The researcher demonstrates that a $25 GPT-5.6 run can produce a working pre-auth RCE that exploit brokers would pay $250k-$500k for. Their core argument is that the marginal cost of finding fresh WordPress RCEs has dropped by orders of magnitude — from a skilled reverse engineer's weekend to pocket change — which fundamentally changes who can afford to hunt bugs at scale.
The editorial emphasizes that static taint analysis on PHP has existed for a decade via tools like RIPS, Progpilot, and Psalm's taint mode. What's genuinely new isn't the sink-tracing approach but the ratio: an off-the-shelf frontier model with no fine-tuning and a basic loop closed the source-to-exploit gap for the price of a team lunch.
The editorial frames WordPress plugins as the internet's soft underbelly — 60,000+ plugins maintained by one or two people, written in legacy PHP, running on servers that will never be patched. Defenders have known this for fifteen years; the change is that cheap AI-driven discovery now matches the ecosystem's fundamental fragility with attacker economics that scale.
The writeup makes clear the human's role was picking the target and steering the model past false positives — the AI didn't operate autonomously. This suggests target selection and triage judgment are still the differentiators, even as raw code-reading capability commoditizes.
SL Cyber researcher published a walkthrough of using GPT-5.6 to hunt for remote code execution bugs in WordPress plugins. The setup is embarrassingly simple: pull a plugin's source from the WordPress.org SVN, feed it to the model in chunks, ask it to identify sinks (unserialize, eval, include, file_put_contents, SQL) and trace user-controlled inputs to those sinks. Then ask it to write a proof-of-concept.
The total compute cost, per the writeup, came to roughly $25. The bug class it surfaced — a pre-auth, unauthenticated RCE in a plugin with a non-trivial install base — is exactly the kind of vulnerability that exploit brokers like Zerodium, Crowdfense, and various less-public buyers will pay $250,000 to $500,000 for. The researcher did not sell it. They reported it, got a CVE, and wrote the story up.
The methodology is not novel in the abstract. Static analysis of PHP for taint flow has existed for a decade (RIPS, Progpilot, Psalm's taint mode). What's new is the ratio: an off-the-shelf frontier model, with no fine-tuning, no agent scaffolding beyond a basic loop, and a budget smaller than a team lunch, closed the loop from source code to working exploit. The human's job was picking a target and steering the model past false positives.
The WordPress plugin ecosystem has been the soft underbelly of the internet for fifteen years. 60,000+ plugins, most maintained by one or two people, most written in a version of PHP that predates modern taint checking, most installed on servers whose owners will never patch them. Every serious defender already knew this. What's changed is who can afford to exploit it.
Before this year, the marginal cost of finding a fresh WordPress RCE was a skilled reverse engineer's weekend — call it $5,000 in opportunity cost, minimum, and often ten times that. Brokers paid what they paid because the supply was constrained by human attention. That constraint just broke. A $25 run means a solo attacker can burn through the top 1,000 plugins by install count for $25,000, which is less than one broker payout. The unit economics of mass vulnerability discovery have inverted.
The defensive story is worse than it looks. GitHub Advanced Security, Snyk, and the various SAST vendors have been quietly running LLMs against their customers' code for a year now, and their false-positive rates are still bad enough that most teams triage the output badly. The difference between an attacker and a defender using the same technique is that the attacker only needs one true positive per hundred false positives to profit. The defender needs to fix all of them, and can't tell which one an attacker will find first.
The exploit-broker economy is going to bifurcate. Bugs in unfashionable, high-install-base targets — WordPress plugins, WooCommerce extensions, cPanel modules, Magento, older Drupal — are about to be worth roughly nothing on the open market, because supply will overwhelm demand. Bugs in hardened targets — iOS, Chrome, hypervisors, kernel — stay expensive because LLMs still can't reason about them well enough. Expect broker price sheets to reflect this within twelve months, and expect the WordPress-adjacent CVE flood to make the last few years look quiet.
One caveat worth naming: we don't know how many attempts the researcher made before landing the disclosed bug. The writeup shows one target, one bug, $25. If the real number is "twenty targets, one bug, $500," the story still holds — the economics still work — but the framing shifts from "LLMs find RCEs" to "LLMs find RCEs at attacker-favorable success rates." Both are true. Only one makes a better tweet.
If you maintain a PHP package with more than a couple thousand installs, three things change starting now. First, your threat model should assume adversaries are running frontier models against your source tree on a weekly cadence. Not "might." Are. Second, the classes of bugs LLMs find easily — unsafe deserialization, unauthenticated admin endpoints, SQLi via string concatenation, LFI via unsanitized include paths — need to be swept out proactively, not fixed reactively when a CVE lands. Run Psalm with taint mode, run PHPStan level 9, and treat any pending fix in those categories as an active incident. Third, your disclosure process needs to handle 5x the inbound volume it does today, because the researcher-to-drive-by ratio is about to shift.
If you run WordPress in production and you're not on a managed host that patches plugins within 24 hours of disclosure, you are choosing to be exploited on a timeline set by whoever spends $25 first. Wordfence, Patchstack, and the various WAF vendors will help, but virtual patching is a delay, not a fix. The only durable answer is aggressive pruning: audit every plugin in your install, delete anything you don't actively use, pin the rest to specific versions, and subscribe to CVE feeds for each one.
For security teams at larger orgs, the takeaway is subtler. Your bug bounty program's payout table was calibrated against human researcher economics. It's about to be flooded by LLM-assisted researchers submitting bugs at the low end of your severity ladder. Either raise the bar (require working PoC, require impact demonstration) or raise the ceiling (pay more for critical bugs to keep serious researchers reporting to you instead of selling), because the middle of your payout curve is about to become unprofitable to run.
The honest read is that the LLM-vs-code contest is going to look like the LLM-vs-chess contest did in the late 2010s — a fast asymmetric shift where the machines become better than the median human at a specific task, then better than the best human, then cheap enough that the question is no longer capability but throughput. WordPress plugins are the pawns. Kernel bugs are the endgame. The interesting years are the ones in between, and they started this quarter.
https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa...String concatenation SQL injection in the year 2026.
I am so done with FOMO writing. Sure man, you found one with $25. With $25 plus your entire industry domain specific knowledge of where to look, of how to probe, of what else you may have accumulated and collected over the years of working within this industry. Let's stop with the gambling narr
The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.
Interesting write-up and I do think LLM assisted/powered exploit disclosure is a real concern (I've been able to get models to create container breakouts from Linux LPEs relatively quickly).One thing I'm surprised about is that GPT-5.6 didn't block that prompt due to guardrails.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
There is no evidence that $500k has been paid or would be paid for an exploit like this one.Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.The author works for https://www.assetnote.io/ , which has AI products for