I found a WordPress RCEs with GPT5.6 and $25

Post by tonyedgecombe » Mon, Jul 20, 2026, 12:10 PM UTC

CM30 wrote: post #59

9dev wrote: post #18

Earlier quoted context omitted.

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…

Post by IshKebab » Mon, Jul 20, 2026, 12:18 PM UTC

9dev wrote: post #71

TacticalCoder wrote: post #51

Earlier quoted context omitted.

[flagged]

Let me convince you! :-) There are match expressions and arrow functions: $slug = $title |> trim(...) |> (fn($str) => str_replace(' ', '-', $str)) |> (fn($str) => str_replace('.', '', $str)) |> strtolower(...); There is meta-programming with annotations: final class PostsController { #[AccessControl(fn(Request $request, Post $post) => $request->user === $post->getAuthor() )] public function update(Request $request, P…

Post by timbits98 » Mon, Jul 20, 2026, 12:22 PM UTC

9dev wrote: post #74

mono442 wrote: post #53

Earlier quoted context omitted.

PHP is a proof that you don't need elegant or good technical solutions to be successful. You can literally pile up slop together and still be successful.

Yeah; the common idea of dignity and self-respect is to replace the duct tape with proper engineering once you're successful though, instead of just taping ever more of it on top and pretending SQL injections aren't really a problem.

Post by muvlon » Mon, Jul 20, 2026, 12:22 PM UTC

denysvitali wrote: post #55

ahartmetz wrote: post #4

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in…

Post by assanineass » Mon, Jul 20, 2026, 12:28 PM UTC

hmokiguess wrote: post #95

I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.