# Email Verification bypass on signup

WordPress.com invites API leaked invite_key and link to the inviter, letting them accept invites and create accounts for unregistered emails, bypassing email verification.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: farhan0x00
- Disclosed: 2020-12-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1040047
- Library page: https://bugbountylibrary.com/r/h1%3A1040047
- Tags: area:web domain:api domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:business-logic vuln:secrets-leak

**Target:** public-api.wordpress.com REST invites endpoint
**Root cause:** The invites list endpoint returns the invite_key and acceptance link to the inviter, who should not possess the invitee's credentials.
**Steps:**
1. Log in to wordpress.com and configure Burp proxy
2. Navigate to manage>people and invite an unregistered email
3. Open `https://wordpress.com/people/invites/yoursite.wordpress.com`
4. Capture GET `https://public-api.wordpress.com/rest/v1.1/sites/{siteId}/invites?http_envelope=1&status=all&number=100`
5. Read `invite_key` and `link` from JSON response
6. Open the link in another browser and complete signup for the invited email without email access
**How found:** Researcher noticed the invite acceptance link/key was visible to the inviter in the invites management UI and API response, hypothesizing it could be used to accept on the invitee's behalf.
**Exploitation:** Attacker invites any unregistered email, retrieves the invite link/key from the API response, opens it in a fresh browser, and completes account creation for that email, bypassing email verification.
**Insight:** Invite/onboarding flows often expose the acceptance token to the inviter in list endpoints; check whether invite_key/link returned to the inviter can be replayed to complete signup for the invitee's email.