Landed my first CVE !! (in a plugin with 600k+ installs) after months of mostly dead ends. Sharing the actual process, not just the win.
CVE-2026-84741, in The Events Calendar (WordPress, 600,000+ active installs). Wanted to share this here because most CVE hunting content online skips the part that actually matters, the failures...
The bug, in one line:
a broken access control issue where non-public venue and organizer data was exposed through the REST API to unauthenticated users. CWE-200, CVSS 5.3. Not glamorous. Real, and confirmed independently by the vendorr, but not an RCE or a headline bug.
What actually got me here, since that's the part worth sharing:
This came after weeks of hunting smaller WordPress plugins first, mostly ones with under 10,000 installs, specifically to avoid competition while I built up the discipline: always live verify before writing anything, always trace a claimed vulnerability all the way to the actual database write or output before believing it, always check the full advisory history before assuming something is undiscovered.
2 submissions before this one got rejected as duplicates. One was a real, independently confirmed bug, lost purely because another researcher submitted it hours or days earlier. That one stung, but the rejection email itself confirmed my analysis was correct, just not first. I also had a lead on a much bigger plugin that looked like a critical unauthenticated data write, spent real time on it, and it turned out to be a false positive once I traced the actual code path. Writing that up as dead was more valuable long term than getting excited too early would have been.
Eventually I applied the same instinct, checking whether a sibling code path enforces the same access check its counterpart already does, to a much bigger target instead of another small plugin. That's what found this one.
Why I'm posting this specifically here:
If you're starting out and every plugin you touch turns out already patched or out of scope, that's not a sign you're bad at this. It took me a real string of dead ends before the process actually clicked. Happy to answer questions about methodology, duplicate handling, or how I picked targets.
[link] [comments]
from hacking: security in practice https://ift.tt/fHOjQWs
Comments
Post a Comment