3 ms·

This looks a lot like a 0day exploit posted to get traffic and exposure for their startup.

• slacka 9y ago
  No, this was because WP security team ignored this issue. From the article: > This issue has been reported to WordPress security team multiple times with the first report sent back in July 2016. It was reported both directly via security contact email, as well as via HackerOne website. > As there has been no progress in this case , this advisory is finally released to the public without an official patch (0day).
  • gibrown 9y ago
    > ignored this issue I'm not sure the author would necessarily know that this is true. The author also didn't say whether they informed WP Core that they were going to publish it. Per the "revision history" the notes about a report sent in 2016 was added after initial publication ("Updated 'solution' section to clarify and highlight numerous resolution attempts"). So it isn't clear to me that communicating the exploit to the team was the top priority. Regardless of the circumstances though, publishing it seems quite clearly tied to the promotion of their business. That's not necessarily bad assuming they were responsible in how they communicated the issue. I am admittedly reading tea leaves and just questioning whether this is the full story.