Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a WordPress RCEs with GPT5.6 and $25

slcyber.io

Post reply on HN
Print view View original

161–170 of 247 posts

Re: I found a WordPress RCEs with GPT5.6 and $25

#161

Post by codedokode »

winstonwinston wrote: post #96
formerly_proven wrote: post #84

Earlier quoted context omitted.

Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.

Quick search shows this in Wordpress: > WordPress database access abstraction class. class wpdb {} So this is some sort of ORM provided. $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT ); > Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escap…

It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.

Re: I found a WordPress RCEs with GPT5.6 and $25

#162

Post by jaredklewis »

marysol5 wrote: post #145
tonyedgecombe wrote: post #101

Earlier quoted context omitted.

This isn’t some problem that has developed over time. It was shit from day one.

Wordpress is a great web shell, shame it also comes with a blog

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But even at that time there were already loads of great, batteries included PHP frameworks like Symfony or Cake. Why not just skip the painful part and code what you want directly?

Anyway, I probably shouldn't comment as maybe WP has progressed but it doesn't sound like it.

Re: I found a WordPress RCEs with GPT5.6 and $25

#163

Post by madaxe_again »

bink wrote: post #121
kuroguro wrote: post #99

Earlier quoted context omitted.

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/ Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero... These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full pa…

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far m…

There’s a server running behind a Wordpress site. If you have RCE, you can run whatever arbitrary code you like there - mine crypto, run a botnet, all sorts of fun and profitable stuff. Hey, you can even make the site make the site’s users your unwitting hosts, too. You don’t go hack a Wordpress site, you go grab a few hundred thousand of them and do industrial scale crimes.

Re: I found a WordPress RCEs with GPT5.6 and $25

#164

Post by deaton »

hmokiguess wrote: post #95

I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.

And nobody would post "I did it for free!" if they had done it themselves, but somehow spending $25 on tokens changes how we're supposed to look at it

Re: I found a WordPress RCEs with GPT5.6 and $25

#165

Post by madaxe_again »

sunaookami wrote: post #39
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with... >Rather than executing an SQL query directly, we’ll use the dbDelta function >Note that the dbDelta function is rather picky, however. For instance: >You must put each field on its own line in your SQL statement. >You must have two spaces between the words PRIMARY KEY and the definition of your primary key. >You must use the key word…

I like that you chose ten examples.

>> s/you must/thou shalt/g

Re: I found a WordPress RCEs with GPT5.6 and $25

#166

Post by close04 »

cmeacham98 wrote: post #127
tptacek wrote: post #119

Earlier quoted context omitted.

Oh, you've done business with them then? Know someone who has?

Yes actually, I know someone who did business with them many years ago (before the advent of LLMs), although for a smaller sum than the advertised top payouts (the vulnerability they had was much less important). Why post these random unsubstantiated claims on HN?

> Why post these random unsubstantiated claims on HN?

To show everyone the Gell-Mann amnesia effect in action.

When HN top karma poster and security professional posts something like this, doubles down, and can’t even be bothered to support it in any way (I’m open to learning and changing my opinion) it completely blurs the line going into social media influencer. Quantity over quality.

Re: I found a WordPress RCEs with GPT5.6 and $25

#167

Post by duped »

sunaookami wrote: post #39
progbits wrote: post #13

https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa... String concatenation SQL injection in the year 2026.

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with... >Rather than executing an SQL query directly, we’ll use the dbDelta function >Note that the dbDelta function is rather picky, however. For instance: >You must put each field on its own line in your SQL statement. >You must have two spaces between the words PRIMARY KEY and the definition of your primary key. >You must use the key word…

Sometimes when you write documentation for APIs you realize something is terribly designed. That should have happened here.

Re: I found a WordPress RCEs with GPT5.6 and $25

#168

Post by hparadiz »

sofixa wrote: post #157
hparadiz wrote: post #49

Earlier quoted context omitted.

I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.

> But with AI you kinda sorta should just build your own blog Please don't. There is absolutely no reason not to use the extremely simple and powerful combination of: * a headless CMS / static website generated, of which there are a bunch so pick the one you like the most. My go-to is Hugo but it is somewhat complex * a static hosting service with a generous free tier like CloudFlare Pages/Workers, Netlify, Firebase…

You happen to be on HN. Not only do I have my own blog but also my own entire ORM.

https://github.com/hparadiz/technexus

https://github.com/divergence/framework

My framework is faster than Eloquent at this point.

Re: I found a WordPress RCEs with GPT5.6 and $25

#169

Post by muldvarp »

inigyou wrote: post #24
Philip-J-Fry wrote: post #21

Earlier quoted context omitted.

One LLM prompt can't get you $500K. Why would someone spend $500k instead of just prompting themselves?

Because they don't know you can

I think anyone willing to pay $500k is well aware that LLMs can be used to find vulnerabilities.

Re: I found a WordPress RCEs with GPT5.6 and $25

#170

Post by muldvarp »

pelagicAustral wrote: post #23
CodeCompost wrote: post #22

I like the idea of not crediting the person who posted the bug but to the LLM that found it. People who find exploits using LLMs should never get a reward or credit.

So people coding with LLMs shouldn't get paid then, right?

Do you assume that five years from now you'll get paid for coding with LLMs?
Post reply on HN