I found a WordPress RCEs with GPT5.6 and $25
A recent blog post claims an advanced GPT-5.6-based workflow uncovered a remote code execution (RCE) vulnerability in WordPress core for about $25 in API costs, prompting debate over how much such exploits are actually worth and whether $500k price tags are realistic marketing hype. Commenters argue that large language models will increase both the supply of vulnerabilities and the need for continuous security testing, while criticizing WordPress’s aging PHP codebase and extensive plugin ecosystem as a persistent risk to a huge share of the web. Some see LLM-assisted bug hunting as a step toward more secure software overall, others worry it accelerates commoditization of exploits and widens the gap between technical and non-technical site owners.
Perceived value of the exploit ($500k claim)
- Many call the headline clickbait: no evidence this exploit sold for $500k, and brokers’ public price lists suggest much lower payouts, especially post-LLMs.
- Some note historical offers “up to” hundreds of thousands for WordPress 0‑day RCEs, but unclear if those were ever fully paid out.
- Several argue WordPress exploits are unlikely to command top-tier prices compared to browser/iOS/Android 0‑days, though others counter that WordPress’s massive footprint and government use make it a valuable target.
Impact of LLMs on vulnerability discovery
- Commenters see this as proof that LLM-assisted or LLM-driven exploit discovery is now practical, including multi-step chains.
- Others stress the human’s domain expertise, prompting, and validation work; $25 in tokens ignores years of experience and many failed attempts.
- Some expect exploit prices to fall as supply of bugs increases; others note demand is constrained and professional attackers can also use LLMs.
WordPress security and code quality
- Strong consensus that the WordPress codebase is dated, messy, and hard to modernize without breaking the plugin/theme ecosystem.
- The specific SQL injection fix is widely criticized as ugly and emblematic of deeper design problems (string-built queries, brittle APIs like
dbDelta). - Some argue WordPress is heavily hardened by sheer age and scrutiny; others point to continued basic mistakes (like string-concat SQL) as malpractice.
WordPress vs alternatives
- Many describe painful real-world WP deployments: plugin sprawl, high CPU, maintenance headaches, and security risk.
- Others defend WP as uniquely accessible to non-technical users (WYSIWYG editing, one‑click installs, WooCommerce, easy content updates).
- Static-site generators + headless CMS + cheap static hosting are proposed as more secure, low-maintenance alternatives, but acknowledged as less approachable for typical users.
Ethics, credit, and ecosystem effects
- Debate over whether people who use LLMs to find exploits or write code “deserve” credit or payment, vs crediting models or original training data authors.
- Some worry about “FOMO writing” that glamorizes LLM-powered bug hunting as a lottery ticket.
- Several expect continuous security scanning and pen-testing to become mandatory in a world where attackers can cheaply automate discovery.