Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsAnalysed#3893632	Valid	Access Control	Medium	2026-09-28	–	51
Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`Analysed#3931777	Valid	File and Path Handling	Critical	2026-08-28	–	48
WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE#3923967	Valid	Command and Code Injection	High	2026-10-21	–	37
CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content#4043537	Valid	Authentication	Medium	2026-10-30	–	36
Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`#3931771	Valid	Cross-site Scripting	Critical	2026-08-28	–	32
wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list#3933198	Valid	Open Redirect	Medium	2026-10-30	–	31
Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields#4152553	Valid	Information Disclosure	High	2026-11-05	–	27
Information Disclosure - Unauthen Leak Private Content#4053546	Valid	Information Disclosure	Medium	2026-10-10	–	27
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles#3942522	Valid	Access Control	High	2026-11-05	–	24
WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses#4029867	Valid	Access Control	Medium	2026-11-05	–	23
Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint#3801107	Valid	Access Control	Critical	2026-10-12	–	23
Large-site Quick Edit reparses a Contributor display name into active HTML#3878399	Valid	Cross-site Scripting	Medium	2026-10-21	–	20
Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order#3941626	Valid	Access Control	High	2026-11-05	–	17
Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports#3871816	Valid	Access Control	High	2026-11-05	–	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,190 analysed so far), which can be wrong. Data as of 2026-11-15.