How a 50-Year-Old ‘Grandfather’ Hacker Bagged a High-Severity WordPress Core Vulnerability (Score 3) – Then Got It Closed as Duplicate: Full Technical Breakdown + Video

By /

Listen to this Post

Featured Image

Introduction:

WordPress powers over 40% of the web, making its core codebase a prime target for vulnerability researchers. When a security researcher submits a report and receives a CVSS score of 3 (High severity) only to see it closed as duplicate, it reveals both the robustness of bug bounty programs and the frustrations of parallel discovery. This article dissects the technical process behind finding a WordPress core flaw, explains how to validate duplicate reports, and provides actionable commands and code to audit your own WordPress instances.

Learning Objectives:

  • Understand how to perform a basic WordPress core security audit using open-source tools and manual code review.
  • Learn to identify common vulnerability patterns (SQLi, XSS, RCE) in WordPress hooks and AJAX endpoints.
  • Master the workflow for submitting bug reports, handling duplicate status, and extracting value from closed issues.

You Should Know:

1. Reconnaissance: Enumerating WordPress Version and Core Integrity

Step‑by‑step guide: Before diving into code, fingerprint the target WordPress installation to confirm it runs a potentially vulnerable core version. Use both passive and active methods.

Linux / macOS commands:

 Fetch WordPress version from readme.html or generator meta tag
curl -s https://target-site.com/readme.html | grep -i "Version"
curl -s https://target-site.com/wp-json/ | jq '.generator'

Use WPScan (requires API token) for thorough enumeration
wpscan --url https://target-site.com --api-token YOUR_TOKEN --enumerate vp,vt

Windows (PowerShell):

Invoke-WebRequest -Uri "https://target-site.com/readme.html" | Select-String "Version"
Invoke-WebRequest -Uri "https://target-site.com/wp-json/" | ConvertFrom-Json | Select-Object -ExpandProperty generator

This identifies the exact core version, which you then compare against the official WordPress Trac and CVE databases. A version mismatch or custom patching may indicate a potential zero-day.

  1. Manual Code Audit: Tracing Unsanitized User Input in WordPress Core
    Step‑by‑step guide: Download the same WordPress core version as the target. Focus on files that handle HTTP requests without nonce checks or proper sanitization – especially wp-includes/rest-api.php, wp-admin/admin-ajax.php, and wp-includes/comment.php.

Linux command to download and grep for risky functions:

wget https://wordpress.org/wordpress-6.4.2.tar.gz
tar -xzf wordpress-6.4.2.tar.gz
cd wordpress-6.4.2
grep -rnw . -e "<em>\$_GET" -e "</em>\$_POST" -e "eval(" -e "unserialize(" --include=".php"

Example vulnerable code pattern (simplified for training):

// In wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
$post_id = $_GET['id'];
$post = get_post($post_id);
echo $post->post_content; // No capability check, no sanitization

An attacker could craft `GET /wp-json/wp/v2/posts?id=1%20AND%201=1` leading to SQLi if `$post_id` is passed unsafely into $wpdb->prepare().

Testing the vulnerability manually:

 Check for reflected XSS via comment author URL
curl -X POST https://target-site.com/wp-comments-post.php \
-d "author=<script>alert(1)</script>&comment=test&[email protected]&comment_post_ID=1"

If the comment appears with the script unescaped, you have a stored XSS. Use this methodology to trace input from HTTP request to database and output.

  1. Duplicate Report Workflow: How to Verify and Leverage Closed Issues
    Step‑by‑step guide: When your report is marked duplicate (like the original post’s “closed with duplicate”), do not discard your research. Duplicates often share identical root causes but may uncover new attack surfaces or bypasses.

Steps to extract value:

  • Request the duplicate ticket ID from the triage team (if allowed). Study the original reporter’s PoC.
  • Compare their payload with yours – differences in encoding, request method, or parameter location can still qualify as a separate vulnerability.
  • Use the duplicate status to practice writing better reports. Many bug bounty programs (e.g., Wordfence, Patchstack) publicly disclose duplicates after patching.
  • Automate detection of similar patterns across other plugins or core files.

Command to search for similar patterns in your local WordPress copy:

 Find all occurrences of a function that was mishandled in the duplicate
grep -rnw . -e "wp_kses_post" -e "esc_url_raw" --include=".php" | grep -v "vendor"

If the duplicate involved improper esc_attr(), scan for every place `esc_attr()` is missing before output.

  1. Leveraging the CVSS Score 3 (High) – What It Means and How to Reproduce
    Step‑by‑step guide: A CVSS base score of 3 is considered Low severity in many standards? Wait – CVSS 3.x defines Low as 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0. The original post says “score 3 for High severity” – likely a typo or internal scoring. Assume they meant a severity rating of “High” with a CVSS score around 7-8. Clarify with the vendor. For educational purposes, here’s how to calculate and reproduce a real High severity WordPress flaw (e.g., unauthenticated SQLi in REST API).

Reproduction steps for a hypothetical High severity bug:

GET /wp-json/wp/v2/users?search=1%27%20AND%20(SELECT%20%20FROM%20(SELECT(SLEEP(5)))a)%20--%20-
Host: target-site.com

If response time delays >5 seconds, blind SQLi exists. Use `sqlmap` to confirm:

sqlmap -u "https://target-site.com/wp-json/wp/v2/users?search=1" --risk=3 --level=5 --dbms=mysql --batch

Mitigation: Patch by switching to prepared statements in wp-includes/wp-db.php. Example fix:

// Instead of: $wpdb->get_var("SELECT user_login FROM $wpdb->users WHERE ID = $id");
// Use: $wpdb->get_var($wpdb->prepare("SELECT user_login FROM $wpdb->users WHERE ID = %d", $id));

5. API Security and Cloud Hardening for WordPress

Step‑by‑step guide: Many WordPress core vulnerabilities now target REST API endpoints. Hardening your cloud-hosted WordPress involves disabling unused API routes and applying strict CORS policies.

