The culprit really should take this route & claim a possible reward:
"the user that took advantage of this bug, we would greatly appreciate if you share how this trick was done 😁"
<<This is the way>>