# Exploit Brokers Pay $500,000 for a WordPress RCE > [!question] Lingering Questions > - Do other WordPress REST batch/bulk endpoints share the validate-then-execute-in-separate-loops pattern that produced this bug? > - How does the cited ~$500k exploit-broker valuation compare to WordPress's own bug bounty payouts for equivalent severity? > [!tip] Article Ideas > - none beyond the fleeting-queue items above — this is primarily a technical case study, not an article seed > [!link] Cross Reference > - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — a concrete instance of AI-assisted vulnerability research finding a real pre-auth RCE chain > - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — the Permanent note already promoted from this same source in a prior pass > [!quote] Vocabulary > - **Sol Ultra** — the long-running, multi-agent GPT-5.6 configuration used for this research, run at up to four parallel agents with mandatory adversarial cross-checking ## Bib capsule Adam Kues, "Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25," Searchlight Cyber Research Center, 2026 — https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/ ## Author's thesis (Adler Q1+Q2) A Searchlight Cyber researcher pointed a long-running, multi-agent GPT-5.6 "Sol Ultra" session at a stripped-down WordPress source tree (no git history, no changelogs, no internet diffing) and asked it to find a pre-auth-to-RCE chain over roughly 6+ hours. The model found a real, previously unknown pre-authentication SQL injection in the WordPress REST Batch API (introduced WP 5.6, 2020), then independently escalated that read-only SQLi to full administrator takeover and remote code execution. A ~$25 (pro-rated) AI research run surfaced a chain worth an estimated $500,000 on the exploit-broker market — a data point that frontier LLMs can now do sustained, creative, multi-step vulnerability research the author says would have been implausible for a human team in the same timeframe. ## Key arguments (≤3) 1. **The root cause is an architectural desync, not a missing check** — the Batch API's two-loop handler updates a validation array in one place but not the matching execution array, letting any batch-enabled endpoint's sanitization be swapped for a different route's (lack of) validation. 2. **Type assumptions in sanitizers are exploitable when an upstream bug can violate them** — the `author__not_in` array-vs-scalar branch assumes an array; a scalar string skips `absint()` sanitization entirely and gets interpolated raw into SQL. 3. **Per-request object caching turns a read-only SQLi into a state-mutation primitive** — cached `WP_Post` objects populated from the SQLi's UNION-injected rows give the attacker control over data that later reconciliation logic treats as authoritative. ## Claim atoms ### Batch API desync separates validation from execution arrays > [!quote] > the $validation array is updated, but because of the continue;, the matches array isn't updated! **Where/why**: Found in "The Bug," describing `class-wp-rest-server.php`'s two-loop batch handler. Root cause of the whole chain — any batch-enabled endpoint's parameter sanitization can be swapped for a different route's. #xref ### Scalar author_exclude values skip absint sanitization entirely > [!quote] > providing a scalar string such as "foobar" will just get interpolated directly into the raw SQL query with no escaping. **Where/why**: Found in "The Sink" — the `author__not_in` array-vs-scalar branch in the posts query builder. Shows why array-only type assumptions in a sanitizer are dangerous when an upstream bug can hand it a scalar instead. #xref ### Cache poisoning grants full control over cached post data > [!quote] > Since these posts will be cached, we have an extraordinary amount of control over the data that gets cached about the post. **Where/why**: Found in "The Cache" — the per-request `WP_Post` object cache populated from the SQLi's UNION-injected rows. The pivot that turns a read-only SQLi into a state-mutation primitive. #xref ## Permanent candidates - **Multi-agent adversarial search outperforms single-pass exploit hunting** — already promoted to [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] in a prior pass. Not re-created; connecting instead. - **Validate-then-execute array desync is a distinct exploitable pattern from cache poisoning** — not yet captured as its own Permanent note. Promoted below. ## Processing checklist - [ ] Check other WordPress REST batch endpoints for the same validate/execute desync pattern - [ ] Compare exploit-broker pricing to WordPress core bug bounty payouts - [x] Connect into the relevant MOC — [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] ## Links - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — a concrete AI-assisted pre-auth-to-RCE chain in WordPress core - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — the Permanent note this source already produced - [[3. Resources/Readwise/Articles/Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25]] — source document