Linux (NGINX) rule to block public access to /wp-json/wp/v2/users:

location ~ ^/wp-json/wp/v2/users {
deny all;
return 403;
}

Windows (IIS) via web.config:

<location path="wp-json/wp/v2/users">
<system.webServer>
<security>
<authorization>
<remove users="" roles="" verbs="" />
<add accessType="Deny" users="" />
</authorization>
</security>
</system.webServer>
</location>

Additionally, use a WAF (e.g., Cloudflare or ModSecurity) with rules to block SQLi and XSS patterns. Test with:

 Send malicious payload and monitor 403/406 responses
curl -X GET "https://target-site.com/wp-json/wp/v2/posts?filter=sleep(5)" -I

6. Training Courses to Master WordPress Bug Hunting

Step‑by‑step guide: Based on the original poster’s role at “ManggalaEdu Pusdatin Kemendikdasmen” (an Indonesian educational technology body), here are recommended free/paid courses to level up from duplicate reports to unique findings.

  • WordPress Security Course (WP Engine Academy) – Covers hardening, auditing, and responsible disclosure.
  • PentesterLab: WordPress – Hands-on exercises for SQLi, XSS, and file inclusion in core and plugins.
  • SANS SEC541: Defending WordPress – In-depth threat modeling and incident response.
  • PortSwigger Web Security Academy – Generic but excellent for learning API and server-side vulns applicable to WordPress.

Linux command to set up a local vulnerable WordPress for training (using Docker):

docker run --1ame vuln-wordpress -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=root -d wordpress:6.0  Known vulnerable version
docker exec -it vuln-wordpress /bin/bash
 Then modify core files to introduce intentional flaws (e.g., remove nonce checks)
  1. Automation: Script to Check for Duplicate Reports Across Bug Bounty Platforms
    Step‑by‑step guide: Avoid wasting time on duplicates by automating cross-referencing against public disclosure databases (e.g., WPScan Vulnerability Database, CVE Details).

Python script to fetch recent WordPress core CVEs and compare with your finding:

import requests
import sys

def check_duplicate(cve_description):
wp_cves = requests.get("https://wpscan.com/api/v3/vulnerabilities?wordpress_version=6.4").json()
for vuln in wp_cves['vulnerabilities']:
if cve_description.lower() in vuln['title'].lower():
print(f"[!] Possible duplicate: {vuln['title']} - {vuln['cve']}")
return True
return False

if <strong>name</strong> == "<strong>main</strong>":
if len(sys.argv) < 2:
print("Usage: python dup_check.py \"your vuln description\"")
else:
duplicate = check_duplicate(sys.argv[bash])
print("Duplicate likely" if duplicate else "No exact match – proceed with report")

Save as `dup_check.py` and run:

python dup_check.py "unauthenticated SQL injection in REST API user endpoint"

What Undercode Say:

Key Takeaway 1: A duplicate closure does not invalidate your research – it validates that you are hunting at the same level as professional researchers. Use duplicate reports to refine your testing methodology and learn new attack vectors.
Key Takeaway 2: Automation and local code auditing with grep and static analysis tools drastically reduce duplicate rates. Always test against the latest core and plugin versions before submission.
+ analysis around 10 lines: The original post from Santika Kusnul Hakim (a 50-year-old grandfather and knowledge hunter) highlights a common pain point in bug bounty: parallel discovery. His high-severity finding scored 3 (likely internal rating) and was closed as duplicate. This reflects both healthy competition and the need for better real-time duplication databases. Many programs now offer “duplicate bounty” – a small reward – to encourage submitters. However, WordPress Core’s HackerOne program rarely pays duplicates. Researchers should pivot to plugin/theme vulnerabilities where duplication is lower. Additionally, leveraging the closed report as a learning asset can lead to chaining the duplicate flaw with another misconfiguration, sometimes resulting in a new, rewarded vulnerability. The emotional takeaway – “baarakallaah” (Arabic for “may Allah bless you”) – shows gratitude despite the outcome, a mindset essential for long-term bug hunting success. Ultimately, duplicates are not failures; they are proof of alignment with industry-level security research.

Expected Output:

Introduction:

WordPress core vulnerabilities often go unnoticed until a researcher discovers a subtle bug in REST API parameter handling. When a report receives a high-severity rating but closes as duplicate, it highlights the need for systematic pre-submission checks and deeper technical documentation. This introduction reframes duplicate reports as learning milestones rather than rejections.

What Undercode Say:

  • Duplicate reports serve as free peer reviews – analyze the original PoC to uncover bypasses or chaining opportunities.
  • Always maintain a local database of past CVEs and use automation (like the Python script above) to filter out known issues before spending hours on write-ups.

Expected Output:

Prediction:

  • -1: Duplicate rates will rise as more researchers adopt automated scanners, flooding triage teams and increasing frustration among manual hunters. Smaller programs may shut down due to report fatigue.
  • +1: AI-powered duplicate detection (e.g., semantic similarity between report descriptions) will mature by 2027, reducing false duplicates and offering “partial credit” for parallel discoveries.
  • -1: WordPress core’s bug bounty payout structure may shift toward lower rewards for REST API flaws, pushing researchers toward more profitable targets like payment plugins.
  • +1: The rise of public duplicate databases (e.g., WPScan’s real-time API) will enable pre-submission checks, fostering collaboration rather than competition.
  • -1: Attackers will exploit the “duplicate gap” – the time between first submission and patch – to launch zero-days, especially when duplicate reports are disclosed prematurely on social media.

▶️ Related Video (62% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Sans1986 This – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: