全部文章0
Hacker Newsinfosecau··访问 1

Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25

原网页

Article URL: https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/

Comments URL: https://news.ycombinator.com/item?id=48975665

Points: 339

# Comments: 185

Hacker News 讨论

340 points · 189 comments · 查看原帖

  1. Zsfe510asG

    There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

  2. progbits

    https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

  3. hmokiguess

    I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.

  4. ahartmetz

    The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

  5. barbazoo

    I'd expect the amount of money paid for exploits to go down then. It's inefficient to pay >$25 for an exploit that took $25 to make.

  6. raesene9

    Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly). One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable). I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.

  7. lillesvin

    I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

  8. secretslol

    One of my websites was hacked with this, luckily not one with any users at all. They did this: - Two admin accounts in the database. - plugin dir: wp-content/plugins/wp-core with remote command-execution web shell wp-core-[12 random chars].php - firewall.php backdoor in mu-plugins dir with admin on GET ?sergei - cache-seo-helper.php backdoor - fixer.php which renames the wordpress version number to one which is patched. I have decided to give up on Wordpress.