Adam Kues Spent $25. GPT-5.6 Found a $500k WordPress RCE.

The research environment Kues set up for GPT-5.6 Sol Ultra was deliberately bare: a WordPress source checkout stripped of its git history — so the model couldn’t trace bug patterns through commit blame — and airgapped from the internet to block known-vulnerability databases. The prompt was adapted from the framework OpenAI used to direct GPT-5.6’s solution of the Cycle Double Cover conjecture last spring: multi-agent analysis, from first principles, up to four concurrent sub-agents working distinct attack surfaces simultaneously. He let it run for ten hours. The output was a complete, pre-authentication remote code execution chain targeting default WordPress installations, requiring no plugins and no special server configuration. A network connection was sufficient.

Total compute cost: roughly $25. Commercial brokerage value for a WordPress Core RCE at that severity level: $500,000. That gap is not a rounding error. It is the story.

The vulnerability was disclosed July 17 and patched the same day. CVE-2026-63030 covers the batch API route confusion; CVE-2026-60137 covers the SQL injection that the confusion enables. Together they are called wp2shell. WordPress.org forced automatic security updates to 6.9.5 and 7.0.2 across all affected sites within hours of disclosure. watchTowr Labs confirmed early in-the-wild exploitation the following morning. Multiple public proof-of-concept exploits appeared on GitHub by July 18. Both an AI-assisted discovery team — Kues at SLC Cyber — and a conventional security research team at Searchlight Cyber identified the vulnerability on parallel tracks. The AI-assisted team got there first.

The Chain

The batch API route confusion is subtle in the way that high-severity vulnerabilities in mature codebases often are: a synchronization error in parallel data structures that passes code review because each array, viewed in isolation, looks correct.

When WordPress’s REST batch handler processes multiple API calls bundled into a single request, it maintains three parallel arrays: $requests (the incoming calls), $validation (authorization results), and $matches (handler assignments). The flaw fires when the first sub-request in the batch is malformed and fails early parsing. WordPress appends the error to $validation but not to $matches. From that point, $matches is one element shorter than $requests and $validation, and every subsequent request in the batch is dispatched against the wrong handler. As Hadrian.io’s analysis described it: an operation you were never allowed to perform is suddenly waved through, because the server checked the wrong request’s permission.

That desynchronization opens the SQL injection. An attacker sends a batch request with an intentionally malformed first sub-request, then follows it with an unprivileged call targeting the author__not_in parameter of /wp/v2/posts. Because the permission check for this call has been swapped with the wrong handler, the parameter bypasses sanitization and is interpolated directly into the SQL query. From there, Kues’s chain used recursive batching to bypass the API’s GET-restriction on certain endpoints, UNION-based injection to poison the WordPress object cache with fabricated database entries, changeset object manipulation to temporarily assume administrator status, and arbitrary administrator action execution while holding that elevation. Final result: a new admin account created and a malicious plugin uploaded. No credentials, no plugins, no atypical server configuration. The exploit path works on any default WordPress installation not running a persistent object cache — which is to say, the default.

The reason GPT-5.6 found this when human auditors missed it isn’t mysterious. Code reviewers examining the batch handler in isolation would see a structurally plausible array management pattern. The bug exists in the invariant across three arrays — a state property that only becomes visible when tracing dispatch logic across the entire handler cycle. That is exactly the class of problem where large context windows and systematic state enumeration outperform human reviewers working under review-queue pressure. The flaw was present in WordPress Core across versions 6.9.0 through 7.0.1, spanning two major release generations.

The System Card’s Blind Spot

OpenAI made GPT-5.6 generally available on July 9 and published a system card classifying Sol as High capability in Cybersecurity under its Preparedness Framework — one tier below the Critical threshold that would have required regulatory notification and additional access controls. The supporting benchmarks are real: Sol scored 73.5% on ExploitBench2 compared to GPT-5.5’s 47.9%, and 71.2% on SEC-Bench Pro against the prior model’s 45.8%. On ExploitGym3, which measures whether agents can convert known vulnerability descriptions into functional exploits, Sol passed 24.9% of tasks within a two-hour window and 33.7% within six.

