Automattic disclosed a bug submitted by aaroncarson: https://hackerone.com/reports/1736846 – Bounty: $100 [Source]