Exploit Brokers Offer $500k for WordPress RCEs

A research team at SL Cyber’s research center has revealed that exploit brokers are willing to pay a staggering $500,000 for a single remote‑code‑execution (RCE) vulnerability in WordPress. The team’s post, which has attracted 75 up‑votes and 40 comments on Hacker News, details how the author discovered a new RCE that can be leveraged using the latest GPT‑5.6 model. According to the report, the vulnerability allows an attacker to execute arbitrary code on a compromised WordPress site without authentication, making it highly valuable to threat actors seeking to launch large‑scale attacks or sell the exploit on underground markets.

The article explains that the exploit’s value is driven by its broad applicability—WordPress powers more than 40% of the web—and the ease with which GPT‑5.6 can automate the exploitation process. The research team notes that the $500,000 price tag reflects the potential for significant financial gain, either through direct monetization of compromised sites or resale to other malicious actors. Industry experts cited in the post warn that the convergence of powerful AI models and sophisticated exploit marketplaces poses a growing risk to the global web infrastructure, urging site administrators to patch known vulnerabilities promptly and to monitor for signs of exploitation.