Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.
The author works for https://www.assetnote.io/ , which has AI products for automated scanning.
Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero...
These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.
bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a browser or a mobile. Browsers and mobiles are the only things that are perennially useful to an intelligence agency. Those two are reliable access vectors for the vast majority of things that interest government organisations.
ex: Target hits website -> site delivers RCE for some software that is on the target's system
I'd disagree here. Still 41% of all sites use Wordpress [1]... and that means a lot of targets, and a lot of ways to target them. Your good ole' deface/ransomware extortion scheme, leaking data supposed to be confidential (such as account lists), trusted spreaders for exploits, or the latest hit, bets on "prediction markets" that have some Wordpress site set as oracle. People are willing to screw around with airport weather stations to manipulate bets [2], it's not that much of a stretch to assume such incentives would also apply for website hackers.
[1] https://www.wpzoom.com/blog/wordpress-statistics/
[2] https://edition.cnn.com/2026/04/23/europe/france-weather-sen...
You also don't need an RCE for 99% of that.
This is just 100% an incorrect assumption. Even just an e-commerce site running Woo has troves of potentially valuable customer data. Not to mention whatever else might be on the server, or what that server is connected to...
I would hope not, but I’d be surprised if that were true across the millions(?) of Wordpress sites?
Why post these random unsubstantiated claims on HN?
To show everyone the Gell-Mann amnesia effect in action.
When HN top karma poster and security professional posts something like this, doubles down, and can’t even be bothered to support it in any way (I’m open to learning and changing my opinion) it completely blurs the line going into social media influencer. Quantity over quality.
Just because they're exclusive about their clients doesn't mean they're not real. Their impact and effectiveness is a separate topic though. I don't think they're still actively operating or taking new clients, at least.
btw: "Oh, so you've done x?" What a snarky and confrontational way to ask someone something. Especially when it's asserting a well documented company and person is "not real".
I’m just baffled.
Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials
It had last been booted on it, complete with working hard drive an; MacOS X 10.3. So $1.299 -> $0.
So never modified at all, even if plainly contradictory and/or ethically and morally compromised?
not big surprise
String concatenation SQL injection in the year 2026.
>Rather than executing an SQL query directly, we’ll use the dbDelta function
>Note that the dbDelta function is rather picky, however. For instance:
>You must put each field on its own line in your SQL statement.
>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.
>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.
>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.
>You must not use any apostrophes or backticks around field names.
>Field types must be all lowercase.
>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.
>You must specify the length of all fields that accept a length parameter. int(11), for example.
>> s/you must/thou shalt/g
But what do you do in that situation? If they change the structure too much, then either they make it impossible to upgrade an existing site, or potentially break a whole bunch of things said sites depend on (mostly themes and plugins). And that ease of upgrading is likely what stops a lot of people just migrating away to other solutions.
And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.
There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.
What WordPress foundation?
It’s clear that the core WordPress developers have a very different idea of project stewardship than the Gutenberg devs do.
Anyway, I probably shouldn't comment as maybe WP has progressed but it doesn't sound like it.
Alternatively, folks that aren't particularly technical hacking together a solution that works 'well enough' for what they need, and agencies that only have the interest/capacity to use one platform deciding that each and every customer needs to use that platform.
If you're a skilled programmer WordPress is probably not a good solution for your issues, but if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use.
But yes, I agree, WP is very useful for those times when you need to run a quick `sudo rm -rf /` command but can't get to a terminal.
WordPress is actively degrading the security and quality of the web I general. Has been for many many years.
If code is poetry, Wordpress is a new genre of it, probably?
[0] https://wptavern.com/wordpress-org-login-introduces-mandator...
Please don't. There is absolutely no reason not to use the extremely simple and powerful combination of:
* a headless CMS / static website generated, of which there are a bunch so pick the one you like the most. My go-to is Hugo but it is somewhat complex
* a static hosting service with a generous free tier like CloudFlare Pages/Workers, Netlify, Firebase Hosting, etc.
Your blog costs nothing, has zero attack surface and zero maintenance.
https://github.com/hparadiz/technexus
https://github.com/divergence/framework
My framework is faster than Eloquent at this point.
PHP might seem worse than other languages due to a combination of factors:
- It's the most used one by far, even though few of us like to admit it.
- Old tutorials still come up during web searches, so "SELECT * FROM `table` WHERE id = $id" will still be written today.
ASP had a bit of a barrier to entry because it required all the MS. Whereas PHP was everywhere.
I cringe everytime.
PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements. It has runtime reflection APIs that are so cheap that you don't really have to think about using them. You can do OOP or FP with PHP, or even procedural HTML-interleaved-with-PHP if that's your thing. It has late static binding, so you can defer to child classes from their parent class. There are generators and fibres as first-class language constructs now. Property hooks are an extremely clear pattern, way better than in many other languages.
Generally, there have been tons of new syntax extensions over the years, and they all slot in gracefully. With PHP 8.6, we're going to get partial application for functions, which will make PHP 8.5's match expressions one of the most ergonomic implementations I have seen yet!
You don't need many libraries in a typical project, because PHP is batteries-included and if you use a framework it does all the rest for you, that is true. But there are still hundreds of thousands of packages with billions of installs:
There are match expressions and arrow functions:
$slug = $title
|> trim(...)
|> (fn($str) => str_replace(' ', '-', $str))
|> (fn($str) => str_replace('.', '', $str))
|> strtolower(...);
final class PostsController
{
#[AccessControl(fn(Request $request, Post $post)
=> $request->user === $post->getAuthor()
)]
public function update(Request $request, Post $post): Response {
// ...
}
}
enum Status
{
case Draft;
case Published;
case Archived;
}
class Data
{
public string $fullName {
get => "{$this->firstName} {$this->lastName}";
set(string $value) {
[$first, $last] = explode(' ', $value);
$this->firstName = $first;
$this->lastName = $last;
}
}
}
There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`.
The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of arrow functions entirely.
array_map(callback: fn($i) => $i * 2, array: [10])There are many very successful and professional PHP projects with millions of users that seem to be able to migrate to newer PHP versions just fine.
Whatever the WordPress developers are claiming are the reasons for their irresponsible codebase and their inability to improve it is nobody's fault but their own.
Beauty is in the eye of the beholder, and I'll disagree kindly with you on that "Nope".
User data should of course be passed via prepared statements.
Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
> WordPress database access abstraction class.
class wpdb {}
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT );
It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
It would definitely be a breaking change and unmigratable.
> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...
hmm yes, definitely. You are the principal.
Not only $25 is not accounting the years of experience, but also all the failed attempts.
I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.
And people like to be able to extend from Blogs to various other non static features which WordPress allows for.
- Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.)
- In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.
Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.
WordPress is one of the most hardened targets of all time
Will be publishing a report on www.theweb.report soon - if you're interested.
That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail.
( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).
One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable).
I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.
They did this:
- Two admin accounts in the database.
- plugin dir: wp-content/plugins/wp-core with remote command-execution web shell wp-core-[12 random chars].php
- firewall.php backdoor in mu-plugins dir with admin on GET ?sergei
- cache-seo-helper.php backdoor
- fixer.php which renames the wordpress version number to one which is patched.
I have decided to give up on Wordpress.
O: publish/oembed_cache, empty content, stale timestamp with parent C
C: future/customize_changeset, changeset JSON with parent C
P: draft/page, with parent D
D: parse/request with itself as its parent
S: publish/post, for providing embed data
T: publish/post, containing the outer embedI've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).
Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?
Elon Musk didn't write code for a rocket, he hired people who could.
This is not a simple y/n question. Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.
And at doing arithmetic for even longer /i
people think PHP is shitty cz of Wordpress.
at a certain point in time - people need to move to better ecosystems painful as that may be.
When Anthropic claimed Mythos chained 4 or 5 bugs to achieve sandbox escape and found bugs in core software, it sounded like bs. But here we are 2 months later seeing what they meant.
Cybersecurity was always a hard sell; security flaws were invisible - by contrast a fence with a hole is visible to everyone - anyone can ignore the locked gate and walk through the fence hole. With cybersecurity a hole in the fence may go unnoticed for years, maybe forever.
LLMs level the field. We will all benefit from more secure systems, a few people will get a lot of egg on their faces, and it will end the malpractice of underinvesting in software security to get a product out the door.
the people that can afford it, sure.
In fact that may well be true today. OP didn't try to sell it to discover the true price the market is willing to pay. And we all know that "somebody paid $$$ for something similar in the past" is no guarantee that somebody else is willing to pay any significant sum for your thing today. If it was, startups would be a lot easier
points to a bigger problem perhaps; software design, construction and distribution is fundamentally flawed.
I'm not seeing any mention where they report this to WP or the patch.
Their listed pricing was up to $50k.
https://cyber-peace.org/wp-content/uploads/2017/09/ZERODIUM-...
And that was before LLMs could produce these at volume.
The demand (dollars) does not go up commensurately with the supply. So today maybe $500 or a few thousand. Maybe not even that.
I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?