The surprising (and possibly untrue) thing is the high price of canned vulnerabilities. WordPress is known as the remote root shell with a blogging feature.

▲ denysvitali a day ago | parent | next [-]

I still don't understand why, for a blog, a static page isn't enough - especially since most of the WordPress issues are "solved" by adding caching.

I do understand it from an user perspective (it's easier to tell the average user to drag and drop rather than committing to a GitHub repo and letting hugo build the website), but from a security standpoint WordPress is really just waiting for a vulnerability (either in the core or on the thousands of plugins) in order to unlock its RCE-as-a-service functionality.

▲

muvlon a day ago | parent | next [-]

In many deployments, Wordpress started out as just a blog that is easy to edit right from the web browser, but then grew into way more. Most commonly, people end up retrofitting all kinds of e-commerce features onto it, and that's how you really get into the whole plugin mess. At that point, for better or worse, the Wordpress instance is serving important business needs that are not addressed by a static page.

	▲	marysol5 a day ago \| parent [-]
		It went from a blog, to an entire CMS. Which is bonkers

▲

CM30 a day ago | parent | prev | next [-]

People like having a WYSIWYG editor, being able to update their posts in the browser, having comments and being able to use plugins. They're also not particularly skilled with the terminal/commands, and a lot of hosts provide a one-click install setup for scripts like WordPress.

▲

mewpmewp2 a day ago | parent | prev | next [-]

Like you said. It is a product for people who are not technical and don't code. A product that you would have to use git for, wouldn't be used by the 90 percent in the first place. And there are such products. There is a reason WordPress is the most popular platform. Most people are not technical.

And people like to be able to extend from Blogs to various other non static features which WordPress allows for.

	▲	thenthenthen a day ago \| parent [-]
		Its so funny… our wordpress started off as simple blogging thing but now is not only using 99% cpu but also no one knows how to edit/deal with all the plugins etc. Wordpress is the worst choice. Always

▲

acomjean a day ago | parent | prev | next [-]

The non-profit I help with moved to Wordpress so people can edit the site without having to use git. (We have a lot more editors now)..

▲

1123581321 a day ago | parent | prev | next [-]

- Anyone can edit it

- Less training; org probably has someone who’s used Wordpress before. (Yes, training. You must deal with the reality of the typical user.)

- In the developing group or agency, anyone can work on the theme if you install a theme builder. An agency can put a cheaper content marketer or designer on it, rather than a developer.

▲

pwillia7 a day ago | parent | prev [-]

WPE tried to make Faust.js a thing so you could use WP CMS but generate a modern static site but I don't think it really took off much

▲ gorszon a day ago | parent | prev | next [-]

Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

	▲	blauditore a day ago \| parent [-]
		...or was just looking for a clickbait title. Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.

▲ slim a day ago | parent | prev | next [-]

  WordPress is one of the most hardened targets of all time

that obsolete code did not change for decades. all the bugs have been discovered and patched

▲ lyu07282 a day ago | parent | prev [-]

some statistics point to almost 50% of all websites on the internet running on Wordpress, $500k for an undisclosed 0day unauthenticated RCE doesn't seem so unrealistic to me

	▲	addedlovely a day ago \| parent [-]
		I've got it at 38.32%. I'm looking at the 'front-door' of the web, active sites, no subdomains, from Crux user experience data. Will be publishing a report on www.theweb.report soon - if you're interested. That's a seed of about 13 million domains - pretty sure WordPress would be dominating the even longer tail. ( Also worth noting it's sooo easy to detect a site is WordPress, it screams it across every signal we gather, where-as some sites are just well made and have limited information leaks ).