Jetpack

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Everything Else column; the $1,000 band is WordPress.com only) │ $500 │ $625 High │ $300 │ $375 Medium │ $200 │ $250 Low │ $100 │ $125 Submit a vulnerability CVE history 5 Last 12 months 40 Lifetime XSS 35 % Access control 30 % Info disclosure 20 % Auth bypass 13 % Latest advisories Loading the feed Overview Jetpack is Automattic's security, backup and performance plugin for self-hosted WordPress, and it is the only SOURCE_CODE asset in Automattic's HackerOne program, listed as eligible for bounty at critical max severity. It carries a real defect history rather than a theoretical one: 40 CVEs lifetime and 5 in the last twelve months, weighted heavily towards cross-site scripting and broken access control, which is what you would expect from a plugin that adds an admin surface and a remote connection to WordPress.com on top of every site that installs it. Automattic pays it, but Jetpack falls in the rewards table's Everything Else column rather than the WordPress.com column, so the ladder runs $100 for Low up to $500 for Critical; Wordfence, the usual alternative payer for WordPress plugin bugs, lists all Automattic products out of scope, so this program is the only paid route. sorona.xyz adds 1.25× on top of whatever Automattic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The HackerOne asset row reads: asset Jetpack , asset type SOURCE_CODE, eligible for bounty, max severity critical. It is the only source-code asset on Automattic's program. That covers the plugin as a whole rather than a handful of its modules: whatever ships inside Jetpack is what the asset row names The connection to WordPress.com: the XML-RPC surface, token issue and verification, and Jetpack single sign-on Jetpack's REST endpoints under jetpack/v4 , its AJAX handlers, and the capability checks gating both The admin surface, meaning My Jetpack and the module settings screens, along with the site data those screens render back Front-end output: blocks and Gutenberg extensions, shortcodes and embeds, sharing, carousel, related posts and the contact form, every one of which renders input a visitor can influence The site-data modules: Stats, Search, Subscriptions, Publicize, Sitemaps, and the sync that ships site content up to WordPress.com Backup and restore, plus the security modules, including brute-force protection and the firewall rules Jetpack installs Out of scope WordPress, BuddyPress and bbPress core bugs, which the program routes to hackerone.com/wordpress instead of paying here Automattic's other assets: the rest of this program's scope table is Tumblr, WordPress.com, Akismet and MailPoet properties, and Jetpack is the only source-code row on it Third-party plugins and themes that merely interact with Jetpack Reports without a proposed CVSS v3 vector and score, which risk losing the reward regardless of the finding's quality Findings whose evidence is hosted on an external service rather than attached to the report Duplicates of an already-reported root cause, since only the first reporter is paid, and related reports may be consolidated into a single payout Components no longer in active development, which stay in scope and are explicitly paid less Payment blocked by sanctions screening, with reporters carrying their own tax liability Most-valued findings Cross-site scripting that fires for an administrator on a default Jetpack install, the largest recorded class at 35% and the one most likely to be rated critical Access-control failures in Jetpack's REST or AJAX handlers that let an unauthenticated or low-privilege caller perform an administrator action Authentication bypass in the WordPress.com connection, token exchange, or single sign-on path, which turns one flaw into remote control of the site Information disclosure through the backup, sync, or stats modules that exposes site content, credentials, or user records Any of the above demonstrated on a stock configuration with the default modules enabled, rather than one the reporter had to weaken Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. First reporter only: a duplicate of an already-filed root cause pays nothing Include a proposed CVSS v3 vector and score, which the program treats as mandatory and without which the reward may be lost Store all supporting evidence and attachments inside the report itself, never on an external file host Awards are adjusted down for assets that are no longer in active development, so check the component is still maintained before you invest time Related reports may be consolidated into a single payout rather than paid separately WordPress, BuddyPress and bbPress core bugs belong at hackerone.com/wordpress, not here; sanctions screening applies to payees and reporters owe their own taxes Program stats $240k Bounties paid 575 Reports received (90 days) 61% Response efficiency Disclosure Coordinated through Automattic on HackerOne, on Automattic's timing rather than a fixed clock. Because the program requires that every attachment and piece of evidence live inside the report and nowhere else, file with Automattic directly and let sorona.xyz track the outcome instead of holding material outside their system. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability