WP2Shell: GPT-5.6 Auto-Generates Critical WordPress RCE Chain

Overview/Introduction

In mid-July 2026, researchers at Searchlight Cyber disclosed a startling development: an advanced AI model-OpenAI’s GPT-5.6 Sol Ultra-was used to autonomously discover, link, and fully weaponize two critical WordPress Core vulnerabilities. The resulting exploit chain, dubbed WP2Shell, provides unauthenticated remote code execution (RCE) against default WordPress installations (versions 6.8.x through 7.0.x). Public proof-of-concepts have been released, and security vendors now report active exploitation at scale.

Technical Details

The WP2Shell chain hinges on two distinct bugs:

• CVE-2026-63030 - A logic flaw in the /wp-json/batch/v1 REST API endpoint introduced in WordPress 6.9. The endpoint processes a batch of sub-requests in a single HTTP call. Improper synchronization of the internal request queue allows a crafted sub-request to desynchronize validation from execution, causing subsequent sub-requests to be routed to unintended handlers. This effectively bypasses the endpoint’s allow-list and lets an attacker inject arbitrary parameters into downstream API calls.
• CVE-2026-60137 - An SQL injection in the author__not_in parameter of the WP_Query class. The parameter expects an array, but the type check can be subverted by passing a specially-crafted string, enabling direct injection of SQL statements into the query.

When combined, the two flaws create a pre-authentication RCE path:

1. The attacker sends a malicious batch request to /wp-json/batch/v1, using the route-confusion bug to invoke the WP_Query endpoint with a malformed author__not_in argument.
2. The SQL injection extracts the option_value of siteurl and, crucially, the admin_email from the wp_options table, confirming successful database access.
3. Leveraging the retrieved admin email, the AI-generated payload injects a UNION SELECT that writes a PHP web-shell into the wp-content/uploads directory via the LOAD_FILE/INTO OUTFILE technique.
4. Finally, the attacker triggers the newly written web-shell through a simple HTTP GET, achieving full RCE under the web-server user.

The entire chain was assembled by GPT-5.6 after being given a stripped copy of the WordPress source and a six-hour, four-agent prompt to “find a pre-auth RCE path”. Within minutes the model identified the batch-route confusion, and over the next few hours it built the multi-stage exploitation logic-including cache-poisoning, object-injection, and the final file-write step.

Impact Analysis

Because both CVEs reside in WordPress Core, the attack surface is massive:

• All installations of WordPress 6.8.x (pre-6.8.6), 6.9.x (pre-6.9.5), and 7.0.x (pre-7.0.2) are vulnerable.
• Estimated hundreds of millions of live sites run a default configuration without hardening (e.g., disabling the REST batch endpoint, applying wp-config.php restrictions, or using WAF rules).
• The exploit requires no authentication, no plugins, and no prior knowledge of the target-making automated scanning and mass exploitation trivial.
• Successful compromise yields full server-side code execution, allowing attackers to install back-doors, mine cryptocurrency, host phishing pages, or pivot to internal networks.

Given the CVSS scores (9.8 for CVE-2026-63030 and 5.9 for CVE-2026-60137) and the observed active exploitation, the overall risk rating is Critical.

Timeline of Events

• July 10, 2026 - Searchlight Cyber begins internal AI-assisted research on WordPress core code.
• July 13, 2026 - GPT-5.6 Sol Ultra flags the batch-route confusion vulnerability (CVE-2026-63030).
• July 15, 2026 - The model discovers the SQL injection in WP_Query (CVE-2026-60137) and begins chaining the two.
• July 17, 2026 - WordPress releases version 7.0.2, patching both CVEs.
• July 18, 2026 - Searchlight publishes an advisory naming the exploit “WP2Shell”.
• July 20, 2026 - Infosecurity Magazine and Dark Reading report on the AI-generated exploit; public PoCs appear on GitHub and Pastebin.
• July 21-26, 2026 - Multiple security vendors (Rescana, WatchTowr, etc.) confirm active exploitation in the wild, primarily by the WP-SHELLSTORM crew.

Mitigation/Recommendations

Organizations should act immediately:

1. Patch now. Upgrade all WordPress installations to 7.0.2 or later. The patch removes the batch-route confusion logic and sanitizes the author__not_in handling.
2. Disable the REST batch endpoint. If you cannot patch immediately, add a rule to .htaccess or your WAF to block /wp-json/batch/v1 requests.
3. Apply a web-application firewall (WAF). Signature-based rules that detect the specific batch-request payload and the SQL-injection pattern can stop exploitation even on unpatched sites.
4. Audit file system permissions. Ensure the web-server user cannot write to wp-content/uploads or any PHP-executable directory without strict controls.
5. Monitor for indicators of compromise. Look for newly created PHP files in uploads, anomalous admin-email changes, and outbound connections to known C2 domains used by WP-SHELLSTORM.
6. Implement least-privilege credentials. Use separate database users with read-only rights for the WordPress application where possible; this limits the damage of a successful SQL injection.
7. Regularly scan. Deploy automated scanners that specifically test for CVE-2026-63030 and CVE-2026-60137, and schedule weekly integrity checks of core files.

Real-World Impact

Early forensic analysis of compromised sites shows a common pattern: attackers deploy a simple web-shell (e.g., wp-shell.php) and then use it to install cryptominers, exfiltrate user credentials, and serve spam/phishing pages. Because the compromise requires no prior authentication, even small blogs, hobbyist sites, and corporate intranets that rely on default WordPress installations are at risk.

For enterprises that host WordPress as a SaaS platform, the vulnerability expands the attack surface to customer-facing portals, potentially exposing client data and violating GDPR/CCPA obligations. The speed of exploitation-public PoCs appeared within 48 hours of disclosure-means that any organization still on an unpatched version is likely already compromised.

Expert Opinion

As a senior cybersecurity analyst, I view WP2Shell as a watershed moment for both vulnerability research and threat modeling. The fact that a frontier AI model could autonomously discover a logical flaw, pair it with a separate injection, and generate a full, weaponizable exploit chain demonstrates a new class of “AI-augmented weaponization”. This raises several concerns:

• Accelerated discovery cycles. Traditional vulnerability research can take weeks or months; GPT-5.6 achieved it in hours. Attackers will increasingly adopt similar pipelines, shrinking the window between discovery and exploitation.
• Core software as a high-value target. Historically, most WordPress exploits focused on third-party plugins. When the core itself is compromised, the entire ecosystem is exposed, and mass-scale attacks become trivial.
• Defensive shift needed. Organizations must move from reactive patching to proactive “AI-aware” threat hunting-monitoring for AI-generated exploit signatures, employing AI-driven code analysis, and integrating AI-risk assessments into the software development lifecycle.
• Policy implications. The open availability of powerful models like GPT-5.6 in commercial plans raises questions about responsible usage, model gating, and the need for industry-wide guidelines on AI-driven exploit generation.

In short, WP2Shell is not just another WordPress bug; it is a proof-point that frontier AI can become a force multiplier for attackers. The security community must adapt quickly-by hardening core platforms, enforcing zero-trust principles, and developing detection capabilities that anticipate AI-crafted attack patterns.