HackerOne Disclosed Reports - 2026-10-21

High
resolved

WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE

Bug reported by mappymappy was disclosed at October 21, 2026, 8:04 pm   |   Code Injection

A race condition vulnerability was discovered in WordPress 7.1 that allowed authenticated users with Author role to achieve persistent arbitrary PHP execution. The vulnerability involved exploiting media finalization, URL-media sideload, and image post-processing flows to generate persistent image files with PHP extensions containing PHP code in image metadata. The issue was confirmed in WordPress 7.1 development versions from Beta 2 through RC2, but was not present in the current 7.0 branch. The vulnerability required a PHP-served writable temporary directory and successful exploitation of a race condition window between multiple REST API calls.

Medium
resolved

Large-site Quick Edit reparses a Contributor display name into active HTML

Bug reported by mappymappy was disclosed at October 21, 2026, 8:03 pm   |   Cross-site Scripting (XSS) - DOM

A stored cross-site scripting vulnerability was discovered in the Posts list Quick Edit feature on WordPress sites with more than 10,000 users. When an administrator opened a crafted URL and clicked Quick Edit on a pending post authored by a contributor, the contributor's entity-encoded display name was decoded and reparsed as active HTML through jQuery, allowing arbitrary JavaScript execution. This vulnerability was confirmed to enable the creation of unauthorized administrator accounts through automated exploitation.

Low
resolved

Cross-room signaling injection enabling unauthorized force-mute

Bug reported by AB was disclosed at October 21, 2026, 6:56 pm   |   Improper Authentication - Generic

A cross-room signaling injection vulnerability was identified in the Talk application that allowed a low-privileged participant to inject moderator-only internal-signaling control messages into a victim's session. The vulnerability exploited the fact that the server checked moderator permissions only against the sender's own room while queuing messages to arbitrary recipient session IDs based on room participant lists. The message delivery mechanism was keyed only by recipient session ID rather than by room, enabling an attacker in one room to send control messages such as force-mute commands to users in other rooms. The vulnerability was reproduced by sending a forceMute control from one room to an active victim in a separate room, which resulted in the client muting the affected user.