How a $25 AI Audit Could Reshape $500,000 Zero-Day Research

Could an AI system uncover a zero-day potentially worth hundreds of thousands of dollars for only US$25 in computing costs? Research involving WordPress suggests that the economics of vulnerability discovery may be entering a dramatic new era.

For years, finding a pre-authentication remote code execution vulnerability in WordPress core has been considered a holy grail for security researchers. WordPress powers millions of websites, making a reliable, exclusive, high-impact exploit potentially worth hundreds of thousands of dollars through exploit brokers.

AI-Assisted Auditing at Massive Scale

Researchers from Searchlight Cyber reportedly used the GPT-5.6 Sol Ultra reasoning model within a multi-agent prompting architecture to audit and reason across millions of lines of code autonomously. Within hours—and at an estimated computing cost of approximately US$25—the system identified a previously overlooked vulnerability chain in WordPress core.

The significance extends beyond the vulnerability itself. Traditional manual code review can require weeks or months of work by experienced researchers. AI systems can now accelerate tasks such as data-flow analysis, control-flow reasoning, and execution-path exploration at substantially lower cost.

How the Vulnerability Chain Worked

The reported chain began with a logic flaw in the WordPress Batch API implementation inside class-wp-rest-server.php. When a sub-request returned is_wp_error(), execution continued without updating the $matches array.

This behavior allegedly caused array-index desynchronization, creating an inconsistency between the parameters that had been validated and the request handler eventually executed.

• A Batch API sub-request produced an error.
• Execution moved forward through continue.
• The relevant match state was not updated correctly.
• Validated parameters and the selected handler became misaligned.
• The resulting state enabled a potential bypass of sanitize_params().

Researchers then identified a path through which certain request handlers could be invoked without the expected sanitization. On the GET /wp/v2/posts endpoint, this condition reportedly developed into a pre-authentication SQL injection vulnerability. Under specific circumstances and with additional exploitation techniques, that SQL injection could potentially contribute to a chain leading to remote code execution.

The Economics of Vulnerability Research Are Changing

The most important takeaway is not a single WordPress flaw, but the falling cost of discovering complex logic bugs. Capabilities once limited to highly experienced vulnerability researchers may increasingly become accessible through scalable AI-assisted workflows.

This shift benefits defenders by enabling faster audits, broader code coverage, and earlier detection. However, threat actors can use the same capabilities. As the cost of zero-day research falls from thousands of dollars to tens of dollars, both offensive and defensive security operations may accelerate.

What Security Teams Should Do

Organizations should treat AI-assisted vulnerability research as an emerging operational capability rather than a distant possibility. Security teams should strengthen secure code review, test complex state transitions, monitor upstream advisories, deploy patches quickly, and explore controlled AI auditing before attackers gain the advantage.

The future of cybersecurity may depend on who can use AI more effectively: defenders finding vulnerabilities before deployment, or adversaries discovering them first. Click the button on the platform to review the referenced research and learn more.