What was the quirk?

Why are government organisations which handle sensitive information using Wordpress?

There's a couple of passing mentions of Download Monitor, but also the timeline strongly implies that a specific source was simply guessing the URL of the PDF long before it was uploaded

I'm not clear from the doc which of these scenarios is what they're calling the "leak"

For those of you not closely following UK politics: the Office for Budget Responsibility (OBR) mistakenly published their Economic and Fiscal Outlook (EFO) document 40 minutes early, pre-empting the announcements by the Chancellor.

This is being treated as an incredibly big deal here: https://www.bbc.co.uk/news/articles/cd74v35p77jo

>During that period, it was accessed 43 times by 32 unique IP addresses

I find this an implausibly low number. It was all over Bluesky, X etc., not to mention journo Signal and WhatsApp groups.

> The available mitigation is at server level and prevents access to download or file storage directories directly. If configured properly, this will block access to the clear URL and return a ‘forbidden’ message. This is the second contributory configuration error – the server was not configured in this way so there was nothing to stop access to the clear URL bypassing protections against pre-publication access

That's the main flaw. Wordpress was configured to allow direct access to file, so they did not go through the authentication system. My experience is with Drupal (and a decade or more out of date), but it sounds like this behaves very similar. And this is a giant footgun, the system doesn't behave the way normal people expect if you allow unauthenticated access to files (if you know the URL). I don't understand why you would configure it this way today.

> It is the worst failure in the 15-year history of the OBR

I'm not sure publishing some information 3 hours early was really their biggest failure in 15 years...

Especially when much of the info was already public because hundreds of civil servants involved in making these decisions told their family members who told the press...