Elementor: Bug Bounty Program

Description

Elementor is the leading website builder platform for professionals on WordPress. Elementor serves web professionals including developers, designers and marketers and boasts a new website created every 10 seconds on its platform. Elementor is an open-source, GPLv3 licensed offering its platform both as free and premium. Since launching in 2016, Elementor’s reach now extends to more than 180 countries, has more than 10,000,000 active installs, and is loved by many, as seen in over 4.5K five-star reviews it received in the WordPress repository. General Guidelines Please submit any vulnerabilities associated with our plugins to Elementor's Patchstack bounty program: * Elementor * Elementor Pro * Ally * Image Optimizer * Activity Log * Temporary Login * Site Mailer * Elementor Blocks for Gutenberg * Hello Elementor * Hello Biz * Hello Plus Vulnerability reports which will not include manual validation - for example, reports based only on results from automated tools and scanners or which describe theoretical attack vectors without proof of exploitability - will be automatically closed. Indicate steps to reproduce and verify you demonstrate a working proof of concept. Submissions without sufficient details - will be automatically closed. Please collect only the information necessary to demonstrate the vulnerability. Please only target your own accounts. DO NOT attempt to access the data of other accounts. Our program will use Bugcrowd’s Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its actual likelihood or impact. In any instance where an issue is downgraded, a detailed explanation will be provided to the researcher. Verify your target, do not attack any 3rd party supporting our services. We base all payouts on impact and will reward accordingly. Please emphasize the actual impact as part of your submission description. Rate Limiting - WAF technology is being utilized and will block high rate traffic deemed to be malicious. Stick with manual and pinpointed attack processes, don’t use mass scanning tools and avoid brute force attempts. If this occurs, discontinue your activity for a period of 24 hours. Out of Scope submissions that will indicate sufficient reasoning (why you believe it should be considered) and demonstrable impact may be considered as “In Scope” submissions (case-by-case basis). Reward Guidelines We base all payouts on impact and will reward accordingly. Please emphasize the impact as part of your submission. We are particularly interested and will consider extraordinary submissions for issues that result in full compromise of a system Priority │ Reward Range P1 (extraordinary submissions) │ Up to $5,000 P1 │ $2,000 - $4,000 P2 │ $500 - $2,000 P3 │ $0 - $500 P4 │ Points Only

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Elementor not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Elementor, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation. Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . You may register for accounts here: https://my.elementor.com/signup/?redirect_to=%2F . Exclusion List Finding types that are specifically excluded from our program: Websites hosted on our Cloud service (*.elementor.cloud) are explicitly out of scope and should not be researched Any contact or support forms Anything SSL (related attacks, insecure cipher suites, etc.) Weak Captcha / Captcha Bypass Username / Email Enumeration Brute Force attacks on our Login or Forgot Password pages Account lockout enforcement and related attacks HTTP security headers and Cookies related Issues Weak password policies CSRF on forms that are available to anonymous users (e.g. login or contact forms) Clickjacking Anything related to Mail Server Domain Misconfiguration (Email spoofing, missing DMARC, SPF/DKIM, etc.) Vulnerabilities impacting only old or end-of-life platforms, browsers and plugins Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Elementor Targets (in scope)

Target Information: The targets for this engagement are the Elementor application, the primary Elementor website, and the Public API. The target web applications are WordPress instances. In order to test Elementor’s Cloud product (elementor.cloud) you should: Create an Elementor account using your Bugcrowd Ninja email address at - https://my.elementor.com/signup/ Verify your email address - you’ll receive a verification email upon registration Researchers can access a one-week Elementor Pro license via the following URL: https://my.elementor.com/store/checkout?add-plans=WyJFTEVNRU5UT1ItQ0xPVUQtQlVHQk9VTlRZLVRSWS0wMSJd Note: This offer is strictly available for users with a @bugcrowdninja email domain. Start your ethical research :) It is important to emphasize that we have a daily limitation on sites creation as part of our Bug Bounty program You're allowed to test your own websites hosted on our Cloud service. However, other websites hosted on *.elementor.cloud that are not your own are explicitly Out of Scope and should never be researched.