Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25
Points and comments are a snapshot, not live.
A researcher used an LLM prompt to find a WordPress pre-auth SQLi leading to RCE.
A security researcher adapted OpenAI's GPT5.6 Sol Ultra prompt used for solving the Cycle Double Cover conjecture to find a zero-day in WordPress. The prompt cost $25 and led to a pre-auth SQL injection via the batch API's validation/execution desync bug. The SQLi was escalated to RCE by poisoning the WP_Post cache via UNION injection and controlling article text. The exploit affects default WordPress installations with MySQL, potentially impacting over 500 million sites.
What commenters are saying
Commenters are split between awe at the LLM discovery and skepticism about the $500k claim, noting exploit brokers would pay that for a true 0-day but the title is likely clickbait. Many criticize WordPress's dated codebase, calling it duct-taped slop, and suggest static sites are more secure. Some discuss the impracticality of selling such exploits versus the market adjusting to LLM-assisted vulnerability discovery.