← All posts

Tag

bug bounty

19 posts tagged with bug bounty.

2026-09-24bug bountyCVEWordPress9 min read

Finding CVEs in WordPress: CVE-2026-39531, SQL injection in WP Directory Kit

WP Directory Kit passed filter_ids through esc_sql() and inserted it unquoted into an IN clause. Quotes were never needed, so the escaping solved the wrong problem. How the bug worked across three sinks in two methods, why the public nonce did not make it authenticated, and how to find the same pattern.

2026-09-05bug bountyCVEWordPress8 min read

Finding CVEs in WordPress: CVE-2026-39513, exposed appointments in Easy Appointments

Easy Appointments registered a REST route with __return_true as its permission callback. One unauthenticated GET returned appointment rows and their custom fields. The vulnerable route, the fix, and a practical way to audit WordPress REST endpoints for the same mistake.

2026-08-21reconbug bountypentesting6 min read

Nobody opens the documents

Everybody reads the JavaScript now. Almost nobody opens the PDFs, the spreadsheets and the decks a target publishes on purpose, and those carry staff names, internal paths, printer queues and database connection strings.

2026-07-23bug bountypentestingweb security4 min read

Why I ask for two accounts per role

Finding an IDOR with one account is the easy half. Confirming it is where one account falls apart. Two accounts at the same level turn an identifier you cannot explain into user A retrieved user B's invoice.

2026-05-12bug bountyCVEWordPress10 min read

Finding CVEs in WordPress: CVE-2026-39534, missing authorisation in WP Directory Kit

CVE-2026-39534 was a custom-MVC dispatcher in WP Directory Kit that took a method name from POST and called it. No authentication, no nonce, no model allowlist. POST a model name, get the rows back. How the dispatcher pattern hides this class of bug and a checklist to find it in any plugin that ships its own MVC.

2026-05-07bug bountyCVEWordPress11 min read

Finding CVEs in WordPress: CVE-2026-39511, SQL injection in WP Photo Album Plus

CVE-2026-39511 was an unauthenticated SQL injection in the WP Photo Album Plus plugin. The query went through wpdb::prepare() correctly and then through stripslashes() right after, deleting the very escapes prepare() had just added. How the anti-pattern works, the exploitable payload and a checklist to grep your own plugin source for the same shape.

2026-04-27bug bountyreconweb security7 min read

The first thirty minutes on a new API

The JavaScript bundle gave you the frontend's idea of the API. The six steps below give you the backend's reality. Version probing, method expansion, parameter discovery, auth boundary checks, response signal.

2026-04-21bug bountyweb securityrecon7 min read

The first ten minutes on a new JavaScript bundle

Opening a stranger's bundled JavaScript for the first time. What I grep for, in what order and why. A practical follow-up to why you should not skip JS files at all.

2026-04-20bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-4392, stored XSS in Shared Files

CVE-2025-4392 was an unauthenticated stored XSS in the Shared Files plugin. A sanitizer that only ran for SVGs and silently passed everything else through. How the gate made the function's name a lie, and a checklist to grep your own plugin source for the same pattern.

2026-04-18bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-3769, IDOR in LatePoint

A walkthrough of CVE-2025-3769, an IDOR in the LatePoint plugin that exposed customer data from about 100K WordPress sites. How I found it, the code-review pattern behind it and a checklist for auditing WordPress plugins yourself.

2026-03-08bug bountypentestingmindset4 min read

Your scope protects from findings, not from attackers

Attackers don't follow your scope. Limited bug bounty programs protect you from findings while leaving your real attack surface wide open. Here's why wide scopes and recon matter.

2026-02-27bug bountypentestingrecon4 min read

Go wide before you go deep

The best vulnerabilities aren't on the main domain. Here's why wildcard scopes beat limited ones and how going wide leads to the findings that actually matter.

2026-02-26bug bountyweb securityrecon4 min read

Stop skipping JavaScript files

Running automated scans while ignoring JavaScript files means missing the real gold. Here's how reading JS files led to full admin access on a HackerOne target.

2026-02-13pentestingbug bountymindset3 min read

Know your audience: translating technical findings into business impact

Technical expertise matters, but if you want your findings fixed, you need to speak your audience's language. Here's how to translate security issues into business decisions.

2026-01-12bug bountyweb securitySSRF4 min read

DNS rebinding: turning blocked SSRF into internal access

How a well-timed DNS change can bypass SSRF filters and turn a blocked vulnerability into full internal network access.

2025-11-26bug bountypentestingweb security2 min read

The uppercase letter that bypassed authorization

Sometimes a single case change in a URL path is enough to bypass 401/403 errors. Here's why this edge case works and when to test for it.

2025-02-04bug bountyreconRCE4 min read

The RCE hidden behind a forgotten endpoint

A development endpoint that shouldn't exist led to full remote code execution. Here's how thinking about impact turned one finding into a critical chain.

2025-01-14bug bountyweb securitySQLi3 min read

The single quote that leaked database credentials

One character in a URL parameter exposed full database credentials and turned into a $2,000 double critical finding. Here's what happened.

2024-06-28bug bountycareermindset3 min read

What 8 years of bug bounty taught me about burnout

Bug bounty can drain you if you approach it wrong. After 8 years and 1,000+ vulnerabilities, here's what actually matters to avoid burning out.