- Top reward
- Not published
- Top severity paid
- Critical
- Assets in scope
- 32
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report on HackerOne
- Submit through the program page.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
HackerOne does not publish a reward table for this program.
- Pays cash
-
Yes
Bounties for the WordPress core software are doubled [if they're reported before the bug is released to users]
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
32 assets you may test, 13 excluded.
Source code 12
- bbPress Core Critical
- BuddyPress Core Critical
- Create Block Theme Critical No bounty
- GlotPress Critical
- Gutenberg Critical
- Official WordPress plugins Critical
- Other github.com/wordpress repos Critical No bounty
- Playground Critical
- Secure Custom Fields Critical
- SQLite Database Integration Critical
- WordPress Core Critical
- WP-CLI Critical
Wildcard domains 11
- bbpress.org
- *.buddypress.org
- *.buddypress.org,bbpress.org,profiles.wordpress.org Critical
- *.git.wordpress.org
- profiles.wordpress.org
- *.svn.wordpress.org
- *.trac.wordpress.org
- *.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org Critical
- *.wordcamp.org Critical
- *.wordpress.net Low
- *.wordpress.org Critical
Web 6
- api.wordpress.org Critical
- codex.wordpress.org,codex.bbpress.org,codex.buddypress.org Medium
- doaction.org Critical
- mercantile.wordpress.org Medium
- planet.wordpress.org Critical
- wordpressfoundation.org Medium
Domains 3
- codex.bbpress.org
- codex.buddypress.org
- codex.wordpress.org
Out of scope (13)
- org.wordpress.android
- glotpress.blog
- status.wordpress.org
- wordpress.tv
- 335703880
- Archived GitHub repositories
- Digital Ocean, AWS, etc
- https://github.com/wordpress-mobile/
- irclogs.wordpress.org
- lists.wordpress.org
- status.wordpress.org,glotpress.blog,wordpress.tv
- munin-*.wordpress.org
- *.wordpress.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from WordPress (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Be patient - Give us a reasonable time to correct the issue before you disclose the vulnerability.
-
You must always verify issues reported by automated tools.
-
You must review and take responsibility for what AI generates.
-
A report longer than 1,000 words in length almost certainly contains far more detail than is necessary.
Not accepted
-
Brute force, denial of service (DoS), memory exhaustion, phishing, text injection, or social engineering attacks
-
Availability of XML-RPC file without PoC demonstrating a significant security impact
-
A report about a hacked website
-
A user with the Administrator or Editor role can post JavaScript and unfiltered HTML
-
Usernames and user IDs are not private
-
A weakness in WP-CLI that doesn't violate its threat model
-
Path disclosure for errors, warnings, or notices
-
WordPress version number disclosure
-
A mixed content warning for passive assets like images and videos
-
Lack of an HTTP security header (CSP, X-XSS, etc.)
-
Clickjacking with a minimal security implication
-
Bypassing the theme review process, plugin release confirmation, or any other safety checks for themes and plugins on wordpress.org
-
Bypassing a moderation control where an attacker gains nothing, such as comment moderation
-
A theoretical vulnerability where you can't demonstrate a significant security impact with a PoC
-
A broken link to external resources in documentation, a profile, or a WordCamp site
-
A vulnerability that exposes an unapproved comment or trackback via social engineering, session theft, brute force, or similar
-
A vulnerability in a repo that is declared experimental
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “A vulnerability on `wordpress.org` is in scope only if it can be exploited without an authenticated user account, or using an account with the default user role...”
-
Rules updated
Added: “Any reproducible vulnerability that has a severe effect on the security or privacy of users is likely to be in scope for the program. Common examples include XS...”
