• AI did not hack WordPress. A skilled researcher used AI to speed up the analysis.

• Over 40% of websites run WordPress, so this vulnerability had wide reach.

• Cybercriminals use the same AI tools, so unpatched sites are now at risk faster than before.

• Apply every WordPress security update within days of release, not weeks.

• AI amplifies human expertise. It doesn’t replace it.

What Actually Happened

I’ve been programming since 1981 and building websites for clients since the 1990s. I’ve watched plenty of security stories come and go. This one is different.

A cybersecurity researcher recently found a serious vulnerability in WordPress using OpenAI’s GPT-5.6 reasoning model. The details matter here, so let’s be precise.

The AI didn’t hack WordPress.

An experienced human researcher used the model to work through the WordPress source code. Together, they identified a chain of individually minor weaknesses that combined into a critical exploit. The researcher knew what to look for, understood the codebase, and verified every finding. The AI made that analysis faster and more thorough.

That distinction is the whole story. And it’s why every business owner with a website should pay attention.

Key point: AI didn’t find the flaw on its own. A skilled expert directed the work. The AI just made that expert significantly faster.

Why This Matters for Your Business

Over 40% of the world’s websites run on WordPress. That includes a large number of New Zealand business sites, quite possibly yours. When a critical vulnerability appears in software used at that scale, the consequences reach millions of businesses at once.

A single flaw in WordPress Core is a flaw in nearly half the web.

This is also a clear signal of where things are heading. AI reasoning models can now hold large amounts of code in view, trace logic across files, and spot patterns that would take a human days to find. In software development, that means faster debugging. In cybersecurity, it means vulnerabilities get found sooner, by researchers and attackers alike.

Key point: WordPress’s widespread use means any serious vulnerability affects a huge number of businesses. Yours included.

How AI Makes Experts More Productive

There’s a persistent worry that AI will replace skilled people. This story shows what actually happens.

The researcher brought years of experience: knowing which parts of the code deserved scrutiny, recognising a genuine finding, and understanding how small weaknesses chain together into something serious. The AI accelerated that work. It handled tedious analysis at scale while the human directed the investigation and made the judgement calls.

An expert with AI outperforms an expert without it. That holds in security research, in programming, in marketing, and in running a business. I see it every day in my own work.

Key point: AI doesn’t replace expertise. It multiplies it. The person directing the work still needs to know what they’re doing.

The Part Business Owners Need to Hear

The same AI models that help ethical researchers find flaws are available to cybercriminals.

Attackers already reverse-engineer security patches to work out what was fixed, then target sites that haven’t applied the update. AI makes that process faster. A lot faster.

The practical result is simple and serious. The window between a WordPress security update being released and active attacks beginning is getting much shorter. A patch that once gave you weeks of breathing room now gives you days. Sometimes hours.

Waiting a month to update your site used to be risky. Now it’s genuinely dangerous.

Key point: AI is shortening the time attackers need to exploit unpatched sites. Prompt WordPress security updates are no longer optional.

Practical Steps for Every WordPress Site Owner

Protecting yourself is straightforward. Most breaches I see come from outdated software and weak passwords. Both are fixable this week. Applying every WordPress security update promptly is the single most effective thing you can do.

• Update WordPress Core promptly. Enable automatic updates for minor security releases, and apply major updates within days of release.

• Update plugins and themes too. Remove any you no longer use. Every inactive plugin is an unnecessary door.

• Back up your website regularly. Store backups off your hosting server and test that you can actually restore them.

• Use strong, unique passwords and two-factor authentication on your WordPress admin, hosting account, and domain registrar.

• Choose quality hosting with a firewall and malware scanning included.

• Limit admin accounts. Give people the minimum access they need to do their job.

• Work with a trusted provider who monitors your site and applies updates for you if this is beyond what you have time for.

None of this is glamorous. All of it works.

Key point: Good security isn’t complicated. It’s consistent. Outdated software and weak passwords cause most breaches, and both are avoidable.

The Bigger Picture: AI as a Technical Tool

For years, most business owners have thought of AI as a writing tool. Something that drafts emails and social posts. This story shows AI has become a genuine technical assistant, capable of serious analytical work in the hands of someone who knows what they’re doing.

That applies well beyond security. In my consulting work, I use AI to speed up automation projects, sharpen marketing content, and work through business problems. It accelerates good decisions. The judgement about what to build, what to fix, and what to ignore still comes from experience.

AI works best alongside real expertise. The tool amplifies whatever knowledge you bring to it. That’s why pairing it with experienced guidance produces the strongest results.

Key point: AI is a technical assistant, not a replacement for experience. The businesses getting the best results are the ones using it alongside genuine expertise.

Key Takeaways

Here’s what to take away from this:

• AI didn’t hack WordPress. A skilled researcher used AI to find a flaw faster. The expertise still came from the human.

• WordPress powers over 40% of websites, so a critical vulnerability has wide reach.

• Cybercriminals use the same AI tools, because of that, the time between a security update and active attacks is shrinking fast.

• Apply WordPress security updates within days of release. Don’t wait weeks.

• Back up your site regularly and test that you can restore it.

• Use strong passwords, two-factor authentication, and quality hosting.

• AI works best alongside real expertise. It amplifies what you bring to it.

FAQs

Did AI actually hack WordPress?

No. An experienced security researcher used an AI reasoning model to analyse the WordPress source code. The researcher directed the work and verified the findings. The vulnerability was reported responsibly so it could be fixed.

Is my WordPress website at risk right now?

If your site runs current versions of WordPress Core, plugins, and themes, your risk is low. Sites running outdated software carry real risk, because attackers actively scan for them.

How quickly should I apply WordPress security updates?

Within days of release. Enable automatic updates for minor releases. The window between a patch being released and attacks starting is now very short.

Should I stop using WordPress because of this?

No. WordPress is a solid, well-maintained platform. Its popularity means flaws get found and fixed quickly. The key is keeping it updated and following sensible security practices.

Can AI help my business beyond security?

Yes. AI assists with automation, marketing, content, and analysis. It delivers the best results when paired with practical experience, because someone still needs to judge which recommendations actually fit your business.

What if I don’t have time to manage WordPress updates myself?

Work with a trusted provider who monitors your site and applies updates for you. That’s a reasonable, cost-effective solution for most small business owners.

How do I know if my WordPress site has already been compromised?

Signs include unexpected changes to your site, slow load times, spam emails sent from your domain, or warnings from your hosting provider. A security scan from a quality hosting provider or a plugin like Wordfence will give you a clearer picture.

Need a Hand?

If you’d like help keeping your website secure, or you want to make better use of AI in your business, get in touch. I’ve spent decades working with this technology, and I’m happy to translate it into plain English so you can make sensible decisions. No jargon, no hype, just straight answers.