WordPress 5.6+ Remote Code Execution Chain Discovered by GPT‑5.6 Sol Ultra for $25

WordPress 5.6+ Remote Code Execution Chain Discovered by GPT‑5.6 Sol Ultra for $25

TL;DR

Searchlight Cyber leveraged the GPT‑5.6 Sol Ultra model (costing about $25) to find a pre‑authentication SQL injection in WordPress’s Batch REST API, then combined four distinct bugs—validation‑execution desynchronisation, scalar‑parameter bypass, cache‑poisoning of embed objects, and a cycle‑detection gadget—to obtain full remote code execution (RCE). The researchers claim exploit brokers pay up to $500 000 for such a chain, highlighting the commercial impact of AI‑assisted vulnerability discovery.

1. Why the discovery matters

WordPress powers over 500 million sites; a pre‑auth RCE affects virtually every installation that runs the default configuration. The exploit demonstrates that large‑language models can autonomously generate a complete, weaponizable chain in under 10 hours, dramatically lowering the cost and time required to produce high‑value zero‑days.

2. The AI‑driven research workflow

  • Model and prompt: The authors used the OpenAI GPT‑5.6 Sol Ultra model with a 4‑agent, 6‑hour prompt that explicitly forbade external look‑ups and required a pre‑auth RCE on a vanilla WordPress‑MySQL deployment.
  • Prompt excerpt (key constraints):

    "Do not use changelogs, git history, or the internet… Identify a chain that reads /flag from the filesystem. Use up to 4 agents aggressively."

  • Cost: The $200/month subscription was used for roughly half a week, amounting to ~ $25 in compute.
  • Outcome: The model first reported a pre‑auth SQL injection, which the researchers manually verified on a fresh WordPress install.

3. The initial vulnerability – Batch API validation desynchronisation

3.1 How the bug works

WordPress’s Batch REST endpoint (/wp-json/batch/v1) validates all sub‑requests in a first loop, then executes them in a second loop. When a request fails is_wp_error($single_request), the validation array is populated but the matches array is not updated because of a continue;. This shifts the indices so that validation results are applied to the next request’s handler.

3.2 Exploitation primitive

By inserting a deliberately malformed request at the start of the batch, the attacker can:

  1. Bypass sanitisation on any subsequent endpoint.
  2. Supply arbitrary parameters to an endpoint that normally rejects them.

4. The SQL injection primitive – author__not_in scalar bypass

The GET /wp/v2/posts endpoint builds a raw SQL fragment:

$author__not_in = implode(',', (array) $query_vars['author__not_in']);
$where .= " AND {$wpdb->posts}.post_author NOT IN ($author__not_in) ";
  • When author__not_in is an array, each element is cast to an integer via absint.
  • When it is a scalar, the value is inserted without escaping.

Using the Batch API desynchronisation, the attacker validates a request that treats author__not_in as an array, but the execution step applies the scalar value to the GET /wp/v2/posts handler, yielding a classic unauthenticated SQL injection (e.g., author__not_in=0) OR 1=1 --).

5. Bypassing the GET‑method restriction – recursive Batch calls

The Batch API only accepts POST, PUT, PATCH, or DELETE. The model discovered that the method validation itself is a parameter processed in the first loop. By nesting a Batch request inside another Batch request and using the same desynchronisation trick, the inner request’s GET method is never validated, allowing the attacker to issue the vulnerable GET /wp/v2/posts query.

6. From SQLi to RCE – cache poisoning and embed abuse

6.1 In‑memory post cache

WordPress caches WP_Post objects for the duration of a request. By controlling the rows returned from the SQLi, the attacker can inject arbitrary post objects that are cached.

6.2 oEmbed cache manipulation

Embedding a local URL like [embed]/?p=10[/embed] creates an oembed_cache post in the database. The model realized that the embed system does not verify the existence of the referenced post ID, allowing the attacker to fabricate an oembed_cache row whose post_type can later be coerced into a normal post.

6.3 Elevating to administrator via customize_changeset

A customize_changeset post stores a JSON diff of site‑wide settings, including a user_id field. By crafting such a changeset with user_id=1 (the admin), WordPress temporarily runs wp_set_current_user(1), granting the attacker admin privileges for the remainder of the request.

7. The cycle‑detection gadget – forcing a second request pass

WordPress prevents post‑hierarchy cycles by resetting a cyclic parent to 0. The model used this logic to trigger a second execution of the Batch request via the parse_request hook (named parse_request because the fabricated post’s post_status and post_type resolve to that hook). During the second pass the attacker already holds the admin role, so a previously failing “create admin account” sub‑request now succeeds.

8. Full exploit chain

  1. Seed three oembed_cache rows (O, C, D) using the SQLi.
  2. Craft a nested Batch payload that:
    • Desynchronises validation to inject the scalar author__not_in payload.
    • Recursively calls the Batch endpoint to bypass the GET restriction.
    • Generates a fake customize_changeset (C) that applies a setting with user_id=1.
    • Triggers the parse_request hook (D) to replay the entire Batch request under admin privileges.
  3. Create a new admin user on the second pass.
  4. Log in as the new admin and upload a malicious plugin, achieving persistent RCE.

9. Economic implications

  • Research cost: $25 in compute on a $200/month subscription.
  • Market value: The write‑up claims exploit brokers pay up to $500 000 for a fully weaponised WordPress RCE chain.
  • Industry reaction: Comments on Hacker News note skepticism about the $500 k figure, but also highlight the alarming speed and low cost of AI‑assisted exploit development.

10. Community and security impact

  • Defender guidance: WordPress sites should upgrade to a patched version (the vulnerability was disclosed before public release). Administrators should disable the Batch API if not needed, or enforce strict request validation.
  • Research outlook: The authors argue that future security work will shift from low‑level bug hunting to high‑level prompt engineering and chain synthesis, a role that may remain human‑centric for the foreseeable future.

11. Key take‑aways

  • GPT‑5.6 Sol Ultra can autonomously discover a complex, multi‑stage exploit chain in a widely deployed platform for a few dollars.
  • The exploit hinges on four distinct WordPress bugs: Batch API validation‑execution misalignment, scalar‑parameter SQL injection, embed cache manipulation, and cycle‑detection‑triggered hook execution.
  • The commercial market for such zero‑days is reportedly high, underscoring the need for rapid patching and reconsideration of AI‑driven threat modeling.

“I make no general claim, but I can say with complete confidence that no security researcher could have found and completed this exploit chain in 10 hours without AI.” – Searchlight Cyber researcher

Selected community reactions

“There is no evidence that $500k has been paid or would be paid for an exploit like this one.” – Zsfe510asG (HN)

“Interesting write‑up and I do think LLM‑assisted exploit disclosure is a real concern.” – raesene9 (HN)

“Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.” – ifdefdebug (HN)

Bottom line: AI‑driven vulnerability discovery is no longer a theoretical possibility; it is already producing market‑valued exploits against critical infrastructure. Defenders must treat LLMs as both a powerful research tool and a potent adversarial capability.

Sources