WordPress · disclosed reports
Access Control
15 disclosed reports · $0 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open WordPress on HackerOne- reports
- 15
- paid a bounty
- 0
Every one of the 15 is a mark on the map. Named now: 1 to 15, most upvoted first.
- Privilege Escalation via REST API to Administrator leads to RCE
- Mssing Authorization on Private Message replies (BuddyPress)
- Pivilege escalation of any new user to Keymaster caused by CSRF
- Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations
- Add users to groups who have restricted group invites
- wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles
- WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses
- Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
- Content Spoofing @ https://irclogs.wordpress.org/
- Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order
- Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports
- Improper Access Control in Buddypress core allows reply,delete any user's activity
- [support.wordcamp.org] - publicly accessible .svn repository
- Allow authenticated users can edit, trash,and add new in BuddyPress Emails function
- Unauthenticated hidden groups disclosure via Ajax groups search
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.