attackers find them.
Future penetration testing platforms will likely include autonomous AI researchers capable of analyzing applications continuously.
(+1) Software Development Will Become More Secure
AI-assisted code reviews may identify dangerous programming patterns earlier during development.
Developers will increasingly rely on AI security assistants before releasing software.
(-1) Attackers Will Discover More Zero-Days Faster
The same technology that helps defenders will also empower cybercriminal groups.
The number of sophisticated attacks may increase as AI lowers technical barriers.
(-1) Traditional Security Testing Will Become Less Effective Alone
Manual penetration testing and periodic audits may not be enough in an environment where AI can continuously search for weaknesses.
Organizations will need automated, real-time security monitoring.
Final Conclusion: The AI Cybersecurity Era Has Begun
The WP2Shell discovery is more than another WordPress security incident.
It represents a fundamental shift in how vulnerabilities are discovered and exploited.
AI has demonstrated that it can analyze complex systems, connect multiple weaknesses, and create advanced attack chains faster than traditional human methods.
The cybersecurity industry is entering a new era where speed, automation, and intelligence will determine survival.
The question is no longer whether AI will change cybersecurity.
The question is whether defenders will adapt faster than attackers.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
