Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25 (slcyber.io)

A recent analysis revealed that exploit brokers are willing to pay up to $500,000 for Remote Code Execution (RCE) vulnerabilities in widely used software like WordPress. Utilizing the newly released GPT5.6 Sol Ultra, a security researcher discovered a critical vulnerability in WordPress that allows for pre-authentication SQL injection, which can escalate to RCE. This exploit is particularly alarming considering WordPress powers over 500 million sites globally. The researcher adapted an OpenAI prompt originally designed for solving complex mathematical problems, employing a multi-agent strategy to explore the WordPress codebase. After testing the model for six hours, an SQL injection vulnerability in the WordPress batch API was identified. This flaw enables malicious users to bypass input sanitization, potentially leading to unauthorized access and full control over affected WordPress installations. The implications for the AI/ML community are significant as it demonstrates the potential of advanced language models in uncovering vulnerabilities, bridging the gap between AI technology and cybersecurity, and prompting further discussions around the responsible use of such powerful tools in security research.