TLDR Tech / InfoSec
Exploit Brokers Pay $500,000 For A Wordpress Rce. I Found One With Gpt5.6 Sol Ultra And $25
A researcher used GPT5.6 Sol Ultra to find a pre-auth SQL injection in WordPress's batch API, abusing a validation desync and an unsafe author filter to gain database access. By chaining cache poisoning, embed handling, and customize_changeset posts, the attack escalates from SQLi to temporary admin privileges. It then abuses WordPress hooks, especially parse_request, to replay the batch request as admin and create a new administrator account, enabling plugin-based RCE on default WordPress installs.
Read the full story