403 Bypass Leading to Exposed WordPress Authentication Endpoint on NASA Science Domain

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 9 Dec 2025 6 months ago
Priority P5 Bugcrowd's VRT priority rating
Status Informational This vulnerability is seen as an accepted business risk

i found a waf bypass bug which lead to admin panel disclosure