[Zsfe510asG]

There is no evidence that $500k has been paid or would be paid for an exploit like this one.

Given that the article says that prompts are modified like they are holy scripture, perhaps sell the prompt for $500k.

The author works for https://www.assetnote.io/ , which has AI products for automated scanning.

[kuroguro]

Likely referencing https://www.crowdfense.com/exploit-acquisition-program/

Zerodium used to offer up to 300k in 2021 https://www.securityweek.com/sites/default/files/images/Zero...

These brokers usually don't pay the bulk sum - they sell access to nation actors and you get payed out over time as long as the bug is not patched to discourage reselling and burning it. I doubt anyone would confirm if they got the full payment or not for something similar.

[bink]

I work in the field and I just cannot believe anyone would pay that much for a Word Press exploit. People pay money for iOS or Android because there is valuable information stored on devices running those operating systems. There's absolutely nothing of value on any Word Press site. The only possible reason I can think of is for a watering hole attack, but that would require a second exploit that would be worth far more (and they aren't).

[tedggh]

I currently work for a federal contractor including the DoD as their customer, using Wordpress as their main website. You would think there’s no sensitive information there, but some times all it takes is enough information about someone and their team to impersonate that person and gain access to an email thread, file sharing system or even an access card to a building. Never underestimate incompetence.

[soulofmischief]

And never underestimate the competence of others.

[kulahan]

lol, a big part of security is being smart enough to never challenge the bored…

[grugq]

Bulk reply to all the people replying.

bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a browser or a mobile. Browsers and mobiles are the only things that are perennially useful to an intelligence agency. Those two are reliable access vectors for the vast majority of things that interest government organisations.

[mschuster91]

> There is very little interest in Wordpress

I'd disagree here. Still 41% of all sites use Wordpress [1]... and that means a lot of targets, and a lot of ways to target them. Your good ole' deface/ransomware extortion scheme, leaking data supposed to be confidential (such as account lists), trusted spreaders for exploits, or the latest hit, bets on "prediction markets" that have some Wordpress site set as oracle. People are willing to screw around with airport weather stations to manipulate bets [2], it's not that much of a stretch to assume such incentives would also apply for website hackers.

[1] https://www.wpzoom.com/blog/wordpress-statistics/

[2] https://edition.cnn.com/2026/04/23/europe/france-weather-sen...

[strictnein]

Plenty of underground forums sell exploits for people to do stuff like that, but you're talking $200, not a theoretical $500k.

You also don't need an RCE for 99% of that.

[tptacek]

This is an axiomatic response to an empirical argument.

[strictnein]

Are they only buying browser RCEs or are they also interested in RCEs deliverable via browser?

ex: Target hits website -> site delivers RCE for some software that is on the target's system

[dcrazy]

Aren’t WP exploits valuable for watering hole attacks?

[strictnein]

You don't need an RCE for that though. There's a lot of vulnerable plugins deployed everywhere.

[dcrazy]

Ok, but an RCE in WP Core still seems pretty dang valuable, especially if you want to hit non-commercial websites that are less likely to have as many plugins installed?

[illliillll]

You already owned the WordPress admin with your browser 0day, you don’t care if WordPress is secure or not.

[JSR_FDED]

Remember the Panama papers? That was a Wordpress hack.

[technion]

Compromising a crappy wordpress site means compromising mailbox credentials.

https://lolware.net/blog/2020-09-02-autodiscover-circus/

[marysol5]

Surprising amount of gov use WP as a CMS on their websites. So it's not that far off.

[madaxe_again]

There’s a server running behind a Wordpress site. If you have RCE, you can run whatever arbitrary code you like there - mine crypto, run a botnet, all sorts of fun and profitable stuff. Hey, you can even make the site make the site’s users your unwitting hosts, too. You don’t go hack a Wordpress site, you go grab a few hundred thousand of them and do industrial scale crimes.

[apercu]

>There's absolutely nothing of value on any Word Press site.

I would hope not, but I’d be surprised if that were true across the millions(?) of Wordpress sites?

[foco_tubi]

> There's absolutely nothing of value on any Word Press site

This is just 100% an incorrect assumption. Even just an e-commerce site running Woo has troves of potentially valuable customer data. Not to mention whatever else might be on the server, or what that server is connected to...

[Hizonner]

Why would anybody trust criminals to pay them over time?

[idiotsecant]

Because if they don't other people will hear they don't pay and won't sell them 0days

[nativeit]

How long do you figure a criminal reputation typically needs/wants to last? I have always been skeptical of “black market credit ratings”. If you happen to build one up, it’s likely only in order to rip someone off at a higher price and cash in the value of it. It’s not like you’ll need that good rep for your retirement.

[applfanboysbgon]

ShinyHunters has been "in business" since 2019 and it is their reputation that resulted in eg. Canvas paying their ransom this year. Without that reputation, it is unlikely a large-scale ransom would have been paid, because the reputation is what gives them credibility that paying the ransom will actually result in the promise being upheld.

[monster_truck]

What do you think the venn diagram looks like for people willing and able to find things like that prior to LLMs and also sell them to a broker, and are also stupid enough to flaunt a massive flashing "arrest me!!!" sign

Closest you're going to get is something like those kids in florida who just got wrapped for putting malware into steam games and draining peoples accounts. They were going to get caught anyways but it would have taken a lot longer to build a case against them if they weren't flaunting it on socials

[nickff]

Is this comment pure speculation, or do you have knowledge (or anecdotal evidence) of a similar exploit being sold for $500k?

[monster_truck]

I can't answer that, did you have something you'd like to sell?

[trollbridge]

"People paid $5,000 for a Macintosh computer when they were new. I found one at a yard sale for $25."

[sgerenser]

Pre-1990s Macs (Mac Plus, SE, etc.) in good condition are actually worth a decent amount nowadays as collectors items. Not $5000, but quite a bit more than $25.

[grugq]

this is the most accurate summary.

[trollbridge]

I actually found a 1999 iMac set out for a special rubbish pick up day. The owner of the house was there so I chatted a bit, asked her if she minded if I took it.

It had last been booted on it, complete with working hard drive an; MacOS X 10.3. So $1.299 -> $0.

[SoftTalker]

That's just typical for computer hardware though. Depreciation is 3-5 years normally, after which it's considered worthless.

[dang]

Ok, we've taken $500k out of the title above.

[nativeit]

> modified like they are holy scripture

So never modified at all, even if plainly contradictory and/or ethically and morally compromised?