HackerOne Disclosed Reports - 2026-10-11

Critical
resolved

Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint

Bug reported by Winston Crooker was disclosed at October 12, 2026, 6:53 am   |   Improper Access Control - Generic

A forum plugin version 2.7.0 registered post types with REST API exposure without enforcing the same access restrictions applied on other platforms. Private and hidden forum topics and replies were stored with public status, and forum visibility was only enforced through query filters that were bypassed by direct REST API single-item requests. Unauthenticated attackers could retrieve the full content of restricted forum posts by making direct REST API calls with sequential post identifiers. The vulnerability was not present in the previous release line, which did not expose these post types to the REST API.

Medium
resolved

Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parser

Bug reported by davinci was disclosed at October 11, 2026, 12:16 pm   |  

A server crash vulnerability was identified in the WKB GEOMETRYCOLLECTION parser of a database server. The parser employed unbounded recursion without depth limits or stack overflow checks when processing nested geometry collections, allowing crafted input with deeply nested structures to exhaust thread stack memory and trigger a denial of service condition. The vulnerability was confirmed through testing with nested geometry structures that caused server crashes. The issue affected spatial functions and geometry column operations accessible to authenticated users with low privileges. A fix was recommended through implementation of recursion depth guards or maximum nesting limits.