Cybersecurity & AI

$500,000 WordPress Holes: The Exploit-Broker Economy Meets AI

Working exploits against the world's most common website system now trade privately for half a million dollars each — and, remarkably, one of them was discovered by an AI assistant.

• Invite-only "exploit brokers" sell a single working WordPress remote-code-execution chain for roughly $500,000.
• A researcher at SL Cyber claims to have found such a pre-authentication RCE using the new GPT-5.6 "Sol Ultra" model — without needing a human to manually trace the code.
• The finding matters because WordPress powers more than 40 percent of all websites, so a single clean hole reaches an enormous attack surface.

For years, weapon-grade software flaws were the property of a small circle: national intelligence agencies, large threat groups, and the specialist researchers who discovered them. A quiet layer of the dark web has since formalized that trade. "Exploit brokers" are intermediaries who vet, verify, and resell working exploits, often on an invite-only basis. The price tag tells the story: a clean, pre-authentication remote code execution (RCE) against a target as ubiquitous as WordPress now fetches around $500,000.

The economics have shifted again with AI. A security researcher at Searchlight Cyber (SL Cyber) describes feeding the raw WordPress source code into OpenAI's GPT-5.6 "Sol Ultra" model and asking it, straightforwardly, to find a zero-day. Within roughly four hours the model surfaced a pre-authentication SQL injection, then was asked whether that could be escalated to full RCE — and answered in the affirmative, tracing a path from read-only database access all the way to an administrator-level shell. The chain was independently reproduced by two other researchers before public disclosure.

The lesson is about speed more than novelty. WordPress is among the most heavily audited software in the world, yet an AI model trained on code and reasoning patterns found a working chain that humans had missed. That does not mean every future flaw will be AI-discovered, but it strongly suggests the clock on zero-day windows is ticking faster. For the billions of pages running WordPress, the only reliable defence — update early, monitor quietly, assume your system is on a broker's shortlist.