GPT-5.6 Found a $500K WordPress RCE for $25 — 500 Million Sites Were Exposed
The going rate for a WordPress remote code execution on exploit broker markets is $500,000. A security researcher paid $25 in API credits to find one — using GPT-5.6.
The vulnerability, dubbed wp2shell, chains two WordPress Core flaws: CVE-2026-63030 and CVE-2026-60137. No authentication required. An anonymous HTTP request is enough to execute arbitrary code on any affected server. Every site running WordPress 6.9 or 7.0 was exposed until emergency patches 6.9.5 and 7.0.2 shipped Friday. Attack surface: 500 million-plus sites across the public web.
What wp2shell Does
The attack works in two stages. The first flaw establishes remote file inclusion in a bare WordPress Core install — no plugins, no configuration required. The second escalates that access to arbitrary code execution and full site takeover. Both CVEs were coordinated through WordPress’s security team before public disclosure.
Public exploits appeared within hours of the patch release. Any unpatched 6.9 or 7.0 install is actively exploitable now with working proof-of-concept code in circulation.
How It Was Found
The researcher documented the process at length. GPT-5.6 traced data flows through WordPress’s request handling, identified boundary conditions in input parsing routines, and generated candidate exploit chains. The full discovery took a single session. Total API spend: $25.
Exploit brokers — Zerodium, Crowdfense, comparable marketplaces — publish buy prices for WordPress RCEs in the $300,000 to $500,000 range, with pre-authentication bugs commanding premiums over authenticated ones. The wp2shell chain qualifies for the upper end of that range.
The Cost Collapse
AI has not lowered the sale price of a working zero-day. A production exploit still commands the same market rate it did a year ago. What has collapsed is the discovery cost — the expertise, time, and tooling historically required to find one.
A vulnerability of this class previously required weeks of expert code auditing or a skilled team. GPT-5.6 found the same category of bug for $25 in an afternoon. The ratio: 0.005% of market value.
That asymmetry extends beyond WordPress. Any codebase where the discovery cost was the primary barrier — critical infrastructure, embedded systems, legacy enterprise software — faces the same repricing. The labor floor for offensive security research has dropped. The question for defenders is whether their budgets have kept pace.
Key Numbers
| Metric | Value |
|---|---|
| CVEs | CVE-2026-63030, CVE-2026-60137 |
| Attack type | Pre-authentication RCE |
| Sites at risk | 500 million+ |
| Discovery cost | $25 (GPT-5.6 API) |
| Broker market value | ~$500,000 |
| Patched versions | 6.9.5, 7.0.2 |
Current Status
WordPress’s automatic update mechanism pushed patches to most sites on Friday. Sites on managed hosting with auto-update disabled, or running pinned versions, need manual action. Any unpatched installation on 6.9 or 7.0 is currently at active risk.