WordPress plugin and theme ecosystem (Patchstack Alliance)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz 15M+ installs or WordPress core: unauthenticated │ $33,000 │ $34,000 15M+ installs or WordPress core: Subscriber │ $16,500 │ $17,500 5M+ installs: unauthenticated │ $14,400 │ $15,400 1M+ installs: unauthenticated │ $7,200 │ $8,200 500K+ installs: unauthenticated │ $4,900 │ $5,900 100K+ installs: unauthenticated │ $2,600 │ $3,250 10K+ installs: unauthenticated │ $600 │ $750 1K+ installs: unauthenticated (Subscriber-level pays half at every tier) │ $250 │ $313 Submit a vulnerability Latest advisories Loading the feed Overview This is an ecosystem target rather than a single project: the GPL-2.0-or-later plugins and themes published through the WordPress.org repository, plus WordPress core, with 1,189 individual products enrolled in Patchstack's directory and each carrying its own published ceiling. Every install is a self-hosted site that patches on its own schedule, which is why plugin vulnerabilities are mass-scanned within days of an advisory and why the same missing capability check reappears across forked plugin code for years. What makes the rail unusual is who funds it: Patchstack pays out of its own commercial threat-intelligence business rather than out of any vendor's pocket, so a plugin whose author has no bounty program still has a cash path. The published range runs from $125 for a Subscriber-level bug on a 1,000-install plugin to $33,000 for an unauthenticated bug in WordPress core or a plugin above 15 million installs. sorona.xyz adds 1.25× on top of whatever Patchstack awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The products enrolled in Patchstack's mVDP directory: 1,189 WordPress plugins and themes at last count, each listed with its own published per-product ceiling WordPress core itself, which the grid places in the same top row as plugins above 15 million installs The whole PHP surface of an enrolled product: admin screens and settings handlers, REST routes, wp_ajax and wp_ajax_nopriv endpoints, shortcodes, blocks and cron callbacks, along with the capability and nonce checks around each of them File upload, import and export, and media handling in enrolled products Database access through $wpdb and any query a product assembles itself Output rendering and escaping across admin screens, front-end templates and email, and the serialisation paths in between Third-party PHP libraries an enrolled product bundles, and the product's own update and licence-check channels The GPL-2.0-or-later code published in the WordPress.org repository, and GPL-derived premium components whose source is not in a public repo Out of scope Products not enrolled in the directory, which carry no published ceiling and therefore no bounty Products below the bottom rung of the grid, which starts at 1,000 active installs Vulnerabilities that require an administrator or super-admin role as a prerequisite: the grid prices unauthenticated and Subscriber-level findings and has no rung above them Reports already submitted to another party, which section 9.3 lets Patchstack publish without a CVE ID Anything outside the WordPress plugin, theme and core ecosystem, since the grid is keyed on WordPress active-install counts and prices nothing else Anything shared with a third party before Patchstack sees it, which rule 6.7 treats as grounds for a permanent ban rather than as a scope question Most-valued findings An unauthenticated vulnerability in WordPress core or a plugin above 15 million installs: the $33,000 top rung, and worth exactly twice the same bug behind a Subscriber login, which is why the authentication requirement is the first thing to attack Unauthenticated file upload, PHP object injection or SQL injection in a high-install plugin: the classes that produce the ecosystem's real incidents, and the ones mass-scanned within days of an advisory landing Stored XSS that fires in an administrator's dashboard, roughly half of the WordPress advisory mix, where a value written by an unauthenticated visitor is rendered back to a privileged user Missing capability or nonce checks on a plugin's REST and AJAX endpoints, the standard route by which a Subscriber reaches an administrator-only action Privilege escalation from Subscriber to administrator, which converts the cheaper authenticated rung into full site takeover and moves the report up several tiers of impact The same defect demonstrated across several enrolled products with shared code lineage, because forked plugin code carries the same missing check into every descendant Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Patchstack's rule 6.7 permanently bans researchers who report or sell a vulnerability to any third party, so this one goes to Patchstack directly and nowhere else first What you get paid is set by the affected product's active install count crossed with the privilege the exploit needs: an unauthenticated finding pays double the Subscriber-level equivalent at every tier Only enrolled products carry a bounty: the directory lists 1,189 WordPress products with a per-product ceiling, and anything outside it has no published rung Rule 24.4 makes an invoice mandatory regardless of payment method: payments are not processed without one Rule 23.2: if a PayPal account is blocked or frozen for sanctions reasons, Patchstack retries for three months and then returns the unpaid bounty to the pool The monthly TOP20 leaderboard and the XP level ladder are separate pools paid on top of per-report bounties, not part of the per-report figure Disclosure Coordinated with the plugin or theme vendor through Patchstack, which publishes the result in its own vulnerability database; section 9.3 says a report already submitted elsewhere may be published without a CVE ID and that the reporting form must be used exclusively. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability