OpenAI's GPT-5.6 Sol Ultra finds critical WordPress bug in 10 hours

Cybersecurity firm Searchlight Cyber used OpenAI's GPT-5.6 Sol Ultra model to find a major WordPress vulnerability in about 10 hours. The bug, named 'wp2shell' and rated CVE-2026-63030, has a CVSS score of 9.8. It allows remote code execution without authentication.

Researcher Adam Kues had the model analyze WordPress source code without Git history. Four AI agents worked together for 6 hours to find an SQL injection flaw, then spent 4 more hours figuring out how to turn it into full remote code execution.

The test used about 50% of the researcher's ChatGPT weekly quota. At a $200 monthly subscription, finding the bug cost only around $25. This shows AI is making it much cheaper and faster to discover serious vulnerabilities, which could change the game for both security researchers and attackers.