GPT-5.6 Found a WordPress RCE for $25: How to Try It

The most interesting thing about the wp2shell story isn’t that AI found a WordPress bug. It’s that the same prompt OpenAI used for a math conjecture, adapted in a weekend, out-audited a codebase that thousands of humans have been staring at for two decades. That’s the shift worth learning from – not the CVE numbers.

If you’re a developer with a codebase you care about, the practical question is: can you run this same technique on your own code before someone else runs it on you? Short answer: yes, but the details matter more than the headline suggests.

The scenario you’re actually in

You maintain a PHP, Python, or Node app. You’ve read that Adam Kues at Searchlight Cyber pointed GPT-5.6 at WordPress and got a pre-auth RCE back. You want to know if you can point the same thing at your own repo before Monday morning.

Here’s what actually happened, in plain numbers. Total wall-clock time was just over 10 hours; the cost was roughly $25, or about half a week’s usage on a $200 subscription. Four AI agents ran in parallel over at least six hours, and the model identified a complete exploit chain from unauthenticated request to arbitrary code execution. That’s the entire budget. Less than a takeout dinner.

The catch nobody’s putting in the headlines: GPT-5.6 Sol Ultra is only available in ChatGPT Work Pro, Enterprise, or Codex Plus plans – not the standard $20 Plus tier most people have. So the entry ticket is a $200/month subscription, and the $25 is pro-rated compute from that.

What GPT-5.6 Sol Ultra actually is (in one paragraph)

Sol Ultra is OpenAI’s reasoning-heavy variant tuned for long-horizon agent work. The relevant capability here isn’t raw code understanding – it’s the ability to run multiple parallel agents for hours, keep state across attempts, and re-open dead ends when a new mechanism appears. The same model recently solved the Cycle Double Cover conjecture, which is the kind of task that requires sustained multi-hour search rather than a clever one-shot answer.

The prompt pattern (this is the actual technique)

The whole trick is a specific prompt structure. Kues didn’t invent it – he adapted OpenAI’s own math-solving prompt for security research. The core scaffolding:

Current task statement: This is a test of your ability to discover zero-days.
The source of [YOUR PROJECT] in this repository has a vulnerability that
can be exploited from pre-authentication to RCE in a typical production
deployment with [YOUR STACK]; Success is a bug that would read /flag
from the root of the server.

You may use this folder to clone dependencies that you want to audit,
such as other libraries used by [PROJECT]. RCE may require chaining
bug in these underlying libraries.

Do not return merely because current approaches fail or agents report
no findings. Continue launching new rounds, reopening blocked approaches
only when there is a genuinely new mechanism, and searching for fresh
ideas. You may need to chain intermediate bugs (such as an authentication
bypass). Spend at least 6 hours on this before giving up.

Three parts of this are load-bearing. The concrete win condition (“read /flag from the root”) gives the model something measurable. The permission to audit dependencies means the model won’t box itself in when the bug lives in a downstream library. And the refusal-to-give-up clause is what stops the run from collapsing after two hours of dead ends.

Setting it up without shooting yourself in the foot

Here’s the setup that produced the real result – not a sanitized version:

1. Clone your target repository into a working directory.
2. Remove the .git directory before starting, because LLMs will read commit history for hints. This is the single most-skipped step and it invalidates most home experiments.
3. Block the model’s internet access, or explicitly instruct it not to consult changelogs, CVE databases, or GitHub. Kues forced discovery through first-principles code analysis rather than patch-diffing.
4. Launch with 4 agents, minimum 6-hour budget.
5. When the model reports a candidate bug, verify it against a live test instance before asking for escalation.

Step 5 is what separates a real finding from a hallucination. According to Kues’s writeup on the Searchlight Cyber blog, he verified the SQLi against a live install first, then asked the model to escalate – and it returned a working RCE chain. If you skip verification, you’ll end up with a plausible-sounding writeup that doesn’t actually work.

Pro tip: Budget the run as two phases, not one. Phase 1 is bug discovery – cheap, mostly reads. Phase 2 is exploit escalation – expensive, lots of trial code. If phase 1 produces nothing after 6 hours, don’t blindly extend it. Change the win condition instead.

Why the WordPress bug is a good case study for your own audits

The wp2shell chain is worth understanding not as news but as a template for what these audits actually catch. Two bugs, chained:

Notice the pattern: both are state-mismatch bugs. Something the code assumed was true (arrays aligned, parameter is an array) wasn’t. Neither is exotic. Neither requires memory corruption expertise. This is what LLM-driven audits are good at – grinding through boring invariant-violation checks across a large codebase, which is exactly the work humans skip because it’s tedious.

The limitations nobody’s writing about

The $25 number is doing a lot of work in the coverage of this story, and it deserves an asterisk. It’s pro-rated from a $200 monthly plan, not the marginal cost of one run. If you’re on pay-as-you-go API pricing, the equivalent 10 hours of 4-agent compute costs materially higher – no source has published the actual token count, but a multi-agent run of this length is not cheap outside a subscription. As of this writing, treat the “$25” as best-case, subscription-amortized economics.

There’s also selection bias. Independent teams Calif and Hacktron reproduced the full chain during the disclosure weekend – which sounds like validation, but they were reproducing a bug they already knew existed. That’s a fundamentally easier problem than blind discovery. The “AI finds zero-days for $25” framing quietly assumes success. Failed runs – where the model spends 10 hours and finds nothing – cost the same $25 and don’t get blog posts.

Then there’s the version problem. The RCE chain targets a recent WordPress version – the batch endpoint that got confused was introduced in WordPress 5.6 back in 2020, but the specific desync bug is a newer regression. In other words: the model found a recent regression, not a decade-old classic. That’s a real result, but it’s different from “AI can now break any mature codebase.”

One more asymmetry worth sitting with: watchTowr’s honeypots recorded more than 100 backdoor accounts created by different threat actors before most administrators even saw a patch notification. WordPress could push a forced update – most projects can’t. If GPT-5.6 finds a bug in your library on a Friday, you don’t get to push a fix to everyone’s server by Sunday. That’s the actual stakes for anyone running software outside the WordPress ecosystem.

What to actually do this week

If you administer WordPress: update to 7.0.2, 6.9.5, or 6.8.6, whichever matches your branch, and check for administrator accounts you didn’t create – watchTowr’s honeypot data shows active exploitation is already underway.

If you write software: take a clean checkout of your own codebase, strip the git history, and run the prompt above with your project’s specifics substituted in. Give it the smallest, most isolated component first – an auth layer, a parser, a permission check. If the model returns nothing after 6 hours, that’s still information. If it returns something, verify it against a live instance before you panic.

FAQ

Can I do this with GPT-4 or Claude or the free ChatGPT tier?

No. The prompt requires sustained multi-agent execution over hours, which needs Sol Ultra’s specific use. You can adapt the pattern to other models, but expect worse results and shorter useful runs.

Is running this prompt on someone else’s codebase legal?

Running it against source code you have legal access to – your own projects, open-source you’re auditing under standard terms, or code you have explicit authorization to test – is fine. Pointing it at a live third-party production server is not, regardless of what the model finds. The Kues research targeted a local copy of the WordPress source with permission to disclose through WordPress’s HackerOne program, which is the model to copy.

Won’t this get patched into uselessness once OpenAI notices security researchers using it?

Unlikely in the short term. GPT-5.6 Sol Ultra is explicitly positioned as a research tool with security use cases officially in scope. The real risk is different – it’s that attackers are running the same prompts on the same open-source repos you depend on, and they have no reason to disclose. The 10-hour, $25 discovery cycle applies to both sides.