A WordPress RCE Was Found Using GPT-5 for Under $30

Exploit brokers price WordPress RCEs at around $500,000. A researcher found one using GPT-5 and roughly $25 in API spend.

The implication is direct: AI-assisted vulnerability research is no longer a force multiplier for well-funded teams. It is now accessible to a single person with a credit card and a prompt chain.

The researcher's approach treats the LLM as a code auditor rather than a co-pilot. Feed it plugin source, ask it to reason about untrusted input paths, follow up on suspicious call chains. GPT-5's improved reasoning over prior generations means it can hold enough context to trace a vulnerability across files and function calls without losing the thread. That capability gap — from GPT-4-class to GPT-5-class — appears to be the delta that made this practical.

For defenders, this changes the threat model in a concrete way. Assume that any sufficiently motivated attacker with minimal budget can now audit popular plugins and themes at a pace that outstrips manual patching cycles. The attack surface of the WordPress ecosystem — tens of thousands of plugins, many maintained by solo developers — becomes materially more dangerous when AI audit costs approach zero.

For builders shipping products on top of WordPress or any large PHP codebase, the takeaway is to treat your own code the same way: run it through current-generation reasoning models as part of your security review before attackers do. The cost is negligible. The alternative is being on the wrong side of this asymmetry.

The broader pattern here is not specific to WordPress. Any language, any codebase, any ecosystem with a large plugin surface is subject to the same economics. The cost of finding high-severity bugs just dropped by several orders of magnitude.

Source