Overview
- Searchlight Cyber disclosed the chained exploit on Friday after using OpenAI’s GPT‑5.6 to assemble a full multi‑stage attack in roughly ten hours and at low compute cost.
- The chain links a REST API batch endpoint route‑confusion bug (CVE‑2026‑63030) with an author__not_in WP_Query SQL injection (CVE‑2026‑60137) to achieve unauthenticated remote code execution against default WordPress installs.
- WordPress released emergency fixes (6.9.5 and 7.0.2) and pushed forced automatic security updates to reduce exposure for affected versions.
- Public proof‑of‑concept code triggered widespread scanning and confirmed compromises that include minimal and feature‑rich PHP webshells, malicious plugin uploads, and creation of backdoor administrator accounts.
- Administrators should verify they run 7.0.2 or 6.9.5, block the Batch API endpoints at the perimeter or with WAF rules, and scan sites for indicators of compromise and implanted backdoors because scanning and active exploitation continue.