Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

171–180 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#171

Post by soulofmischief »

tedggh wrote: post #138
bink wrote: post #121

Earlier quoted context omitted.

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

I currently work for a federal contractor including the DoD as their customer, using Wordpress as their main website. You would think there’s no sensitive information there, but some times all it takes is enough information about someone and their team to impersonate that person and gain access to an email thread, file sharing system or even an access card to a building. Never underestimate incompetence.

And never underestimate the competence of others.

Re: I found a WordPress RCEs with GPT5.6 and $25

#172

Post by CM30 »

liveoneggs wrote: post #86
CM30 wrote: post #59

Earlier quoted context omitted.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far. But what do you do in that situation? If they change the structure too much, then either they make…

they broke tons of stuff with Gutenberg/block editor and didn't seem to be bothered by backwards compat

Fair enough. The way they added Gutenberg was a complete mess. Like yeah, the idea is a good one, and the editor can be pretty good if used correctly. But the way it was built was certainly not ideal, and was probably the worst of all worlds. Felt like someone saw SquareSpace and co, thought WordPress was falling behind and decided to push for those features to be added as quickly and inefficiently as possible.

Re: I found a WordPress RCEs with GPT5.6 and $25

#173

Post by CM30 »

jaredklewis wrote: post #162
marysol5 wrote: post #145

Earlier quoted context omitted.

Wordpress is a great web shell, shame it also comes with a blog

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But e…

Honestly, the reasons could mostly be summed up as "we already used WordPress for the blog, we now need to add a shop onto the existing site, might as well extend the former rather than rebuild or maintain two systems".

Alternatively, folks that aren't particularly technical hacking together a solution that works 'well enough' for what they need, and agencies that only have the interest/capacity to use one platform deciding that each and every customer needs to use that platform.

If you're a skilled programmer WordPress is probably not a good solution for your issues, but if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use.

Re: I found a WordPress RCEs with GPT5.6 and $25

#175

Post by monster_truck »

Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign

Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials

Re: I found a WordPress RCEs with GPT5.6 and $25

#177

Post by f311a »

lillesvin wrote: post #91

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

They would not catch it, it requires combining multiple vulns.

Re: I found a WordPress RCEs with GPT5.6 and $25

#178

Post by f311a »

dzonga wrote: post #80

wordpress is so shitty - though it runs the majority of the web. people think PHP is shitty cz of Wordpress. at a certain point in time - people need to move to better ecosystems painful as that may be.

Historically, a lot vulnerabilities in PHP projects were because of PHP itself. Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.

Re: I found a WordPress RCEs with GPT5.6 and $25

#179

Post by muldvarp »

jorisw wrote: post #31
grey-area wrote: post #25

Earlier quoted context omitted.

That is in fact the end goal of CEOs pushing LLM use yes. Not possible right now, but if it were they would absolutely take that option.

[citation needed]

Do you think the CEO of your company hired you and pays a lot of money for you because they like you?

Re: I found a WordPress RCEs with GPT5.6 and $25

#180

Post by [deleted] »

Zsfe510asG wrote: post #88

There is no evidence that $500k has been paid or would be paid for an exploit like this one. Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k. The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

[deleted]
Post reply on HN