Re:Unpatched WordPress vulnerability allows code execution f...
by griffinmb on Tuesday June 26, 2018 @03:38PM
(#17403423)
It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
Re:Unpatched WordPress vulnerability allows code execution f...
by prophesi on Tuesday June 26, 2018 @04:01PM
(#17403570)
The unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it.
It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines
(I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)
RIPS could have at least waited one more month. It sounds like Wordpress gave their HackerOne extension deadline.
Also, lots of typos and bad wording in the article makes it look even less professional. For instance, if I didn't know the context, the following sentence makes absolutely no sense:
"The value of $_POST[‘thumb’] could hold the, to the WordPress upload directory relative, path of any file, and when the attachement gets deleted, the file will get deleted with it as seen in the first listing."