Executive TL;DR:

• Exploit brokers pay $500k for WordPress RCEs.
• A WordPress RCE was found using GPT5.6 for $25.
• Forum voices question the high price and skill level of buyers.

The Buzz Score

The Internet’s Verdict: 70% Hyped, 30% Skeptical

Forum Discussion

Some experts are surprised by the high price of canned vulnerabilities.

This assumes those who’d pay $500k don’t have the skill to use GTP5.6 for the same purpose themselves?

Others are not surprised, given WordPress’s history of security issues.

WordPress is known as the remote root shell with a blogging feature.

There are also questions about the harness used and the lack of blocked prompts.

What was the harness used? And yeah surprised about such prompts not being downright blocked, even with the cybersafety verification

LLM-Assisted Exploit Disclosure

One expert notes that LLM-assisted exploit disclosure is a real concern.

Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I’ve been able to get models to create container breakouts from Linux LPEs relatively quickly).

Focus Keyword: WordPress RCE