GPT-5.6 Sol Finds Critical WordPress Exploit in 10 Hours

AI Uncovers Flaw in Record Time

In a striking demonstration of artificial intelligence's growing capability in cybersecurity, the GPT-5.6 Sol AI system discovered a critical remote code execution (RCE) vulnerability in WordPress core. The exploit, dubbed wp2shell, was identified in just ten hours of automated scanning.

The vulnerability has been assigned the identifier CVE-2026-63030. Security firm Rapid7 has classified it as a critical severity issue, noting that it allows attackers to execute arbitrary code on vulnerable WordPress installations.

What the wp2shell Exploit Does

The wp2shell vulnerability permits an unauthenticated attacker to inject and execute malicious code remotely. This means a hacker could take full control of a website, steal data, deploy malware, or deface pages without needing any credentials.

Given that WordPress powers over 40% of all websites globally, the potential blast radius is enormous. Security experts are urging site administrators to apply patches immediately.

Active Exploitation Underway

Security researchers at TechCrunch and The Hacker News have confirmed that hackers are actively exploiting the flaw. Reports indicate that attackers are scanning the web for vulnerable WordPress sites and launching automated attacks.

Cloudflare has already released Web Application Firewall (WAF) rules to protect WordPress applications from the two high-severity vulnerabilities, including CVE-2026-63030. The company's security blog detailed the mitigation measures available to customers.

Implications for Cybersecurity

The speed at which GPT-5.6 Sol identified the exploit marks a significant milestone. Traditional vulnerability discovery, which relies on manual code review and fuzzing, can take weeks or months. An AI completing the task in hours reshapes expectations for patch timelines.

However, the same capability raises concerns. If offensive AI can find exploits rapidly, defenders must match that pace. The discovery also highlights the need for automated patching systems and AI-driven security monitoring.

Techzine Global, which first reported the discovery, noted that the AI's analysis included detailed technical documentation that helped developers reproduce and patch the flaw quickly.

What Comes Next

WordPress has released an emergency security update to address CVE-2026-63030. Site administrators should update their installations immediately and review any suspicious activity on their servers. The broader cybersecurity community will be watching closely to see how AI-driven vulnerability discovery evolves — and whether it becomes a standard tool for both defenders and attackers.