WordPress: 10 Hours to Find, 90 Min to Exploit

Why it matters

WordPress has shipped its second security release in three weeks, with the core team urging immediate installation. The latest release fixes a reflected cross-site scripting flaw on the login screen, reported by pwn.ai, that could lead to PHP code execution. The earlier release patched a critical chain in which Searchlight Cyber directed an OpenAI model at WordPress core and obtained a working pre-auth SQL injection chained to remote code execution within hours, at trivial cost. Patchstack telemetry then recorded exploitation attempts beginning shortly after the fix was committed to trunk, followed by a large-scale campaign of blocked attempts from many addresses, aided by a publicly circulating exploit tool. Patchstack also found that most early web application firewall rules were bypassable because they matched on the request URL while WordPress accepts the same route through the POST body. The story matters because both discovery and exploitation have accelerated at once, eroding the assumption that defenders have days to react between disclosure and active attacks.