News for hackers. Stuff that matters.

A comment on Unpatched WordPress vulnerability allows code execution for authors. Parent comment

Re:Unpatched WordPress vulnerability allows code execution f... by griffinmb on Tuesday June 26, 2018 @03:38PM (#17403423)
It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
[ Parent | on HN ]
Re:Unpatched WordPress vulnerability allows code execution f... by prophesi on Tuesday June 26, 2018 @04:01PM (#17403570)
The unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it.

It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines

(I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)

[ Parent | on HN ]