A WordPress RCE Worth $500k on the Exploit Market Found for $25 Using GPT

The economics of vulnerability research just shifted. A researcher running GPT against WordPress source code surfaced a remote code execution flaw that would command a $500,000 payout on the open exploit broker market. The total spend: around $25 in API costs.

This is not a story about AI replacing security researchers. It is a story about cost compression. RCE discovery in complex codebases has historically required deep manual auditing, domain expertise, and significant time. LLM-assisted analysis collapses the per-finding cost by orders of magnitude — at least for a class of vulnerabilities that the model can pattern-match against known sinks and sources.

The practical implication for builders: the asymmetry between attacker and defender is widening. If a solo researcher with a credit card can surface a half-million-dollar exploit, threat actors with actual budgets can run this at scale across every popular plugin and theme in the WordPress ecosystem. WordPress powers a large fraction of the public web, and its plugin surface area is enormous and largely unaudited.

For engineering teams shipping on WordPress or maintaining PHP codebases, the signal here is clear. Static analysis tooling and manual review cadences designed for a pre-LLM threat model are insufficient. Automated, LLM-augmented scanning needs to be part of your defensive posture now, not eventually.

The finding also puts pressure on exploit broker pricing models. If $25 of compute can surface $500k inventory, the supply side of that market is about to get crowded. Prices will compress. That changes the incentive calculus for responsible disclosure versus sale.

The researcher's write-up is worth reading in full at slcyber.io. The methodology is replicable, and the cost floor will only drop as model efficiency improves.

Source