I spotted this in August 2014 and reported it via Automattic&#x27;s responsible disclosure process (bug number #25376). They acknowledged it quite quickly and patched the hosted Wordpress.com accounts within a few weeks, and said they&#x27;d submitted a report for it to be fixed upstream, but then went silent and didn&#x27;t respond to any more requests for updates. A year and a half later they awarded a $100 bug bounty with no other information. I still don&#x27;t know if it&#x27;s been patched in the open source Wordpress release.