Bug for Get a Blog Signup Page
-
Going to an unregistered subdomain of wordpress.com can show your user account in the blog domain text box and in the blog title text box if you add /wp-admin/ to the end of the url. I think someone might think of some kind of xss to exploit this. It also only seems to work when the subdomain is exactly 6 characters long.
Example urls: -
Edit: I also just noticed it won’t work if there are numbers, underscores, or dashes in the subdomain.
And it seems that if there are four or two characters, like http://cake.wordpress.com/wp-admin/ and http://hi.wordpress.com/wp-admin/, the glitch is also triggered. -
-
-
Yeah, but it’s filled in with your current user account name if you visit some of them. For me they are automatically filled with “sephr”
-
Only if you’re logged in. Log out and try it again, with something like “gggrrrrrr.wordpress.com/wp-admin”, and you’ll get “gggrrrrrr” filled in.
- The topic ‘Bug for Get a Blog Signup Page’ is closed to new replies.