🎉 Welcome to the Wordfence Intelligence Bug Bounty Program 🎉

In Scope Assets

🚨 High Threat Vulnerabilities 🚨

⚠ Common and Dangerous Vulnerabilities ⚠

All Other Vulnerabilities

For other vulnerabilities, all WordPress plugins and themes, free and premium (excluding those listed in Out of Scope Assets) are in scope with active installation thresholds that vary with your Researcher tier:

If in doubt on what's in scope for your tier, use our bounty estimator to check if your discovery is in scope, or out of scope.

Out of Scope Assets

There are some assets explicitly out of scope of our bug bounty program which are listed below. Please note this list is non-exhaustive and there may be other products not currently listed in our Out-Of-Scope Asset List that are considered out of scope. If you would like to confirm whether a specific product is in-scope prior to submission, please contact us at wfi-support@wordfence.com.

Additionally, Plugins or Themes Closed to Downloads or Sales at the time of submission, or any web service associated with a WordPress plugin or theme that is not run locally (such as an API running on a plugin vendor’s website) is considered out of scope.

We will no longer assign CVEs to any vulnerabilities discovered in the products outlined above and they will not be eligible for a bounty through our bug bounty program.

We no longer assign CVE IDs to any vulnerabilities found in the out of scope list above and they will not be eligible for a bounty through our bug bounty program.

Program Rules Key Highlights & Important Things to Know

• Our rewards go all the way up to $31,200 for Standard Researchers, and $32,760 for 1337 Researchers. Use our bounty estimator to get an idea of what bounties you may be awarded for different vulnerability types, or check out our Bounty Hall of Fame to see real examples of the bounties we have awarded. Researchers are also eligible for additional bonuses that may increase bounties further.
• You must be a registered researcher on the Wordfence website, and be authenticated at the time of submission, in order to submit a vulnerability for the Bug Bounty Program.
• Vulnerabilities that require more than one CVE assignment may only earn a single bounty for the higher awarding CVE (i.e. Cross-Site Request Forgery and Missing Authorization in a single function)
• Researchers can be banned or throttled from the program if they are continuously submitting low-quality or spammy false positive reports, or appear to be gaming the rules of the program in a harmful fashion.
• Developers cannot report vulnerabilities in their own software for bounties, though they can submit issues for CVE ID assignments.
• Wordfence must handle the responsible disclosure process for any reported vulnerabilities, and you must keep the information confidential until we publicly disclose the issue in our database. This means Wordfence must be the only organization you submit the vulnerability to.
• The first researcher to submit a vulnerability with a valid and working proof of concept will be the only one to receive a bounty in the event of a duplicate report.
• Bounty payments are processed in bulk on the 1st and 15th of every month.
• In-Scope submissions are triaged according to the priority level shown to you on the researcher dashboard, with critical issues having a much faster turnaround. Out-of-Scope submissions are triaged as time allows or rejected immediately upon submission.
• You may be eligible for a monthly streak bonus reward depending on the quality and volume of submissions you make in any calendar month. Review our monthly streak bonus details here.
• Once registered, you will have access to our researcher dashboard where you can track and manage all of your vulnerability submissions, reward payments, profile details, and referral information.
• Remember that when you participate in our Bug Bounty program, you are giving back to the security of the WordPress ecosystem. All of the vulnerabilities submitted to us are added to the Wordfence Intelligence vulnerability database which is given back to the community through webhook and API access completely for free. All other WordPress-centric vulnerability databases charge for this level of access.
• All newly registered researchers will be considered ‘New Researchers’ and limited to 15 total reports pending triage, with 10 of those being in-scope, until they have submitted at least 10 validated vulnerability submissions, or unlocked the 1337 Researcher or Resourceful Researcher Tier.
  • These researchers will also be subject to Out of Scope report throttling:
    • If a New Researcher submits too many out of scope reports in a short period of time, their ability to submit new vulnerabilities will be throttled.
    • If a New Researcher submits 10 out of scope vulnerabilities in a period of 7 days, they will be blocked from any further submissions for at least 7 days.
  • You may be temporarily throttled from any further submissions to Wordfence if you submit too many false positive, low-quality, or AI hallucinated reports.
    • You may be throttled from any further submissions:
      • For 7 days, if 5 False Positives are reported in a period of 7 days
      • For 14 days, if 10 False Positives are reported in a period of 14 days
      • For 30 days, if 20 False Positives are reported in a period of 30 days
      • For 30 days, if 2 AI hallucinated reports are submitted
    • You may be banned permanently from the program if you:
      • Submit 4 or more AI hallucinated reports (where the code reported does not exist in the codebase)
      • Submit 30 or more false positive reports

Pending In-Scope Report Limits

All researchers have a limit to the number of vulnerabilities that can be actively submitted and pending triage at one time for participation in the Bug Bounty Program. The following outlines these pending report limits:

This allows us to control the flow of submissions to ensure we can sustain reasonable triage times for all of our researchers and everyone has a fair chance at submitting qualifying vulnerabilities.

