Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`Analysed#3931777	Valid	File and Path Handling	Critical	2026-08-28	–	48
WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCEAnalysed#3923967	Valid	Command and Code Injection	High	2026-10-21	–	37
Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`Analysed#3931771	Valid	Cross-site Scripting	Critical	2026-08-28	–	32
Information Disclosure - Unauthen Leak Private ContentAnalysed#4053546	Valid	Information Disclosure	Medium	2026-10-10	–	27
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesAnalysed#3942522	Valid	Access Control	High	2026-11-05	–	24
Large-site Quick Edit reparses a Contributor display name into active HTMLAnalysed#3878399	Valid	Cross-site Scripting	Medium	2026-10-21	–	20

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.