The critical WordPress vulnerability chain known as “wp2shell” was discovered with substantial assistance from an AI model, which identified both the initial pre-authentication SQL injection and a complex path to remote code execution.
Patchstack now says attackers are actively exploiting the flaws, increasing the urgency for administrators to confirm their sites are patched.
Adam Kues, a security researcher at Searchlight Cyber, explained in a blog post today that he found the chain after directing GPT-5.6 Sol Ultra to audit a clean copy of the latest stable WordPress source code. Kues adapted a multi-agent research prompt originally designed to solve difficult mathematical problems, instructed the model to avoid changelogs and internet-based patch comparisons, and asked it to search specifically for a realistic pre-authentication route to code execution.
According to Kues, the model first identified an unauthenticated SQL injection and later developed a multi-stage exploit that escalated database access to administrator privileges and ultimately to remote code execution. The work took a little over 10 hours of model runtime and cost roughly $25 based on prorated usage of a $200 subscription.
Searchlight Cyber is a cybersecurity company focused on external attack-surface monitoring and threat intelligence. Its Assetnote platform provides customers with checks for newly discovered vulnerabilities, often before full technical details become public.
The exploit chain affects WordPress core rather than a third-party plugin, making it particularly significant. WordPress is one of the world’s most widely deployed content-management systems, with estimates commonly placing its global footprint at hundreds of millions of websites.
At the technical level, wp2shell combines two flaws. The first, CVE-2026-63030, is a route-and-handler confusion bug in the WordPress REST API batch endpoint. A malformed request can cause WordPress to validate one sub-request against the wrong handler and then execute it using another, breaking the normal link between validation, permissions, and dispatch.
The second issue, CVE-2026-60137, is an SQL injection condition in WP_Query. A parameter used to exclude author IDs is sanitized when passed as an array, but not when supplied as a scalar value. Under normal processing, WordPress validation prevents that unsafe input from reaching the query layer. The batch-route confusion bypasses those checks and exposes the injection to unauthenticated attackers.
The AI-generated exploit went further by abusing WordPress’s in-memory post cache, oEmbed cache rows, theme customization changesets, post-parent cycle handling, and dynamically generated hooks. This allowed the attacker to temporarily assume an administrator’s identity, replay the original REST request with elevated privileges, create a new administrator account, and then upload a malicious plugin to execute code.
Kues said several parts of the chain surprised him, including the use of nested batch requests to bypass method restrictions and the decision to trigger the parse_request hook to replay the attack while administrator privileges were active.
Patchstack has independently confirmed that the combined vulnerabilities can lead to full site takeover and says it is already seeing exploitation attempts in customer logs. The company advises administrators to check for unfamiliar user accounts and other signs of compromise.
WordPress users should update immediately to version 7.0.2, 6.9.5, or 6.8.6, depending on their branch. Administrators should also review newly created accounts, recently installed plugins, modified PHP files, web server logs, and outbound connections, especially on systems that were not patched before public exploit details became available.
Leave a Reply