A $25 AI Run Found WordPress's $500K Bug
Searchlight Cyber's Sean Kues did something that should make every WordPress admin nervous. He handed GPT-5.6 Sol Ultra a clean copy of the WordPress source code, stripped of its version history so the model couldn't cheat by reading the patch notes, and told it to run up to four agents for at least six hours hunting for a pre-authentication remote code execution path. Ten hours and about twenty-five dollars of API time later, it found one.
The bug is actually two, chained. First a type confusion in WordPress's REST API batch endpoint that lets a crafted request slip past input validation (CVE-2026-63030). Then a SQL injection in a query parameter (CVE-2026-60137). Chain them and you get pre-auth RCE against WordPress 6.9.x and 7.0.x, which is to say against a huge slice of the internet. WordPress shipped 7.0.2 on July 17 to close both.
The framing is the part worth sitting with. Exploit brokers pay up to half a million dollars for a working WordPress RCE. Kues found one for the price of a nice dinner. That half-million isn't a documented sale, it's his rhetorical anchor, but the ratio is the whole story: the economics of finding critical bugs just fell off a cliff. What used to take an elite researcher weeks now takes an agent swarm an afternoon.
Both sides get this weapon at the same time. Defenders can now fuzz their own code with the same tool before shipping; attackers can point it at every CMS on earth. The uncomfortable truth is that the attacker's job is easier, because they only need one bug and the defender needs to find all of them. Read the writeup at slcyber.io.
← Back to all articles
The bug is actually two, chained. First a type confusion in WordPress's REST API batch endpoint that lets a crafted request slip past input validation (CVE-2026-63030). Then a SQL injection in a query parameter (CVE-2026-60137). Chain them and you get pre-auth RCE against WordPress 6.9.x and 7.0.x, which is to say against a huge slice of the internet. WordPress shipped 7.0.2 on July 17 to close both.
The framing is the part worth sitting with. Exploit brokers pay up to half a million dollars for a working WordPress RCE. Kues found one for the price of a nice dinner. That half-million isn't a documented sale, it's his rhetorical anchor, but the ratio is the whole story: the economics of finding critical bugs just fell off a cliff. What used to take an elite researcher weeks now takes an agent swarm an afternoon.
Both sides get this weapon at the same time. Defenders can now fuzz their own code with the same tool before shipping; attackers can point it at every CMS on earth. The uncomfortable truth is that the attacker's job is easier, because they only need one bug and the defender needs to find all of them. Read the writeup at slcyber.io.
Comments