Exploit brokers pay up to $500k for WordPress RCE bugs

Exploit brokers are offering up to $500,000 for remote code execution (RCE) vulnerabilities in WordPress, according to SLCyber’s market analysis [SLCyber]. The lucrative payouts have prompted a surge of researchers to target the platform’s codebase.

What was discovered

An independent researcher disclosed that, after spending $25 on API calls to the language model GPT‑5.6, they identified a previously unknown RCE flaw in WordPress core. The vulnerability allows an attacker to execute arbitrary code on a compromised site, a capability that aligns with the high‑value criteria set by exploit brokers.

Why it matters

The $500,000 bounty demonstrates that the exploit market can shape research priorities, steering talent toward high‑impact bugs rather than routine security work. The successful use of GPT‑5.6 shows that advanced AI models are now practical tools for vulnerability discovery, lowering the cost barrier for finding sophisticated flaws. Because WordPress powers roughly 40% of all websites, any RCE vulnerability in its core can affect millions of sites, amplifying the potential damage if such exploits fall into malicious hands.

Implications for defenders

Organizations running WordPress should treat the increased financial incentive as a signal to tighten defenses: prioritize timely patching, employ comprehensive application‑layer firewalls, and consider AI‑assisted scanning to surface hidden weaknesses before brokers can monetize them.