GPT-5.6 Sol Ultra Found Wp2shell RCE Flaw That Could Be Worth $500,000 for About $25

### Executive Summary The report describes an AI-discovered pre-authentication RCE in WordPress's /wp-json/batch/v1 Batch API that chains a SQL injection with changeset forgery and hook replay to escalate to administrator privileges and install a malicious plugin, enabling remote code execution; independent researchers reproduced the exploit and a proof-of-concept was published, prompting urgent patching and scanning recommendations.