When do in-scope reports roll over?

Only vulnerabilities in triage or pending triage will count against your pending report limit. This means that as soon as a vulnerability is validated by our team, you are eligible to submit another in-scope report.

Pro-Tip: You can track and manage how many submissions you have available on the researcher dashboard. In addition, you will know if you are at your pending report limit by accessing the vulnerability submission form. If you get a notice that you are at your limit then you can not submit any more vulnerabilities for participation in the Bug Bounty Program. If you do not get a notice, then you are all clear to submit another bounty-eligible report.

For a more detailed overview, please read our terms and conditions.

There are various researcher tiers that control what your scope is and how many pending vulnerability submission reports you can have at any given time.

Special Note: Anything in the lists of examples below, in software with 1,000 to 50,000 Active Installs is considered a 'Medium' impact issue and will count towards earning the Resourceful Researcher tier.

What are critical or high severity vulnerabilities in our eyes?

Qualifying vulnerabilities are not based on CVSS score, but rather a combination of CVSS scoring and the threat factor (i.e. likelihood of mass exploitation) of the vulnerability. The following outlines vulnerabilities that are critical and high "severity" qualifying vulnerabilities. This list is exhaustive, but exceptions may be made for vulnerabilities on a case by case basis. Please note that these all assume there are no prerequisites to exploit (i.e. settings or user interaction). In order for a vulnerability to qualify, the vulnerable plugin or theme should have >=50,000 active installations.

The Achievement Badges for the Wordfence Bug Bounty Program are designed to recognize the contributions and skills of participants in enhancing the security of the WordPress open-source community. Through a system of badges named "Achievements," individuals are rewarded for their expertise, perseverance, and collaborative efforts in making the WordPress environment safer. These badges signify not only personal growth and discovery but also professional development, as they are displayed on the researcher's profile, enhancing their reputation and providing clear milestones in their bug-hunting career.

This initiative encourages both seasoned and novice security researchers to engage actively, pursue continual improvement, and gain acknowledgment within the open-source ecosystem, with the promise of expanding the badge offerings in the future to further incentivize and track progress in contributing to a more secure open-source community.

Refer-A-Researcher Program

Introducing the Wordfence Refer-A-Researcher Program! This initiative rewards our top security researchers for bringing new talent to our Bug Bounty Program. If you're an active contributor, you can refer researchers and earn commissions while helping to strengthen WordPress security.

Eligible researchers will be notified by email once they’ve met the Wordfence Refer-A-Researcher Program eligibility requirements. At that point, access to apply to the Wordfence Refer-A-Researcher Program can be found on the researcher dashboard. Note that researchers who do not meet the eligibility requirements will not be able to view or complete the application until the requirements are met.

Researchers that are a part of the Wordfence Refer-A-Researcher Program will receive a special referral link that can be shared to new researchers for signing-up that will allow referring researchers to earn a commission based on the first few submissions of a newly referred researcher.

Benefits

Earn a 20% commission on the cumulative bounties from the first five validated reports submitted by your referrals. It's a rewarding way to help expand our community of security experts! The commission earnings are unlimited, meaning there are no caps to how much you can earn by referring researchers.

Maximize your commissions by encouraging and helping other researchers learn how to hunt for the most impactful and critical vulnerabilities in WordPress, which will ultimately lead to a bigger reward for you, your referral, and the WordPress ecosystem.

To provide an example, if a researcher submits 5 vulnerabilities earning $100 each, then the referring researcher would earn a bonus of $100 after those 5 vulnerabilities have been submitted, validated, and their bounties approved.

Eligibility

To qualify, you must:

• Be registered as a researcher for at least one month
• Submit at least 10 valid in-scope vulnerabilities
• Actively promote meaningful vulnerability research in WordPress
• Receive approval from the Wordfence Bug Bounty Team
• Once eligible, you will receive an email letting you know that you can apply. You can also track your eligibility in your Researcher Dashboard.

How it Works

After you're approved, here's how it works:

1. You share your unique referral link to a researcher who is not already registered as part of our program.
2. The researcher signs up using the link you've provided them. Our team approves their profile.
3. You help and encourage the referred researcher to submit their first 5 in-scope reports.
4. You can track their progress from your Researcher Dashboard.
5. After the researcher submits their first 5 in-scope validated reports, you earn a commission bonus of 20% of the total bounties that were awarded for those submissions.

Review the full terms and conditions.