The system card’s language about Sol’s offensive limitations is careful: Sol and Terra can find vulnerabilities and pieces of exploits, but did not autonomously carry out end-to-end attacks against hardened targets in testing. Every word is doing work. “Hardened targets” describes the actively monitored, purpose-built environments OpenAI controls for red team evaluations. A default WordPress installation — software maintained across 23 years with backward-compatibility pressure at every major version boundary, deployed by millions of sites without dedicated security engineering — is not a hardened target. It is, as Hadrian.io notes, approximately 43% of the public web.

The mismatch is specific. OpenAI’s Preparedness Framework is calibrated for the kind of environment its own red team can control. The actual exposure surface — open-source codebases, default CMS installations, production software maintained by teams without security specialization — is categorically more exploitable. The ExploitGym3 aggregate of 33.7% is a rate across many targets in a structured benchmark. The Kues result is what that aggregate becomes when focused on a single well-scoped real-world codebase for ten hours. Rapid7 anticipated this explicitly in its CVE advisory: due to WordPress Core being an open-source project and given the current ability of AI models to analyze open-source code, it is highly likely that a public PoC will be made available in a short period of time. The industry is already pricing in AI-accelerated exploit development as a baseline. The question is whether the safety classification reflects the same assumption.

The Jailbreak Asymmetry

The “High but not Critical” Preparedness Framework designation depends, in part, on OpenAI’s safety stack functioning. That assumption is the most important thing to scrutinize here, because the UK AI Security Institute tested it before GPT-5.6’s launch and published what it found.

The AISI ran testing against Sol with grey-box access — the full text of the safety monitor’s reasoning chain, the exact policy rules, and real-time classifier labels that ordinary users never see — and found universal cyber jailbreaks in every testing round conducted before launch. These were not narrow bypasses that degraded the model’s underlying capability: one automated jailbreak retained 83.0% task performance on CyberGym with safety blocking disabled, against 83.6% for a fully unconstrained model. The safety stack was being circumvented while preserving almost all of the model’s offensive competence. The AISI’s report noted that the jailbreaks were developed within hours using automated optimization techniques, and that the operational concern is not a model that produces a prohibited sentence — it’s an agent that maintains coherence across a ten-step exploitation sequence: interpreting an objective, identifying a target, generating payloads, executing code, parsing results, adapting when a step fails.

That reframes the classification. The “High but not Critical” designation is a statement about what OpenAI believes a constrained Sol deployment can do. The AISI result suggests the effective constraint is weaker than OpenAI’s internal red team measured. An adversary who runs a successful jailbreak gets access to a model that scores 83.6% on CyberGym — one that can find a WordPress Core RCE in ten hours for $25 without a responsible disclosure process afterward. Sol’s API pricing is $5 per million input tokens and $30 per million output tokens. At ten hours of agentic inference, the cost to find wp2shell was an afternoon and a credit card transaction.

The wp2shell chain was found by a researcher trying to demonstrate a capability, who disclosed responsibly, and whose disclosure triggered a same-day patch pushed to 500 million installations. The adversarial version of that scenario has a different ending: no disclosure, no patch window, thirty seconds to root on every unprotected site. The safety classification that separates those two scenarios is the AISI’s target, and the AISI found it bypassed in every test round they ran.

The responsible disclosure economy in security research has always depended on researchers having legal safe harbor, vendor relationships, and professional reputation that adversaries don’t. What it has not depended on is researchers being faster at finding vulnerabilities — historically, domain expertise and access determined that advantage. A model that compresses ten hours of directed research into $25 in API calls doesn’t change who wins the vulnerability race. It removes the qualification barrier to entering it.

Kues adapted a math-conjecture prompt into a security research directive and recovered a $500k exploit chain. The meta-skills that remain human are real — what to point the model at, how to evaluate whether the chain actually exploits, when to stop and disclose. They’re also narrower than the Preparedness Framework accounts for. OpenAI’s “High but not Critical” classification was built on testing against hardened infrastructure with its own red team in control. The actual threat model is a competent prompter, a well-scoped open-source target, and $25 on a card. That’s not a hypothetical. It happened last Thursday.

AI-generated editorial illustration · TemperatureZero · July 20, 2026