Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege Escalation via REST API to Administrator leads to RCE#1107282	Valid	Access Control	–	2021-05-17	–	92
Mssing Authorization on Private Message replies (BuddyPress)#490782	Valid	Access Control	–	2019-03-08	–	66
Pivilege escalation of any new user to Keymaster caused by CSRF#2999394	Valid	Access Control	Medium	2025-09-13	–	61
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations#3893632	Valid	Access Control	Medium	2026-09-28	–	51
Add users to groups who have restricted group invites#538008	Valid	Access Control	–	2019-07-27	–	32
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles#3942522	Valid	Access Control	High	2026-11-05	–	24
WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses#4029867	Valid	Access Control	Medium	2026-11-05	–	23
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint#3801107	Valid	Access Control	Critical	2026-10-12	–	23
Content Spoofing @ https://irclogs.wordpress.org/#278151	Valid	Access Control	–	2017-12-04	–	22
Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order#3941626	Valid	Access Control	High	2026-11-05	–	17
Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports#3871816	Valid	Access Control	High	2026-11-05	–	16
Improper Access Control in Buddypress core allows reply,delete any user's activity#837256	Valid	Access Control	–	2020-05-22	–	12
[support.wordcamp.org] - publicly accessible .svn repository#309714	Valid	Access Control	–	2018-02-01	–	12
Allow authenticated users can edit, trash,and add new in BuddyPress Emails function#833782	Valid	Access Control	–	2020-05-22	–	8
Unauthenticated hidden groups disclosure via Ajax groups search#282176	Valid	Access Control	–	2017-11-02	–	6

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.