The WordPress community take security bugs seriously. We appreciate your efforts to disclose your findings responsibly and will make every effort to acknowledge your contributions.

To report a security issue, please use one of the following private channels:

• The WordPress HackerOne program.
• Email the WordPress security team at security@wordpress.org.

Please do not report security issues in public GitHub issues, pull requests or discussions.