An AI prompt found the WordPress bug exploit brokers pay $500,000 for (slcyber.io)
Kues adapted a prompt OpenAI built for math-olympiad problems and pointed it at WordPress's raw source with no hints. It found the REST batch endpoint validates and executes requests separately — a gap it used to slip a SQL injection into a live query, the start of a much longer chain.
One reader asked why bother with the rest of the chain: with SQL injection already in hand, why not just write an admin account straight into the database? Others went after the $500,000 figure itself, tracing the byline to a rival AI vulnerability-scanning shop.
Sign in to save