-
Scope added
github.com/wordpress
-
Scope added
Playground
-
Scope added
SQLite Database Integration
-
Scope added
https://github.com/WordPress/secure-custom-fields
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-119977 | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | High 8.1 | 31 Oct 2026 |
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | High 8.1 | 22 Sep 2026 |
| CVE-2026-63030 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. | Critical 9.8 | 17 Jul 2026 |
| CVE-2026-60137 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. | Medium 5.9 | 17 Jul 2026 |
| CVE-2022-4973 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. | Medium 4.9 | 16 Oct 2024 |
| CVE-2024-8914 | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible f | High 7.2 | 25 Sep 2024 |
| CVE-2024-4439 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, | High 7.2 | 3 May 2024 |
| CVE-2024-31211 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. | Medium 5.5 | 4 Apr 2024 |
| CVE-2024-31210 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary av | High 7.6 | 4 Apr 2024 |
| CVE-2023-5561 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack | Medium 5.3 | 16 Oct 2023 |
| CVE-2023-39999 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 th | Medium 4.3 | 13 Oct 2023 |
| CVE-2023-38000 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. | Medium 6.5 | 13 Oct 2023 |
| CVE-2013-10027 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060e | Medium 4.3 | 4 Jun 2023 |
| CVE-2022-47174 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. | Medium 4.3 | 25 May 2023 |
| CVE-2022-47161 | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. | Medium 4.3 | 25 May 2023 |
| CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. | Medium 5.4 | 17 May 2023 |
| CVE-2013-10021 | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef7 | Low 3.5 | 11 Mar 2023 |
| CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on in | Medium 5.3 | 5 Jan 2023 |
| CVE-2022-3590 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. | Medium 5.9 | 14 Dec 2022 |
| CVE-2022-43504 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. | Medium 5.3 | 5 Dec 2022 |
| CVE-2022-43500 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | Medium 6.1 | 5 Dec 2022 |
| CVE-2022-43497 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | Medium 6.1 | 5 Dec 2022 |
| CVE-2011-1762 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission. | Medium 6.5 | 18 Apr 2022 |
| CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. W | High 8.0 | 6 Jan 2022 |
| CVE-2022-21664 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you | High 7.4 | 6 Jan 2022 |
| CVE-2022-21663 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly re | Medium 6.6 | 6 Jan 2022 |
| CVE-2022-21662 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go bac | High 8.0 | 6 Jan 2022 |
| CVE-2021-44223 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. | High 8.1 | 25 Nov 2021 |
| CVE-2021-39202 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta pha | High 7.6 | 9 Sep 2021 |
| CVE-2021-39203 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. | Medium 6.8 | 9 Sep 2021 |
| CVE-2021-39201 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress | High 7.6 | 9 Sep 2021 |
| CVE-2021-39200 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via mino | Medium 5.3 | 9 Sep 2021 |
| CVE-2020-36326 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exp | Critical 9.8 | 28 Apr 2021 |
| CVE-2021-29476 | Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. | Critical 9.8 | 27 Apr 2021 |
| CVE-2021-29450 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. | Medium 6.5 | 15 Apr 2021 |
| CVE-2021-29447 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. W | High 7.1 | 15 Apr 2021 |
| CVE-2020-28035 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28034 | WordPress before 5.5.2 allows XSS associated with global variables. | Medium 6.1 | 2 Nov 2020 |
| CVE-2020-28033 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | High 7.5 | 2 Nov 2020 |
| CVE-2020-28032 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | Medium 4.3 | 2 Nov 2020 |
| CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | Critical 9.1 | 2 Nov 2020 |
| CVE-2020-28038 | WordPress before 5.5.2 allows stored XSS via post slugs. | Medium 6.1 | 2 Nov 2020 |
| CVE-2020-28037 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28036 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-26596 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role. | High 8.8 | 7 Oct 2020 |
| CVE-2020-25286 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. | Medium 5.3 | 13 Sep 2020 |
| CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1 | Low 3.5 | 12 Jun 2020 |
| CVE-2020-4047 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5 | Medium 6.8 | 12 Jun 2020 |
| CVE-2020-4049 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, | Low 2.4 | 12 Jun 2020 |
| CVE-2020-4048 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, | Medium 5.7 | 12 Jun 2020 |
| CVE-2020-4046 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor | Medium 5.4 | 12 Jun 2020 |
| CVE-2020-11026 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4. | High 8.7 | 30 Apr 2020 |
| CVE-2020-11030 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | Medium 6.4 | 30 Apr 2020 |
| CVE-2020-11029 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3 | Medium 5.8 | 30 Apr 2020 |
| CVE-2020-11028 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.3 | Medium 5.8 | 30 Apr 2020 |
| CVE-2020-11027 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5. | Medium 6.1 | 30 Apr 2020 |
| CVE-2020-11025 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.2 | Medium 5.8 | 30 Apr 2020 |
| CVE-2019-20043 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous Word | Medium 4.3 | 27 Dec 2019 |
| CVE-2019-20042 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | Medium 6.1 | 27 Dec 2019 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
WordPress is an open-source publishing platform. Our HackerOne program covers the Core software, as well as a variety of related projects and infrastructure.
