4 ms·

The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

gorszon 3mo ago
Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?
- blauditore 3mo ago
  ...or was just looking for a clickbait title. Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.
lyu07282 3mo ago
some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me
- addedlovely 3mo ago
  I've got it at 38.32%. I'm looking at the 'front-door' of the web, active sites, no subdomains, from Crux user experience data. Will be publishing a report on www.theweb.report soon - if you're interested. That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail. ( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).
denysvitali 3mo ago
I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.
- CM30 3mo ago
  People like having a WYSIWYG editor, being able to update their posts in the browser, having comments and being able to use plugins. They're also not particularly skilled with the terminal/commands, and a lot of hosts provide a one-click install setup for scripts like WordPress.
- mewpmewp2 3mo ago
  Like you said. It is a product for people who are not technical and don't code. A product that you would have to use git for, wouldn't be used by the 90 percent in the first place. And there are such products. There is a reason WordPress is the most popular platform. Most people are not technical. And people like to be able to extend from Blogs to various other non static features which WordPress allows for.
  - thenthenthen 3mo ago
    Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always
- acomjean 3mo ago
  The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..
- 1123581321 3mo ago
  - Anyone can edit it - Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.) - In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.
- muvlon 3mo ago
  In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.
slim 3mo ago
WordPress is one of the most hardened targets of all time that obsolete code did not change for decades. all the bugs have been discovered and patched

gorszon 3mo ago

Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

blauditore 3mo ago
...or was just looking for a clickbait title. Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.

lyu07282 3mo ago

some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me

addedlovely 3mo ago
I've got it at 38.32%. I'm looking at the 'front-door' of the web, active sites, no subdomains, from Crux user experience data. Will be publishing a report on www.theweb.report soon - if you're interested. That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail. ( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).

denysvitali 3mo ago

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching. I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

CM30 3mo ago
People like having a WYSIWYG editor, being able to update their posts in the browser, having comments and being able to use plugins. They're also not particularly skilled with the terminal/commands, and a lot of hosts provide a one-click install setup for scripts like WordPress.
mewpmewp2 3mo ago
Like you said. It is a product for people who are not technical and don't code. A product that you would have to use git for, wouldn't be used by the 90 percent in the first place. And there are such products. There is a reason WordPress is the most popular platform. Most people are not technical. And people like to be able to extend from Blogs to various other non static features which WordPress allows for.
- thenthenthen 3mo ago
  Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always
acomjean 3mo ago
The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..
1123581321 3mo ago
- Anyone can edit it - Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.) - In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.
muvlon 3mo ago
In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.

slim 3mo ago

WordPress is one of the most hardened targets of all time that obsolete code did not change for decades. all the bugs have been discovered and patched