66 ms·
"2018/01/24: The WordPress security team estimates the time to fix to be 6 months." RIPS could have at least waited one more month. It sounds like Wordpress ga
by prophesi 8y ago
"2018/01/24: The WordPress security team estimates the time to fix to be 6 months."
RIPS could have at least waited one more month. It sounds like Wordpress gave their HackerOne extension deadline.
Also, lots of typos and bad wording in the article makes it look even less professional. For instance, if I didn't know the context, the following sentence makes absolutely no sense:
"The value of $_POST[‘thumb’] could hold the, to the WordPress upload directory relative, path of any file, and when the attachement gets deleted, the file will get deleted with it as seen in the first listing."
- griffinmb 8y agoIt has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
- prophesi 8y agoThe unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it. It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines https://www.hackerone.com/disclosure-guidelines (I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)