Automattic disclosed a bug submitted by riadalrashed: https://hackerone.com/reports/1987172 – Bounty: $200 [Source]