WordPress shipped its second emergency security release in three weeks on August 6, and the story behind it says more about the current threat landscape than the patch itself does.
The 7.0.3 update fixes a pre-auth cross-site scripting bug on the login screen that can lead to code execution, reported by researchers at pwn.ai. But the more revealing details trace back to the previous release, 7.0.2, patched on July 17.According to Patchstack, that fix addressed a vulnerability chain that traditional manual research never caught. Searchlight Cyber pointed an OpenAI model at WordPress core, and the AI produced a working exploit chain, from SQL injection to remote code execution, in ten hours, for roughly $25 in compute costs.
What happened next moved just as fast. Patchstack recorded the first real-world exploitation attempts about 90 minutes after 7.0.2 went live, only three hours after developers committed the fix to WordPress’s public codebase. Attackers needed no reverse engineering. They simply watched the commit.
Within days, Patchstack says it blocked more than 65,000 attempts from over 1,500 different addresses, most of them automated scans against the vulnerable REST API endpoint. A smaller cluster of requests, just three IP addresses, went straight for administrator account creation using the full exploit chain.
There’s also a broader trend sitting underneath all this. WordPress security reports through HackerOne held steady at a few dozen per month for nine years, then jumped to 450 in July, according to figures from core security lead John Blackbourn. Patchstack attributes much of that spike to AI tools lowering the barrier for finding vulnerabilities in the first place.
One finding matters more than the exploit itself. Nearly every web application firewall rule published after the July disclosure, including Patchstack’s own, only checked request URLs for the malicious pattern. WordPress, it turns out, also accepts the same routing information through POST request bodies, a gap that let attackers slip past filters that looked airtight on paper.
For hosting providers, the practical takeaway is blunt: reading release notes and reacting manually no longer works when the gap between disclosure and exploitation shrinks to hours.