Our most critical targets are:
- WordPress Core software.
- WordPress.org API and website.
- Gutenberg software.
- WP-CLI software and website.
- BuddyPress software and website.
- bbPress software and website.
- WordCamp.org website.
- Supply chain and CI/CD workflows for the above.
Source code for most websites can be found in our GitHub account. Many of these include a Docker environment that provisions a local copy for you to test against.
Bounties for the WordPress core software are doubled if they're reported before the bug is released to users.
Please note that WordPress.com is a separate entity from the main WordPress open source project. Please report vulnerabilities for WordPress.com or the WordPress iOS and Android mobile apps through Automattic's HackerOne page.
Qualifying Vulnerabilities
Any reproducible vulnerability that has a severe effect on the security or privacy of users is likely to be in scope for the program. Common examples include XSS, CSRF, SSRF, RCE, SQLi, and privilege escalation.
Important: Submitting an unverified report from an automated scan or AI agent is not acceptable. You must always verify issues reported by automated tools. An unverified automated report will be closed as spam.
We generally aren’t interested in the following problems:
- A vulnerability on
wordpress.orgis in scope only if it can be exploited without an authenticated user account, or using an account with the default user role when signing up, and has a clear security impact like valid XSS, SQL injection or private information leak. A vulnerability affecting higher level user roles only is not in scope. - A vulnerability in WordPress Core and Gutenberg is in scope regardless of user role, as long as it has a genuine security impact and isn't disqualified by anything listed below.
- A vulnerability in any other asset covered by the program is in scope only if it can be exploited without an authenticated user account. A vulnerability that requires an authenticated role like Contributor+ or one that can only be granted by an admin is ineligible unless you can demonstrate a significant and high impact escalation such as remote code execution.
- Brute force, denial of service (DoS), memory exhaustion, phishing, text injection, or social engineering attacks are not in scope. Wikis, Tracs, forums, etc are intended to allow users to edit them.
- Availability of XML-RPC file without PoC demonstrating a significant security impact is not in scope. As noted above, this excludes DDoS and brute force attacks.
- A vulnerability in a WordPress plugin not specifically listed as an in-scope asset is not in scope. A vulnerability in a plugin should be reported to the Plugin Review team.
- A report about a hacked website is not in scope. The site owner can learn more about restoring their site.
- A user with the Administrator or Editor role can post JavaScript and unfiltered HTML, therefore a report about such a user being able to perform XSS or publish arbitrary HTML is not in scope.
- A self-XSS vulnerability within wp-admin that requires a user with
unfiltered_htmlcapability is not in scope. For example, script execution within/wp-adminas an Administrator or Editor on a single-site installation. Only vulnerabilities where a less-privileged user is able to execute a XSS attack on a higher-privileged user is in scope. - Usernames and user IDs are not private therefore disclosure and enumeration of usernames and user IDs is not in scope.
- A weakness in WP-CLI that doesn't violate its threat model is not in scope. Please ensure you have read and understood the WP-CLI policy on report validity.
- Path disclosure for errors, warnings, or notices is not in scope.
- WordPress version number disclosure is not in scope.
- A mixed content warning for passive assets like images and videos is not in scope.
- Lack of an HTTP security header (CSP, X-XSS, etc.) is not in scope.
