Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282	Valid	Access Control	High	2021-05-17	–	92
Mssing Authorization on Private Message replies (BuddyPress)Analysed#490782	Valid	Access Control	Low	2019-03-08	–	66
Pivilege escalation of any new user to Keymaster caused by CSRFAnalysed#2999394	Valid	Access Control	Medium	2025-09-13	–	61
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsAnalysed#3893632	Valid	Access Control	Medium	2026-09-28	–	51
Add users to groups who have restricted group invitesAnalysed#538008	Valid	Access Control	High	2019-07-27	–	32
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesAnalysed#3942522	Valid	Access Control	High	2026-11-05	–	24
WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responsesAnalysed#4029867	Valid	Access Control	Medium	2026-11-05	–	23
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpointAnalysed#3801107	Valid	Access Control	Critical	2026-10-12	–	23
Content Spoofing @ https://irclogs.wordpress.org/Analysed#278151	Valid	Access Control	Low	2017-12-04	–	22
Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to orderAnalysed#3941626	Valid	Access Control	High	2026-11-05	–	17
Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp ReportsAnalysed#3871816	Valid	Access Control	High	2026-11-05	–	16
Improper Access Control in Buddypress core allows reply,delete any user's activity#837256	Valid	Access Control	Medium	2020-05-22	–	12
[support.wordcamp.org] - publicly accessible .svn repository#309714	Valid	Access Control	None	2018-02-01	–	12
Allow authenticated users can edit, trash,and add new in BuddyPress Emails function#833782	Valid	Access Control	Medium	2020-05-22	–	8
Unauthenticated hidden groups disclosure via Ajax groups search#282176	Valid	Access Control	Medium	2017-11-02	–	6

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.