An AI prompt found the WordPress bug exploit brokers pay $500,000 for

Six fake WordPress posts and one forged administrator account

Adam Kues, a researcher at Searchlight Cyber, ran a prompt originally built by OpenAI for solving math-olympiad problems against a model he calls "Sol," part of what he describes as the GPT-5.6 line, and pointed it at WordPress's raw source with nothing else to go on. What it built runs through nine separate quirks in WordPress's REST batch endpoint, a feature added back in WordPress 5.6.

The endpoint validates and executes a batch of requests in two separate passes; triggering an error desynchronizes the two, so a request that passed validation gets matched to a different handler at execution time. That gap exposes an unvalidated author__not_in parameter that flows straight into a raw SQL query, where the payload "0) OR 1=1 -- " proves injection is possible. The model then nested batch calls recursively to route around a GET-only restriction, and used UNION-based injection to plant six fabricated posts, labeled O, C, P, D, S and T, directly into WordPress's in-memory object cache. Embedding one of them promotes it from that volatile cache into a permanent database row. From there, a forged customize_changeset post, WordPress's mechanism for storing draft theme edits as JSON, gets executed with administrator privileges, thanks to how WordPress's own cycle-detection logic re-processes parent posts. The last fake post carries status parse and type request; creating it fires the parse_request hook and replays the entire original batch call, this time as an admin. That replay creates a real administrator account, and from there WordPress will run any code an uploaded plugin contains.

Kues's own conclusion: "no security researcher could have found and completed this exploit chain in 10 hours without AI." The model's edge, he argues, was holding nine unrelated gadgets scattered across a huge codebase in mind at once. He expects vulnerability research to shift toward target selection and prompt design, with the model handling the technical assembly.

A simpler shortcut through the chain, and a receipt nobody can produce

On Hacker News, the reaction split between alarm at what an AI prompt can now do that cheaply and skepticism about the specific numbers in the story.

One reader who says he's used LLMs to build container breakouts from Linux privilege-escalation bugs raised a different concern than the exploit itself:

"My experience is that GPT-5.5 and up does not like offensive security work... I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit." — an engineer who says he's built container breakouts from Linux LPEs using LLMs

Another reader spent time inside the published exploit chain itself:

"Why are the steps in the middle of the exploit chain necessary?... if you have a SQL injection, why can't you use that to just create an admin account directly, by inserting it into the users table?" — an HN commenter

A third reader picked at a different detail entirely:

"There is no evidence that $500k has been paid or would be paid for an exploit like this one." — a reader who traced the byline to Assetnote, a rival AI-powered vulnerability scanner

Neither the write-up nor the thread settled whether the bug has actually been patched, or when WordPress was told about it.

If a model can hold nine unrelated WordPress quirks in its head at once, the scarce skill in bug hunting stops being the exploit-writing itself and becomes deciding which sprawling, unglamorous codebase deserves that attention in the first place.