GPT-5.6 found a WordPress RCE for $25. The human review took longer.

Searchlight Cyber researcher Adam Kues says GPT-5.6 Sol Ultra found a pre-authentication WordPress core exploit chain in just over 10 hours, using roughly $25 of a $200 subscription. His technical account of wp2shell is a striking result. I think the more important detail comes after the model stopped: Kues spent the next day untangling what it had produced.

WordPress had already shipped fixes on July 17, 2026. The official advisory says versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 were affected by the chain. That makes this more than a model demo, but it does not make $25 the full cost of finding a zero-day. The scarce resource is moving toward verification, disclosure, and getting patches onto real systems.

Answer snapshot

Question	My read
What happened?	A researcher adapted OpenAI's long-running research prompt, gave GPT-5.6 Sol Ultra the WordPress source, and says it produced a working route from unauthenticated access to remote code execution.
What did it cost?	The researcher estimated about $25 of subscription usage. That excludes his setup, testing, analysis, reporting, and the vendor's patch work.
Who should act?	Operators on affected WordPress branches should update to 6.9.5 or 7.0.2. The release used forced automatic updates where supported.
What changes for security teams?	More plausible findings can arrive faster, so human review capacity and safe disclosure processes become more important.

The $25 figure leaves out the hard part

Kues did not ask the model for a quick code review. He adapted an OpenAI research prompt, removed the repository history, provided the current WordPress source, allowed four agents, and required at least six hours of work. The model first surfaced a read-only SQL injection. Kues then asked whether it could reach remote code execution, and the model returned a longer chain about four hours later.

He checked the initial claim against a stock WordPress installation on a remote server and later spent a day understanding the full result before reporting it. That human work matters. A convincing exploit narrative can still contain a fake precondition, an impossible state, or a step that only works in the model's imagined environment. In security, a plausible hallucination is not harmless noise. It can waste a response team or push dangerous code into circulation.

What the model appears to have done

The submitted write-up describes a chain in WordPress core rather than a vulnerable plugin. At a high level, it begins with a mismatch in how the REST API batch route tracks request validation and matched handlers. That mismatch lets an attacker reach a SQL injection. The later stages use WordPress caching and post-processing behavior to gain administrator authority, replay the request, create an administrator account, and then reach code execution.

I am deliberately keeping that summary above the payload level. The useful point here is the composition. The model connected several behaviors that look less serious on their own. Hadrian's independent patch analysis agrees on the affected versions, the absence of authentication or plugin prerequisites, and the fixed releases.

One result is not a benchmark

The write-up makes a strong claim about speed. It also says, more carefully, that this is one result and not a general evaluation. I would keep both sentences together. The experiment had a skilled researcher, a carefully shaped prompt, a clean source tree, a concrete success condition, and follow-up steering after the first bug appeared. Those are part of the system.

OpenAI's GPT-5.6 announcement says the Ultra setting coordinates four agents by default and reports stronger results on its cybersecurity evaluations. That supports the basic setup described by Kues. It does not independently validate his exploit, measure the rate of false findings, or tell us how often a similar run ends with nothing useful.

This is where I resist the easiest headline. The experiment does not prove that anyone can buy a $25 zero-day on demand. It shows that a strong operator can now rent a surprisingly capable search process for very little incremental money. The operator still needs to choose the target, constrain the work, test the result, understand the chain, and disclose it safely.

The economics are becoming uncomfortable

The source's $500,000 comparison is not a payout that Kues received. A 2026 Trend Micro report lists $500,000 as a price range for a WordPress remote-code-execution exploit in the nondefensive broker market. That market value and the researcher's estimated $25 model usage describe different things, but the gap still matters.

Search has become cheaper. Verification has not fallen at the same rate, and patch deployment still moves at the speed of maintainers, hosts, and site owners. Attackers benefit from cheap parallel exploration too. Defenders therefore need more than access to the same models. They need isolated test environments, reproducible evidence, review queues, coordinated disclosure contacts, and the authority to patch quickly.

The WordPress 7.0.2 release shows the defensive side working: two security issues were fixed, the wp2shell reporter received credit, backports shipped, and forced updates were enabled for affected sites. That is the part I would fund before celebrating lower token bills.

My takeaway

I believe the result because the vendor patch, the independent analysis, and the researcher's detailed account agree on the important facts. I do not believe the lesson is that security researchers have become optional. Kues had to design the search, challenge the first result, verify it on a real installation, understand an unfamiliar chain, and coordinate disclosure. Remove that work and the $25 output is only a dangerous suggestion.

GPT-5.6 made the search dramatically cheaper in this case. That is impressive, and a little unsettling. The next investment should go to the people and systems that decide which machine-generated findings are real, which are safe to share, and how fast everyone else can patch.