String concatenation SQL injection in the year 2026.
hmokiguessyesterday at 12:05 PM
I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narrative and the illusion that we are all missing out.
ahartmetzyesterday at 9:08 AM
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
raesene9yesterday at 9:24 AM
Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).
One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails. My experience is that GPT-5.5 and up does not like offensive security work (similar to Opus 4.7+/Fable).
I didn't notice it but I'd assume that the authors have some level of cyber approvals from OpenAI to relax the guardrails a bit.
lillesvinyesterday at 11:57 AM
I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?
secretslolyesterday at 5:03 PM
One of my websites was hacked with this, luckily not one with any users at all.
They did this:
- Two admin accounts in the database.
- plugin dir: wp-content/plugins/wp-core with remote command-execution web shell wp-core-[12 random chars].php
- firewall.php backdoor in mu-plugins dir with admin on GET ?sergei
- cache-seo-helper.php backdoor
- fixer.php which renames the wordpress version number to one which is patched.
I have decided to give up on Wordpress.
ameliaquiningtoday at 1:23 AM
I might be missing something, so perhaps someone can explain: Why are the steps in the middle of the exploit chain necessary? The writeup describes getting a SQL injection, then going from there to cache poisoning to exploiting various logic bugs, to eventually creating an admin account (and WordPress grants RCE to admin accounts by design). But if you have a SQL injection, why can't you use that to just create an admin account directly, by inserting it into the users table?
lexicalityyesterday at 10:30 AM
The author lost me at the last bit where they started using weird names for the posts. Why would you make one ID O and the other ID 0? Why single letters and not EMBED_01? Why seemingly random letters instead of ABCDEF? Does OCPDST stand for something?
cromkayesterday at 9:48 AM
This assumes those who'd pay $500k don't have the skill to use GTP5.6 for the same purpose themselves?
ifdefdebugyesterday at 9:32 AM
> Is GPT5.6 Sol Superhuman?
This is not a simple y/n question. Computers have been superhuman at playing chess for decades now. Reading this article, I guess they are superhuman at understanding code now as well.
dzongayesterday at 11:24 AM
wordpress is so shitty - though it runs the majority of the web.
people think PHP is shitty cz of Wordpress.
at a certain point in time - people need to move to better ecosystems painful as that may be.
barbazooyesterday at 6:29 PM
I'd expect the amount of money paid for exploits to go down then. It's inefficient to pay >$25 for an exploit that took $25 to make.
cadamsdotcomyesterday at 11:14 AM
That was an incredible writeup! Chapeau to the author - thanks for taking the time to do a writeup.
When Anthropic claimed Mythos chained 4 or 5 bugs to achieve sandbox escape and found bugs in core software, it sounded like bs. But here we are 2 months later seeing what they meant.
Cybersecurity was always a hard sell; security flaws were invisible - by contrast a fence with a hole is visible to everyone - anyone can ignore the locked gate and walk through the fence hole. With cybersecurity a hole in the fence may go unnoticed for years, maybe forever.
LLMs level the field. We will all benefit from more secure systems, a few people will get a lot of egg on their faces, and it will end the malpractice of underinvesting in software security to get a product out the door.
vavkamilyesterday at 9:07 AM
This one is both awesome and scary. We are living in a black mirror episode, where one well-crafted LLM prompt can get you $500k or the ability to hack into 500M websites :)
throwitaway222yesterday at 5:08 PM
Seems like exploit brokers can just buy a codex license and put the 500k towards finding all bugs in all software for the price of one bug
deletedyesterday at 12:09 PM
_superposition_yesterday at 10:25 AM
The cost of business nowadays? At what point does it become apparent that in today's world software needs continuous pen testing and scanning? If you don't your attackers will.
tantaloryesterday at 12:11 PM
Is this real? Or did they concoct this vulnerability just to write a blog post?
I'm not seeing any mention where they report this to WP or the patch.
r1chyesterday at 12:07 PM
Does Sol allow this kind of research by default or is this a "look at me I'm on the cyber research allowlist" post?
_joelyesterday at 1:10 PM
The "pro's buy out a company that has a massive add-on install base with the most non-technical users.
mixtureoftakesyesterday at 9:48 AM
What was the harness used? And yeah surprised about such prompts not being downright blocked, even with the cybersafety verification"
aussieguy1234yesterday at 9:15 AM
So they spent the $25. But the real question here is did they get the $500K?
preetham_ranguyesterday at 9:07 AM
Nice balance between practicality and ambition. Curious how it holds up with real-world scale.
joriswyesterday at 9:45 AM
RCE — Remote code execution
perarnengyesterday at 12:33 PM
How do you find exploits without risking someone seeing your attempt and reporting you as a hacker? do you register first somewhere?
CodeCompostyesterday at 9:39 AM
I like the idea of not crediting the person who posted the bug but to the LLM that found it. People who find exploits using LLMs should never get a reward or credit.
j45yesterday at 6:35 PM
I wonder if there could be a crowdfunding to harden Wordpress with the leading models, or some who might have access to something like a Mythos level.
staredyesterday at 11:02 AM
On another note - who needs WordPress in the age of Astro and LLMs?
I mean, it's not a taunt, but a serious question - do people keep WordPress because it used to be the easiest solution to set up years ago, or are there still clear use cases where one can argue it's the best solution?
IshKebabyesterday at 9:10 AM
Presumably they don't pay $500k anymore...
rvzyesterday at 9:20 AM
Just like that, the 0-day black market is experiencing a mini black Monday.
koko443yesterday at 1:37 PM
[dead]
supportmyesterday at 12:37 PM
[flagged]
throw8394498383yesterday at 9:27 AM
[flagged]
yellow_leadyesterday at 9:17 AM
Can RCEs like this still be sold to exploit brokers like Zerodium? If so, how? Asking for a friend