# Race condition on add 1 free domain

Race condition on WordPress.com free Gravatar domain transaction endpoint lets a user claim multiple free custom domains instead of one.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: root_geek280
- Disclosed: 2025-05-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2616045
- Library page: https://bugbountylibrary.com/r/h1%3A2616045
- Tags: area:web3 domain:web impact:funds-loss kind:bounty platform:hackerone sev:medium tech:rest technique:race-window vuln:business-logic vuln:fee-bypass vuln:race-condition

**Target:** REST transaction endpoint public-api.wordpress.com/rest/v1.1/me/transactions
**Root cause:** The free-domain transaction endpoint lacks idempotency/locking, so parallel duplicate requests each process a separate free domain purchase before the one-per-account limit is enforced.
**Steps:**
1. Create free Gravatar account and log in
2. Select 'claim free custom domain' under My profile
3. Redirected to `https://wordpress.com/start/domain-for-gravatar/domain-only?search=yes&new=<domain>`
4. Complete payment flow until reaching `public-api.wordpress.com/rest/v1.1/me/transactions`
5. Capture the request and duplicate it 1-15 times
6. Change the `meta` parameter to a different name in each copy
7. Send all requests in parallel as a group
8. Multiple free domains get purchased instead of one
**How found:** Researcher reasoned that free-tier providers enforce limits at transaction time and hypothesized a race window on the domain-claim endpoint, then duplicated the request with varied `meta` params to test parallel execution.
**Exploitation:** Attacker captures the final transaction request, clones it with distinct `meta` values, and fires them concurrently so the free-domain entitlement check races and each request succeeds, yielding multiple free domains.
**Insight:** On free-entitlement flows, the final transaction/claim endpoint is the race target; varying a per-request unique field like `meta` avoids dedup and lets parallel copies each pass the limit check.