HackerOne Disclosed Reports - 2026-11-05

High
resolved

Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields

Bug reported by 0x200 was disclosed at November 5, 2026, 7:56 pm   |   Information Disclosure

A vulnerability was discovered in a WordPress plugin's reference field functionality that allowed unauthenticated users to access non-public post content through a permission bypass. The issue existed in the post retrieval function, which did not enforce read permission checks when retrieving posts with any status, including private, draft, and password-protected posts. Sensitive post data including full content, excerpts, author information, timestamps, and plaintext passwords were exposed to unauthorized users. The vulnerability affected multiple code paths including render functions and JSON-LD formatters. An attacker could submit multiple post IDs in a single request to exfiltrate bulk unpublished content at scale due to the absence of pagination limits.

Medium
resolved

WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names, user IDs, profile information, and comment details for password-protected events. The vulnerability was caused by the wrapper route using a permission callback that always returned true without checking password requirements.

High
resolved

wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A privilege escalation vulnerability was found in a wordpress.org custom mu-plugin used on locale team sites. The vulnerability allowed authenticated editors to assign the administrator role to users during the account invitation process, despite administrator being explicitly removed from the editable roles list. The role parameter was accepted directly from user input without validation against the permitted roles before the invitation was stored. When the invitation was accepted, the stored role was applied without re-validation, resulting in unauthorized administrator access being granted. The issue affected the invite persistence mechanism which failed to enforce role restrictions that were properly implemented elsewhere in the codebase.

High
resolved

Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 2:18 pm   |   Improper Access Control - Generic

A payment binding vulnerability was identified in the Instamojo payment gateway addon for a ticketing system. The gateway failed to verify and bind Instamojo payments to specific ticket orders. Three attack paths were present: a draft order could be marked pending using only a payment token without Instamojo API verification, invalid webhook signatures were accepted and still marked orders as pending instead of rejecting them, and valid webhooks with credit status could complete orders without verifying the payment matched the order amount. The issue was noted as a logic error at the payment boundary that was not present in similar payment gateway implementations within the same codebase.

High
resolved

Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports

Bug reported by 0xBS0D27 was disclosed at November 5, 2026, 1:59 pm   |   Improper Access Control - Generic

A broken authorization check in a WordCamp plugin allowed unauthenticated attackers to export a private CSV file containing organizer personally identifiable information. The vulnerability was caused by an inverted logic operator in the security gate that verified nonce validity and user capabilities, resulting in the protection being bypassed for users without authentication or valid nonces. The exported data included email addresses, physical addresses, messaging handles, usernames, and notes.

Medium
resolved

CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching

Bug reported by Robin was disclosed at November 5, 2026, 9:51 am   |   Uncontrolled Resource Consumption

A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, the discovery function performed on the order of N squared fnmatch operations. This was caused by bucket-scanning logic that was repeated once per discovered result rather than being performed once per mask. The vulnerability affected properties-style and JSON file backends but not Gettext format files. The inefficiency persisted even when discovery produced zero results, making pre-filtering ineffective as a mitigation. Processing 4,000 files took approximately 11 seconds of CPU time, while 8,000 files required around 46 seconds. The vulnerability was exploitable through the library's public discovery interface when integrated into web applications that executed the discovery process synchronously within request handling.