AI Agent Achieves Full-Chain RCE on WordPress Core Vulnerability
rez0__ · x · 2026-07-19
A developer discovered that their deployed AI Agent successfully identified the final remote code execution (RCE) exploit step for a core WordPress vulnerability.
The PoC referenced by the Agent is named wp2shell, a single-file, zero-dependency proof of concept. Through a single anonymous HTTP request, it chains REST route confusion and unauthenticated SQLi to gain admin privileges, ultimately securing a system shell. This vulnerability affects default WordPress installations and requires no plugins or login.
More from coding & agent
- SF 'Code Engineering' event picks up where 1,000-person harness engineering meetup left off — LangChain · 2026-10-27
- Prompt turns Claude Code into an iPhone backup forensics tool exposing 30-day 'deleted' photo copies — alex_verem · 2026-10-27
- Prompt turns Claude Code into a forensics tool finding deleted iPhone photos in backups — alex_verem · 2026-10-27
- Phones won't be mobile IDEs but control planes for agent fleets, argues Yuchen Jin — Yuchenj_UW · 2026-10-27
- FrontierCS 2 launches on Kaggle: 48 tasks make agents beat published CS papers — MeganRisdal · 2026-10-27
- Agent Field Kit launches $29 security runbooks for production AI agents — alvelda · 2026-10-27