Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Mssing Authorization on Private Message replies (BuddyPress)Analysed#490782	Valid	Access Control	Low	2019-03-08	–	66
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsAnalysed#3893632	Valid	Access Control	Medium	2026-09-28	–	51
Add users to groups who have restricted group invitesAnalysed#538008	Valid	Access Control	High	2019-07-27	–	32
Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference FieldsAnalysed#4152553	Valid	Information Disclosure	High	2026-11-05	–	27
Information Disclosure - Unauthen Leak Private ContentAnalysed#4053546	Valid	Information Disclosure	Medium	2026-10-10	–	27
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesAnalysed#3942522	Valid	Access Control	High	2026-11-05	–	24
WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responsesAnalysed#4029867	Valid	Access Control	Medium	2026-11-05	–	23
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpointAnalysed#3801107	Valid	Access Control	Critical	2026-10-12	–	23
Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to orderAnalysed#3941626	Valid	Access Control	High	2026-11-05	–	17
PII of users can be downloaded from export pagesAnalysed#1172852	Valid	Information Disclosure	Medium	2023-05-12	–	17
Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp ReportsAnalysed#3871816	Valid	Access Control	High	2026-11-05	–	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.