Forum Thread: Should I Tell Wordpress About a 0day?

If it is in fact a vulnerability (and not a false-positive), you should most definitely turn it in. I don't know what kind of bug bounty program Wordpress does, but it should qualify.

Whoa... black-hat.

Publishing it is not blackhat.

Publishing as in telling Wordpress about it? That's not what it sounded like. Again, mis-communication.

Publish the 0 day.

ghost_

I never thought you wanted Null-Byte to be a database of exploits. I have a couple to post if you are interested. I've worked with the developers on some so there not 0-day anymore (but still plunty sites not updated), others the developers just ignored the issue.

I thought of posting it here, but I am skeptical.

You are skeptical? I am in complete doubt... This wouldn't happen to be the 0day from last week that got patched 3 hours later by Wordpress?

I'm skeptical of "your" finding.

No. I am skeptical about that if I publish a 0day, that can be used to perpetrate multiple Wordpress websites, I can get in trouble. I will report the Wordpress 0day, then I will post it here, afterwards, you can use it on any website you want and hope they haven't updated.

Isn't that quite counter-intuitive...?

If I were you I would report it to wordpress, then wait. If they don' get back to you, publish it publicly to raise awareness and force them to patch it.

Publish or sell.
We are all right :P

I contacted them yesterday, I am waiting for reply.. If they don't reply, I'm publishing it.

Well let's all hope that Wordpress doesn't respond.

Publish it to googles 0day tracking, contact wordpress (if its legit and a true unknown flaw you could end up likely getting paid for finding it see as how big of an impact on the web wordpress seems to have right now.

He didn't find it. He stole it.

He has nothing to publish. He has 0 0days! Tell me about that RFI Guide again...

Lol. I love how you reply to something you know nothing about. The RFI is something simple I did as my 1st tutorial. And, I have 3 0days. All found by I and my team. Thanks.

What team? You are just a script kiddie stealing tutorials from other websites. I can give the exact link to the tutorial you stole.

'His RFI tutorial was copied from Security Exploded's site.' = Deleted
Of course you do.

Biggest crap I've ever heard. I didn't delete anything, nor copy pasted.

Oh, really? Then why did the mods delete it after I found the EXACT same tutorial on Security Xploded?

LoL. Show me the link, please.

http://securityxploded.com/remote-file-inclusion.php

That URL is diffrent from mine. I read it. What did mine have that one had? Don't tell me you got it deleted because the URLs for the examples looked the same.

Nope, the content was the same. Read it and weep. You just changed the URLs and added some comments.

The principle of it.