World Health Organization (WHO)

World Health Organization's WordPress Vulnerability

April 2026 — Vulnerability Disclosure Program

I think it was around September 2024 when I first came across the WHO Vulnerability Hall of Fame. At the time, I was still in the learning phase, studying beginner cybersecurity stuff, and seeing other people post their wins made me wonder what it actually took to get listed. I kept that goal in my sights; my principle has always been that if I can't get it now, I will definitely get it later.

I'm honestly surprised by how straightforward it is to score a valid, accepted vulnerability on the WHO Hall of Fame. This is definitely good news for anyone looking for bragging rights on social media by saying they "ethically hacked" the WHO. However, that doesn't mean they just accept anything. In my opinion, it simply means their cybersecurity team is proactive. They accept reported vulnerabilities and try to patch every vulnerabilities as long as it falls within their official scope.

Roughly around the same time I started hunting for vulnerabilities in UNICEF and UNESCO, I also began casually scouring through the WHO's public-facing digital assets. I noticed that many XSS and information disclosure issues had been reported previously. Personally, I'm not sure how others were finding those specific bugs; even when I invested more time and effort, I couldn't get an XSS payload to trigger, nor did I find any sensitive leaks via Google Dorks.

Since I'm a manual hunter armed with the Wappalyzer extension, I screened the WHO's enumerated subdomains myself. I manually appended /xmlrpc.php to the URL of any site running WordPress. I hit a lot of HTTP 403 responses, but after some thorough searching, I finally came across two unprotected endpoints. The Proof-of-Concept (PoC) for both endpoints used the exact same method, so I only provided proof for one.

I used Burp Suite to intercept the request so I can see the HTTP response.

Since it returns HTTP 405 Method not Allowed, I changed the request method from GET to POST, and appended some XML code to list the available system methods.

XML-RPC endpoints commonly expose the pingback.ping method. When publicly accessible, this method has historically been abused to trigger server-side HTTP requests to third-party targets, which can be leveraged for reflected traffic or amplification-style abuse if not restricted or rate-limited.

I then used Interactsh Web Client as a temporary callback server for this PoC.

Once I proved that the pingback method is working, I checked the IP address to confirm it.

As usual, I sent an email report detailing the steps I took to the WHO Cybersecurity Team on 26 January 2026. A few days later, on 30 January 2026, I received a reply from them.

Not bad. I was not expecting them to classify my finding as an Out-of-Band Server-Side Request Forgery (SSRF). After they fixed it, they emailed me and asked me to manually confirm that the vulnerability had been patched.

I opened the URL of the endpoint in a web browser and checked the Network Tab in the Developer Tools. It was indeed fixed and returned an HTTP 403 Forbidden response.

Once I confirmed the fix and sent them a screenshot, they replied with an email asking for my name and LinkedIn profile so they could add me to their Hall of Fame.

It was only during the first week of April 2026 that I randomly checked and saw they had updated the list. This is why I am publishing this blog on 6 April 2026. My assumption is that they update the list every two to three months. I am still really curious about how to find a successful XSS on WHO's public-facing assets, so I aim to get at least one valid XSS during my next hunt there.