Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

11–20 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#11

Post by raesene9 »

Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).

One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable).

I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.

Re: I found a WordPress RCEs with GPT5.6 and $25

#12

Post by lyu07282 »

ahartmetz wrote: post #4

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me

Re: I found a WordPress RCEs with GPT5.6 and $25

#15

Post by wongarsu »

vavkamil wrote: post #2

This one is both awesome and scary. We are living in a black mirror episode, where one well-crafted LLM prompt can get you $500k or the ability to hack into 500M websites :)

The market will quickly adjust to the point where spending $50 on tokens will on average give you a vulnerability valued at $50. Maybe $100 to account for your edge in having a better prompt and the risk of prison time you take in selling the exploit

In fact that may well be true today. OP didn't try to sell it to discover the true price the market is willing to pay. And we all know that "somebody paid $$$ for something similar in the past" is no guarantee that somebody else is willing to pay any significant sum for your thing today. If it was, startups would be a lot easier

Re: I found a WordPress RCEs with GPT5.6 and $25

#18

Post by 9dev »

progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

Re: I found a WordPress RCEs with GPT5.6 and $25

#20

Post by geek_at »

9dev wrote: post #18
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

it would help if they used strict types and modern standards but as you say the wordpress codebase is beyond dated and held together with duckt tape
Post reply on HN