a bug which allow free users on wordpress.com to add google webmaster tool to wordpress blog

[kingmedo208]

this bug is in the wordpress and i'll explain this issue and i'm so sorry because i'm not very good at English because i'm Egyptian
first visit this link ​https://"yourblog".wordpress.com/wp-admin/tools.php
then simply put the code and save the changes and you will be surprised as the code has been added to your blog so i hope that this issue will be closed because of its dangerous

[tobifjellner]

Hi @kingmedo208
Welcome to WordPress.org meta tracker. Here we follow up on issues and development around WordPress.org.

1. You're writing about WordPress.com which is different from WordPress.org.

You may read more about the differences at ​https://en.support.wordpress.com/com-vs-org/
I'm going to close this ticket as invalid, since you should have made this report to support.WordPress.com instead.
But read on!

2. Google webmaster is a tool that lives completely on google's own servers. Nothing is installed in your own blog. But – if you manage to prove to google that you're the owner of a site, they may give you some inside access about things that concern your site.

On the page that you linked, there are some fields where you can enter long "ownership proof" strings that you'll find in the user interface of google webmaster when you try to add your blog.
So this functionality is fully OK and even intentional!

3. If you would ever find a security hole somewhere, please bear in mind, that most organizations have separate, more secure ways for people to report about security issues. This ticket system, is public, and anything we write here can be read by anyone, even by evil hackers, who might not yet know about the issue you wanted to inform about.