[dcrazy]

Aren’t WP exploits valuable for watering hole attacks?

[strictnein]

You don't need an RCE for that though. There's a lot of vulnerable plugins deployed everywhere.

[dcrazy]

Ok, but an RCE in WP Core still seems pretty dang valuable, especially if you want to hit non-commercial websites that are less likely to have as many plugins installed?

[illliillll]

You already owned the WordPress admin with your browser 0day, you don’t care if WordPress is secure or not.