- Any non-severe vulnerability on a
*.wordpress.orgsubdomain or any other low impact site is not in scope. For*.wordpress.netplease check the Scope section as only a limited number of subdomains are eligible. - Clickjacking with a minimal security implication is not in scope.
- A vulnerability in Composer/npm
devDependenciesis not in scope unless there's a practical way to exploit it remotely. - Bypassing the theme review process, plugin release confirmation, or any other safety checks for themes and plugins on wordpress.org is not in scope. This is classified as a review bypass, not a vulnerability.
- Bypassing a moderation control where an attacker gains nothing, such as comment moderation, is likely not in scope. This is a classified as a moderation bypass, not a vulnerability.
- A theoretical vulnerability where you can't demonstrate a significant security impact with a PoC is not in scope.
- A broken link to external resources in documentation, a profile, or a WordCamp site is not in scope unless a significant security impact can be shown.
- A vulnerability that exposes an unapproved comment or trackback via social engineering, session theft, brute force, or similar is not in scope. The impact is far too low compared to the effort required to exploit.
- A vulnerability in a repo that is declared experimental is not in scope. Please report it as an issue on the repo.
AI Guidelines
- You are free to use artificial intelligence (AI) tooling as part of your research and reporting, but you must disclose what tooling you are using and to what extent a report has been authored by AI.
- You must review and take responsibility for what AI generates. See the WordPress AI Guidelines. Submitting an unverified report from an automated scan or AI agent is not acceptable. An unverified automated report will be closed as spam.
- An AI-generated mediation request is not acceptable and will be dismissed. Mediation requests need to be handled by real humans, therefore if you have a serious mediation request you are expected to demonstrate your own effort in writing it.
- AI-generated comments requesting further details on a report closed as a duplicate are no longer entertained and will be ignored. Do not submit them.
- A report longer than 1,000 words in length almost certainly contains far more detail than is necessary. Use the following instructions to produce a concise report:
- You're writing a bug bounty report for an experienced triage engineer who knows the platform and the bug class, reads many reports a day, and sets severity themselves. Pull out every verifiable fact, such as file paths, flags, missing checks, log values, URLs, SHAs, counts, and drop everything else: framing, repetition, the story of how the research or draft came about, claims about the report's quality, background the reader already knows, rebuttals to expected objections, padded impact speculation and generic setup steps. Keep any uncertainty exactly as the source states it.
- Then write the report in this order, skipping any section the source has no facts for: a title in the form " in allows ", a summary of up to 100 words, one numbered entry per independent defect, a short note on how the defects chain (if they do), reproduction steps the triager can follow without asking questions, brief impact in up to 50 words, and any required disclosure statements in three sentences or fewer. Use the shortest form that carries each fact, and state each fact once, in its most specific place. Write neutrally, with no hedging, no emphasis for effect, no persuasion, no stock openers like "It is worth noting", and no blame on any person or team. Never lose a technical detail and never add anything that wasn't in the source, except that live secrets and third parties' personal data must be redacted with a note saying what was removed.
General Guidelines
We're committed to working with security researchers to resolve the vulnerabilities they discover. You can help us by following these guidelines:
- Follow HackerOne's disclosure guidelines.
- Pen-testing Production:
- Please setup a local environment instead whenever possible. Most of our code is open source (see above).
- If that's not possible, limit any data access/modification to the bare minimum necessary to reproduce a PoC.
- Don't automate form submissions! That's very annoying for us, because it adds extra work for the volunteers who manage those systems, and reduces the signal/noise ratio in our communication channels.
- If you don't follow these guidelines we will not award a bounty for the report.
- Be patient - Give us a reasonable time to correct the issue before you disclose the vulnerability. We care deeply about security, but we're an open-source project and our team is mostly comprised of volunteers. WordPress powers 40% of the Web, so changes must undergo multiple levels of peer-review and testing, to make sure that they don't break millions of websites when they're installed automatically.
We also expect you to comply with all applicable laws. You're responsible to pay any taxes associated with your bounties.