I found a WordPress RCEs with GPT5.6 and $25

Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero...

These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.

Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials

So never modified at all, even if plainly contradictory and/or ethically and morally compromised?

not big surprise

>Rather than executing an SQL query directly, we’ll use the dbDelta function

>Note that the dbDelta function is rather picky, however. For instance:

>You must put each field on its own line in your SQL statement.

>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.

>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.

>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.

>You must not use any apostrophes or backticks around field names.

>Field types must be all lowercase.

>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.

>You must specify the length of all fields that accept a length parameter. int(11), for example.

> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

hmm yes, definitely. You are the principal.

Not only $25 is not accounting the years of experience, but also all the failed attempts.

I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

  WordPress is one of the most hardened targets of all time

    O: publish/oembed_cache, empty content, stale timestamp with parent C
    C: future/customize_changeset, changeset JSON with parent C
    P: draft/page, with parent D
    D: parse/request with itself as its parent
    S: publish/post, for providing embed data
    T: publish/post, containing the outer embed

I've been using LLMs to find security vulnerabilities and there is no way I can just submit what I found and call it a day (many try).

Yet you think professional criminals are too stupid to launder their activities through an unscrupulous yet legal intermediary?

Elon Musk didn't write code for a rocket, he hired people who could.

And at doing arithmetic for even longer /i

the people that can afford it, sure.

In fact that may well be true today. OP didn't try to sell it to discover the true price the market is willing to pay. And we all know that "somebody paid $$$ for something similar in the past" is no guarantee that somebody else is willing to pay any significant sum for your thing today. If it was, startups would be a lot easier

points to a bigger problem perhaps; software design, construction and distribution is fundamentally flawed.

Their listed pricing was up to $50k.

https://cyber-peace.org/wp-content/uploads/2017/09/ZERODIUM-...

And that was before LLMs could produce these at volume.

The demand (dollars) does not go up commensurately with the supply. So today maybe $500 or a few thousand. Maybe not even that.