GPT-5.6 Sol Ultra Discovers WordPress Pre

Gbhackers •Divya • July 20, 2026

A critical vulnerability chain in WordPress, called wp2shell, that allegedly allows unauthenticated attackers to exploit a pre-authentication SQL injection flaw to achieve remote code execution (RCE) on typical WordPress installations running MySQL. Security researcher Adam Kues discovered this vulnerability chain using GPT-5.6 Sol Ultra during a multi-agent audit of the WordPress source code. GPT-5.6 Sol […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical wp2shell Vulnerability Enables Unauthenticated RCE in WordPress A critical vulnerability chain, dubbed wp2shell, has been identified in WordPress Core, allowing unauthenticated attackers to execute arbitrary code on default installations. This vulnerability is tracked as CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection). Exploitation can occur via a single anonymous HTTP request, impacting WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Security teams are urging immediate updates to versions 6.9.5 and 7.0.2 to mitigate risks. A public proof-of-concept (PoC) is available, and while no mass exploitation has been confirmed, the risk is considered extremely high. The vulnerabilities were disclosed on July 17, 2026, and have been actively discussed in the security community. 46 sources 73

Extracted Entities

GPT-5.6 Sol Ultra Discovers WordPress Pre

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Vulnerabilities (1)