“Big discoveries often hide in plain sight.”

That’s exactly what happened when a security researcher spotted an overlooked WordPress endpoint on a Microsoft-owned domain—and turned it into a $7,500 bug bounty.

🔍 The Curiosity That Sparked It

Security researchers routinely check WordPress REST API endpoints (/wp-json/) when exploring a target. Most of the time, these lead nowhere—generic responses, limited information, or benign metadata.

But on visualstudio.microsoft.com, one endpoint stood out:

/wp-json/visualstudio/chatbot-token

The name alone suggested something worth investigating. Could this be linked to authentication? A token system? Curiosity demanded a closer look.

🧪 Step 1: Testing the Endpoint

The researcher first tried a simple POST request without any data.

Result: 411 length required
Not much at first glance—but that error revealed the API was expecting some sort of body .

🧪 Step 2: Sending a Minimal Payload

Next, the researcher sent a minimal JSON payload with proper headers:

curl -X POST https://visualstudio.microsoft.com/wp-json/visualstudio/chatbot-token \
  -H "Content-Type: application/json" \
  -d '{}'

Result: Success—an actual JWT (Direct Line token) was returned!
What’s more, it was signed with Microsoft’s RS256 key.

This meant the endpoint was effectively issuing valid tokens without any authentication.

💡 Lessons for Security Researchers

1. Check the obvious. Even endpoints that look harmless—like /wp-json/—can expose sensitive functionality.

2. Minimal payloads are powerful. Sometimes sending {} is enough to trigger interesting behavior.

3. Documentation matters. A clear proof-of-concept (POC) makes it easier for vendors to validate and reward findings.

4. Patience pays off. Responsible disclosure and persistence build trust with organizations.

✨ Final Thought

This story shows that security research isn’t always about complex exploits or deep zero-days. Sometimes, the path to a five-figure bounty begins with nothing more than a sharp eye, a simple request, and the curiosity to test “what if.”

So next time you’re exploring an application, don’t ignore the basics. That one overlooked endpoint might just be your ticket to the next big bounty.