Preliminary research

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

Adam Kues · Searchlight Cyber · 20 July 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

A WordPress REST batch mismatch enables nested validation bypass and read-only SQL injection. Forged post objects poison the request cache; oEmbed updates and hierarchy repair persist them as changesets. Temporary administrator authority and a forged hook re-enter REST dispatch to create an admin account, enabling plugin-based RCE.

Record

Researcher

Adam Kues

Published by

Searchlight Cyber

Date

20 July 2026

Topic

Server

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• wp2shell: Pre Authentication RCE in WordPress Core
• wp2shell: Pre Authentication RCE in WordPress Core
• The WordPress Chain Massacre
• Calif wp2root code and lab
• Calif technical wp2shell writeup Code
• Calif full-chain technical writeup Code

Tags

• wordpress
• sqli
• rce
• attack-chain
• cache-poisoning
• rest-api
• privilege-escalation
• llm
• ai-agent
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Adam Kues, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.