Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Pivilege escalation of any new user to Keymaster caused by CSRFAnalysed#2999394 | Valid | Access Control | Medium | 2025-09-13 | – | 61 |
| Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsAnalysed#3893632 | Valid | Access Control | Medium | 2026-09-28 | – | 51 |
| WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responsesAnalysed#4029867 | Valid | Access Control | Medium | 2026-11-05 | – | 23 |
| Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpointAnalysed#3801107 | Valid | Access Control | Critical | 2026-10-12 | – | 23 |
| Content Spoofing @ https://irclogs.wordpress.org/Analysed#278151 | Valid | Access Control | Low | 2017-12-04 | – | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.