GPT-o3 Found a WordPress RCE Vulnerability for $25 in API Costs

Exploit brokers pay into the hundreds of thousands of dollars for reliable WordPress RCE chains. The researcher behind the writeup found one using GPT-based tooling and a modest API budget.

The core claim is straightforward: a capable frontier model, given the right scaffolding and a target codebase, can surface exploitable code paths that previously required a skilled human researcher investing significant time. The cost asymmetry is the story. Broker payouts in this vulnerability class sit around $500,000. The compute cost to find the flaw sits around $25.

This has direct implications for how defenders think about attack economics. If the marginal cost of discovery collapses, the volume of discovered vulnerabilities in widely-deployed software increases. WordPress powers a large share of the web. RCE in that surface area is not an academic concern.

For engineers building on or extending WordPress, the practical response is narrower than it sounds. The model found what static analysis and human auditors missed, which means existing review pipelines have a gap. Adding LLM-assisted code review to CI is no longer a nice-to-have on projects where security posture matters.

For AI tooling builders, the writeup is a concrete benchmark. It demonstrates that current model capability, without fine-tuning or specialized agents, is sufficient to perform meaningful vulnerability research on real-world codebases. The researcher used an off-the-shelf model with a relatively minimal prompt and scaffolding investment.

The broader shift is that offensive security work is getting cheaper faster than defensive tooling is scaling. Blue teams adopting the same models for automated code review is the logical counterweight, but adoption is uneven. The gap between what attackers can now do cheaply and what most organizations actively scan for is real and growing.

Source