zero-day Archives

Verify Your Site Protection Now ↓

I’ve been tracking a fascinating—and frankly, eye-opening—piece of security research that came out of the team over at Searchlight Cyber. If you’re running a WordPress site, you’re going to want to pay close attention to this one, because it changes the game on how vulnerabilities are found.

Here is the long and short of what went down, in plain English:

Key Takeaways

A $25 AI prompt discovered a critical zero-day vulnerability in WordPress core.
The flaw allows full remote takeover of a site without needing a password.
Exploit brokers would pay $500,000 or more for this kind of access.
The fix is available now. Update your WordPress immediately.

The $25 Artificial Intelligence Zero-Day

A security researcher decided to see what the latest advanced AI models (specifically GPT-5.6 Sol Ultra) could do if you gave them the right instructions and let them loose on the standard WordPress core code.

Instead of just asking it a simple question, they set up a complex prompt that forced the AI to act like four different security experts double-checking each other’s work for six hours straight. The total cost to run this AI experiment? About $25.

The result? The AI found a massive, completely unknown “Zero-Day” vulnerability in the default WordPress setup. In the dark corners of the web, exploit brokers would easily pay $500,000 or more for a bug like this because it affects millions of sites.

⚠ Why this matters: Over 500 million websites run WordPress. A pre-authentication RCE means an attacker needs no username and no password. They just need to send the right request. This is the worst class of vulnerability a website can have.

How the Bug Works (Without the Tech Jargon)

The flaw lies in something called the Batch API. This is a feature introduced back in 2020 that allows developers to bundle a bunch of web requests together into one neat package to speed things up.

Think of it like a security line at the airport. WordPress is supposed to check everyone’s ID in line (Validation) and then let them through the gate (Execution).

The AI noticed a coding oversight: if the very first person in the batch line fails the ID check, WordPress gets confused. It throws an error for that person, but it forgets to shift the line properly. As a result, the next person in line gets pushed through the gate using the validation paperwork of a completely different request.

By manipulating this “mismatched line,” an attacker can completely bypass the built-in security filters that WordPress uses to sanitize dangerous inputs.

From a Glitch to Total Takeover

Once the AI realized it could bypass the security guards, it chained a few steps together:

SQL Injection: It used the bypassed filters to inject malicious commands into the database — a Pre-Authentication SQL Injection. No password needed.
Privilege Escalation: It used that database access to stealthily trick the site into granting full Administrator privileges — without needing to crack a single password.
Remote Code Execution: Once it had Admin access, taking over the underlying server is trivial. Full control. Game over.

💡 The bigger picture: The total cost of the AI computing tokens used to discover this $500,000 exploit was about $25. We are officially entering an era where bad actors can use AI to find deep, hidden bugs in hardened software for the price of a cheap lunch.

The Bottom Line for WordPress Owners

The good news is that the researchers responsibly held onto this information to give the core developers time to address it, and security teams have been working to get fixes out.

But here is my standard, broken-record advice that I preach every single day: Keep your core, your themes, and your plugins updated.

The absolute best defense you have is proactive maintenance. Don’t sit on updates. Log into your dashboard today, make a backup, and make sure you’re running the latest, patched version of WordPress.

Your Checklist:

Log into your WordPress dashboard right now.
Navigate to Dashboard → Updates.
Make a full backup before updating.
Update WordPress core to the latest patched version.
Update all themes and plugins while you’re in there.
Delete any unused plugins or themes. Less code means fewer hiding spots.

Frequently Asked Questions

Is my site already hacked if I haven’t updated?

Not necessarily. The researchers practiced responsible disclosure and held the details until patches were available. However, the longer you wait to update, the higher the risk. Attackers reverse-engineer patches to build exploits. Update immediately.

Which WordPress versions are affected?

The vulnerability exists in any WordPress version that includes the Batch API (introduced in 2020). If you are running an unpatched version of WordPress 7.0.0 or older, you are potentially exposed. Update to the latest version immediately.

Can a firewall or security plugin protect me?

Web application firewalls (WAFs) from services like Cloudflare, Sucuri, or Wordfence may help mitigate the attack if they have rules targeting this specific exploit. However, the only guaranteed fix is applying the official WordPress core patch. A WAF is a seatbelt. The patch is the steering wheel.

How did an AI find this when human researchers didn’t?

The AI was given a specialized multi-agent prompt that forced it to analyze the code from first principles for six hours. It tested different attack categories systematically — character sets, race conditions, encryption flaws — and cross-checked its own findings. Think of it as four tireless auditors working around the clock, double-checking each other’s work, for the price of a coffee.

Does this mean AI will keep finding zero-days?

Yes. This is a milestone. Expect both security researchers and bad actors to use AI for vulnerability hunting at increasing speed and decreasing cost. The best defense remains the same: keep everything updated and maintain a solid backup strategy.

WordPress Vulnerability Scanner

Enter your current WordPress version (e.g. 7.0.1) to see if your site is exposed to the wp2shell Pre-Auth RCE exploit.

✅ SAFE: Your WordPress version includes the patch for this vulnerability. Keep your site updated and maintain regular backups.

❌ VULNERABLE: Your version is vulnerable! Patch to WordPress 7.0.2 immediately! Log into your dashboard, go to Dashboard → Updates, and update your WordPress core right now.

If you need help auditing your WordPress site, cleaning up a hack, or figuring out whether your current setup is creating hidden risk, contact me anytime at HackRepair.com, or call (619) 479-6637.

[ A security researcher used a $25 AI prompt to discover a pre-authentication remote code execution vulnerability in WordPress core. Here is what happened and what you need to do. ]

AI Just Found a Critical WordPress Zero-Day | What You Need to Do Today