I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several responsible two weeks ago and offered my help to fix it but nobody has done anything, not even have been interested a little. I would like to write an entry in my blog, summarizing what methods I used, the results I got ...

How long should I wait before publishing them?

  • The term you should look up is "responsible disclosure". There are some guidelines around this. – schroeder Nov 21 '18 at 16:23

If the company you are publishing a vulnerability for is your employer, it's never a good idea to publish the vulnerability. You may be a whistleblower, but you will likely lose your job for neglecting your responsibilities.

Publishing responsible disclosure applies mainly to external party who neither has a duty to the company and whose livelihood is not dependant on the company. The main reason for responsible disclosure is because it is in the public's interest to know about the issue, as well as for taking credit for the discovery which can allow you to build a reputation/resume. However, running a vulnerability scanning tool like wpscan is not really considered an original research, there isn't really much credit to gain here.

As an employee of the company though, you really should fight this from the inside. You are part of the company and you are in a much better position than an external party to push for the resolution of the vulnerability.

How long should I wait before publishing them?

You should only publish the issue if you are ready to leave the company if the issue isn't resolved. Alternatively, if you judge that it is in the public's best interest to know about the issue, then you may want to go the whistleblower's route and publish it anyway if you think losing your job is a good enough cost for the greater good of public interest.

Although, do note that not all security vulnerabilities are of public interest. A vulnerability that simply allows users to deface the company's site, for example, are embarrassing for the company, but really serves no public benefit. A vulnerability that allows you to launch a nuclear rocket to anywhere in the world or allow the NSA to do dragnet snooping, on the other hand, would definitely be of public interest. And there are lots in between them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.