WordPress · Report #428019
CSRF to HTML Injection in Comments
Validstatus
highseverity
95upvotes
13 May 2019disclosed
Summary
Simon discovered a CSRF vulnerability that led to RCE. More details are available on the RIPS blog.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.