2025-09-06 –, Rookie Track
From discovering a low-severity vulnerability during a code review, to fingerprinting bug bounty programs that use the plugin, resulting in a critical vulnerability by going deep — creating impact with research and perseverance.
I was working on a public Vulnerability Disclosure Program (VDP) where their main web application was utilising WordPress as their Content Management System (CMS). I used tools to enumerate the installed plugins and then conducted a code review on each one.
This code review turned out to be uninteresting, revealing an unauthenticated local file tree disclosure vulnerability in the plugin — not very impactful.
All hope was not lost when I discovered that other bug bounty programs utilised the same vulnerable plugin. In the end, it was identified that one public program had a critical vulnerability, it was possible to retrieve a backup of their WordPress database.
This talk will give a high-level overview of methodology, techniques, and a pretty cool story.
Harry is a security consultant with 3 years of experience. Prior to this, he did bug bounty, identifying impactful web vulnerabilities whilst self-teaching himself to become a penetration tester.