GPT5.6 Finds WordPress Zero-Day RCE for $25 — Exploit Brokers Pay $500K

Security researcher Adam Kues used GPT5.6 Sol Ultra and a $25 API budget to discover a pre-authentication remote code execution vulnerability in WordPress — the kind exploit brokers pay half a million dollars for.

A security researcher at Searchlight Cyber has demonstrated that frontier AI models can now discover critical zero-day vulnerabilities at a fraction of the cost that exploit brokers pay for them.

Adam Kues used OpenAI's GPT5.6 Sol Ultra with just $25 in API credits and found a pre-authentication remote code execution (RCE) chain in WordPress — the kind of vulnerability that zero-day brokers routinely pay $500,000 or more for on underground markets.

The approach was methodical. Kues took the prompt that OpenAI used to solve the Cycle Double Cover conjecture — a famous mathematical problem — and adapted it for security research. He pointed it at a clean WordPress installation, stripped of git history to prevent the model from "cheating" by diffing against patched versions, and let four AI agents work in parallel for six hours.

The agents explored input parsing, file uploads, serialization, race conditions, and other attack surfaces. The prompt explicitly required them to maintain diverse research routes, cross-pollinate ideas, and use adversarial checking. The result: a full RCE chain that could read arbitrary files from a production WordPress server.

Kues and his team held off publishing to give WordPress administrators time to patch over the weekend. During that window, two other researchers — Calif and Hacktron — independently reproduced the full exploit chain before proofs-of-concept appeared on GitHub, confirming the finding was reproducible and real.

The implications are stark. If a single researcher with a $25 API budget can find a half-million-dollar vulnerability in the world's most widely used CMS — running on over 40% of all websites — the economics of vulnerability discovery have fundamentally shifted. The same technique can be pointed at any codebase. Defenders can use it to find and fix bugs before attackers do; attackers can use it to stockpile zero-days at unprecedented speed and scale.

A verification tool is available at wp2shell.com for WordPress administrators to check if their instances are vulnerable.

Sources: Searchlight Cyber, Hacker News discussion