Researchers Build WordPress Exploit Using OpenAI's GPT

Security researchers disclosed two critical WordPress Core vulnerabilities (CVE-2026-63030: REST API route confusion leading to validation desync; CVE-2026-60137: author__not_in WP_Query SQL injection) and demonstrated an AI-crafted chained exploit (“WP2Shell”) that achieves pre-auth remote code execution on affected 6.8/6.9/7.0 installations; evidence of exploitation was reported and WordPress forced automatic updates to patch affected sites.