Send a single HTTP request to a vulnerable WordPress site, and it’s game over. Researchers have demonstrated how easy it is for hackers to gain admin rights using a captured payload. The most severe WordPress exploit in a decade, “wp2shell,” was spit out by OpenAI’s best model GPT-5.6 Sol, powering ChatGPT, spending only $25 in tokens.

Johannes B. Ullrich, the Dean of Research for SANS Technology Institute, shared an actual payload the attackers are sending to websites, probing if they’re vulnerable to “wp2shell,” a critical, recently unveiled WordPress exploit.

The researcher acknowledged that exploit attempts are hitting their honeypots, testing if they’re vulnerable. However, the complete payload was submitted by one of the SANS Internet Storm Center (ISC) readers.

All it takes is a single highly nested HTTP/1.1 POST request. However, the attackers actually send two requests in total – the first one is to determine whether the site is vulnerable.

The threat actor didn’t even try to hide the intentions and literally identified itself as “cve-2026-63030/1.0” – the user agent was named after the unique ID assigned to this exploit.

The requests target the batch endpoint (/?rest_route=/batch/v1) – the vulnerable WordPress REST API’s feature that can be called publicly with no permissions.

They use a few layers of encoding – hex-encoded text sequences, to bypass text filters, and \x escape codes planted inside – they simply spell a command letter by letter.

This nested structure is what triggers the route-confusion bug – requests within requests trick WordPress into processing them with the wrong permissions.

The malicious SQL query is buried in the last request, smuggled through the “author_exclude” field. WordPress uses this parameter, expecting numbers corresponding to the author IDs, but fails to sanitize strings.

“The exploit follows standard SQL injection patterns. It uses a UNION request to execute a second SELECT statement,” the researcher explains in a post.

SQL UNION is a database feature that lets legitimate users combine the results of two separate database searches into one, but attackers abuse it to piggyback on the original request and attach a second crafted query.

In the probing part, the bolted-on SELECT query determines if the system is vulnerable to SQL injection by simply returning a single row of values, and planting “||OK||” in the website’s response if it works.

Upon receipt, the attacker sends the similarly nested actual payload in the second HTTP POST request.

In the second request, a SQL injection payload uses SELECT to write PHP code to a file on the server, creating a simple web shell. It acts as a backdoor that can be accessed remotely to execute commands on the server.

The attackers drop 94uh9ubh6e1x.php file into /wp-content/cache/. The web shell will not load for just anyone, but instead will display a generic 404 error, unless accessed with correct secret parameter, acting as a password.

“I call these ‘Jedi errors’... this is not the page you are looking for,” Ullrich said.

“The attacker later also added a new admin user to the WordPress database. As a ‘cleanup’ tip: Check for files in the '/cache/' directory and for recently created users.”

Site owners can check if their websites are affected, and immediately updating WordPress is the recommended mitigation.

ChatGPT found this exploit

Adam Kues, a security researcher at Searchlight Cyber who discovered the “wp2shell” exploit, says that all it took was GPT-5.6 Sol Ultra – the current best large language model from OpenAI, which is also used in ChatGPT.

The researcher used the $200 subscription and expended 50% of weekly tokens, so assigned the $25 cost for the whole project, which could’ve netted $500,000 if sold to exploit brokers.

The researcher couldn’t believe that AI would pull it off. The researcher didn't jailbreak the model, but simply tasked it with finding a pre-authentication-to-RCE vulnerability as a test of its ability to discover zero-days.

“WordPress is one of the most hardened targets of all time, and it also hasn’t had any meaningful pre-auth vulnerabilities this decade,” reads the detailed write-up about the exploit.

“This full exploit was produced in just over 10 hours.”

Kues argues that this find represents a real step-up in AI capabilities, because GPT-5.6 Sol was able to chain several distinct and creative bugs.

“I make no general claims, but I can say with complete confidence that no security researcher could have found and completed this exploit chain in 10 hours without AI.”