The problem was essentially that, through a misconfiguration, they published it early.
I'm not clear from the doc which of these scenarios is what they're calling the "leak"
A bunch of people were scraping commonly used urls based on previous OBR reports, in order to report as soon as it was live, as it common with all things of this kind
The mistake was that the URL should have been obfuscated, and only changed to the "clear" URL at publish time, but a public was bypassing that and aliasing the "clear" URL to the obfuscated one
Not hard to guess really. Wouldn't they know this was likely and simply choose a less obvious file name?
This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo
I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.
That's the main flaw. Wordpress was configured to allow direct access to file, so they did not go through the authentication system. My experience is with Drupal (and a decade or more out of date), but it sounds like this behaves very similar. And this is a giant footgun, the system doesn't behave the way normal people expect if you allow unauthenticated access to files (if you know the URL). I don't understand why you would configure it this way today.
kingkool68•34m ago
cstuder•31m ago
WordPress is a nice piece of software, but the plugin situation is getting worse and worse. (Too many pending updates, premium features and constant upselling, selling of plugins to new sketchy owners...)
withinboredom•23m ago
kassner•14m ago
devnull3•23m ago
Even if that is the case, the backend must validate.
whycome•14m ago
chippiewill•11m ago
The plugin situation is a mess largely because Wordpress isn't a nice piece of software.
It's popular, and functionally it's great, but the codebase is really showing its age. Wordpress has never properly rearchitected because it would break plugins on a scale that would endanger its dominance.
kstrauser•8m ago