I gave her the money. I told her I did it. Gave her the 40 and 2.5% processing fees in payment/invoice and notified the application dev team. However, her "company" didn't pay for services rendered.
So no. I didn't tell her "how" I did it. I mistook the question. I did notify her and the dev team. But provided no documentation or other advice. As I have a docket of paying customers I have to write up and actually work for. To this day. The vulnerability remains unpatched and she hasn't switched plugins either. Which. Would have been my advice.
Like I said. No pay. No play. The developer didn't, and I have the email, "see how this posed risk to users."
I noticed WordPress and the PCI/DSS points of contact that users employing the widget are vulnerable and not compliant. Took about 3 hours total of my time. And mostly served to train one of my new guys.
How we do things, many say are reckless or whatever. I argue that our customers have very high satisfaction rates and we work and partner with the FBI for a lot of work.
Carrying out the act itself was not a crime as I, and many I work with, have on the authority of DHS, by having been vetted and authorized to carry out activities related to critical infrastructure (payment processing, HIPAA ect) without notice, warrant or anything other than notifying our local cyber crime POC.
If we want further access. We simply push it up the chain and get a warrant from DoJ. Local LEAs facilitate the actual physical intercept and or confiscation of information systems.
Kind of standard... and definitely not secret or anything like that. 50,000 people are part of the private sector/ federal program to facilitate this effort.
Huntsville AL. Where were based has more of these types of contracts and professionals than any other place on earth. Bar none. So down here my man, we design, build and field most of the militaries most advanced weapon systems. In fact. We run fucking circles around silicon valley in overall capability, classified mfg, and design.
Name a weapon system. Any of the most advanced. 90% odds are it was designed here. 20 years ago. Since that's all anyone sees. "Future weapons" is like a show for "ohh I remember that project!" Yea. It's like that.
So yes. We have shady partnerships. Yes we carry out independent work that many would deem illegal. (Electronic and cyber warfare payloads on drones for example, constantly run routes around the area, actively targeting and testing the abilities).
So. I see your point. But you're out of your depth I assure you. Anything I've said here. Ever. Is monitored. And anything and everything I say, is, totally unclassified and sanctioned. In the IC secret courts or otherwise.
Our levels of access come at a price. And that price is the total and complete loss of privacy. In all forms. Including who the fuck I have as a girlfriend.
We're a little known town. But we work silently doing the bulk of R&D thay keeps your fucking asses safe. Clandestine operations and the real world training required keeps our guys from getting fucking slaughtered in a Saudi prison when on OP. It's necessary and it's not up for debate. Sorry. Believe what you want. But 99% of the Cyber private sector operates with a capability that can't even begin to match some of the firms based here.
End rant.