Oct 23, 2026, 12:12 AM@amy @mhoye well it's good that they've somewhat patched some of these things. the dismissive attitude i got when i reported it put me off pursuing it further, and to some extent my sites' survival depended on not being the easiest pickings, and their policy helped with that.
i guess if they patched it (eventually) perhaps my report *was* actually valid then hmm, whaddya know 🤔
am i allowed to be a bit smug about that, as a treat?
Oct 23, 2026, 12:19 AM@nflux@gts.exile.social @mhoye@cosocial.ca what's really interesting is i cannot see the patch in which they added these checks. the context flag "edit" has always existed since the feature was added
wonder if you had also some kind of auth bypass going on at the time lollll
https://github.com/WordPress/WordPress/blob/e4a7c0a397b07764999aae94f4bf1567ebf4a9d1/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L826
Oct 23, 2026, 12:45 AM@amy @mhoye i have no idea. i tested it on random sites periodically to which i had no access and it nearly always worked, both as a way of establishing "do these ppl im considering dealing with have their shit together" and also as a potential freebie to offer them by way of getting freelance work in a "did you realise all your stuff was exposed"-sorta way 🤷🏼♀️ (almost always no and no).