WP Engine VDP
By WP Engine Vulnerability disclosure program on Intigriti wpengine.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 15
- Public CVEs
- 11
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on Intigriti
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Intigriti lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
Yes
are prohibited from participating in WP Engine's VDP program, and are therefore not eligible for bounty or bonus payments.
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 2 excluded.
Web 7
- app.getflywheel.com
- getflywheel.com
- https://nitropack.io
- my.wpengine.com
- spressforumstg.wpengine.com
- studiopress.blog
- wpengine.com
Wildcard domains 6
- *. advancedcustomfields.com
- *. bettersearchreplace.com
- *.deliciousbrains.com
- *.studiopress.com
- *.wpengine.io
- *.wpesvc.net
Products and areas 2
- NitroPack Plugins
- WP Engine-developed WordPress Plugins and Themes
Out of scope (2)
- https://getflywheel.com/schedule-a-demo
- https://wpengine.com/contact
Rules
What the policy asks of you, and the bug types it won't reward, quoted from WP Engine VDP (via Intigriti)'s policy.
While testing
-
Respect the scope of the program
-
Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
-
Utilize an @intigriti.me account for any authenticated interactions with web or desktop applications
-
Avoid testing of any WP Engine or Flywheel customer sites, nominally located on the *.wpengine.com or *.flywheelsites.com subdomains.
Not accepted
-
API key disclosure without proven business impact
-
Wordpress usernames disclosure
-
Pre-Auth Account takeover/OAuth squatting
-
Self-XSS that cannot be used to exploit other users
-
Verbose messages/files/directory listings without disclosing any sensitive information
-
CORS misconfiguration on non-sensitive endpoints
-
Missing cookie flags
-
Missing security headers
-
Cross-site Request Forgery with no or low impact
-
Presence of autocomplete attribute on web forms
-
Reverse tabnabbing
-
Bypassing rate-limits or the non-existence of rate-limits.
-
Best practices violations (password complexity, expiration, re-use, etc.)
-
Clickjacking without proven impact/unrealistic user interaction
-
CSV Injection
-
Sessions not being invalidated (logout, enabling 2FA, etc.)
-
Tokens leaked to third parties
-
Anything related to email spoofing, SPF, DMARC or DKIM
-
Content injection without being able to modify the HTML
-
Username/email enumeration
-
Email bombing
-
HTTP Request smuggling without any proven impact
-
Homograph attacks
-
XMLRPC enabled
-
Banner grabbing/Version disclosure
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 42 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
*. bettersearchreplace.com
-
Scope removed
*. advancedcustomfields.com
-
Scope removed
studiopress.blog
-
Scope removed
spressforumstg.wpengine.com
-
Scope removed
my.wpengine.com
-
Scope removed
app.getflywheel.com
-
Scope removed
getflywheel.com
-
Scope removed
wpengine.com
-
Scope removed
WP Engine-developed WordPress Plugins and Themes
-
Scope removed
NitroPack Plugins
-
Scope removed
*.wpengine.io
-
Scope removed
*.deliciousbrains.com
-
Scope removed
*.wpesvc.net
-
Scope removed
*.studiopress.com
-
Scope removed
https://nitropack.io
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-3901 | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks. | Medium 6.8 | 15 May 2025 |
| CVE-2024-45429 | Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker | Medium 6.1 | 4 Sep 2024 |
| CVE-2024-3563 | The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute | Medium 6.4 | 9 Jul 2024 |
| CVE-2024-2761 | The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks. | Medium 6.8 | 19 Apr 2024 |
| CVE-2023-6933 | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could all | High 8.8 | 5 Feb 2024 |
| CVE-2022-1563 | The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL. | Medium 5.3 | 16 Jan 2024 |
| CVE-2023-23684 | Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5. | Medium 4.4 | 13 Nov 2023 |
| CVE-2023-24421 | Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions. | Medium 5.4 | 11 Jul 2023 |
| CVE-2019-9879 | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. | Critical 9.8 | 10 Jun 2019 |
| CVE-2019-9880 | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. | Critical 9.1 | 10 Jun 2019 |
| CVE-2019-9881 | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. | Medium 5.3 | 10 Jun 2019 |
Original policy
Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
WP Engine invites you to test the WP Engine and Flywheel Digital Experience Platforms. WP Engine equips its customers with a suite of agility, performance, intelligence, and integration solutions, so you can build and deploy a range of online experiences from campaign sites to content hubs to e-commerce extensions. Good luck and happy hunting!
Rules of engagement
By participating in this program, you agree to:
- Respect the Community Code of Conduct
- Respect the Intigriti Terms and Conditions
- Respect the scope of the program
- Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
- Utilize an @intigriti.me account for any authenticated interactions with web or desktop applications
- Avoid testing of any WP Engine or Flywheel customer sites, nominally located on the *.wpengine.com or *.flywheelsites.com subdomains.
Restrictions Security researchers who reside in countries sanctioned or embargoed by the United States (U.S.) Government or are on a U.S. Government list of sanctioned individuals are prohibited from participating in WP Engine's VDP program, and are therefore not eligible for bounty or bonus payments.
You may not participate in this program if you are ordinarily resident in, or located in, any country or region subject to comprehensive sanctions, or if you are an individual or entity identified on any applicable sanctions list (including those administered by OFAC, the EU, the UN, or the UK's OFSI).
In scope
We are happy to announce our first bug bounty program on the Intigriti platform! We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed! We are specifically looking for
- Exposure of sensitive data in the WP Engine User Portal, Flywheel App, as well as on the associated platforms
- Horizontal / vertical privilege escalation
- SQLi
- Code execution on internal hosts or services
- SSRF
Any other issues that have a demonstrated security impact, aside from those in the Out of scope section below, are eligible for submission.
Out of scope
Customer Support Interactions
- https://wpengine.com/contact/
- https://getflywheel.com/schedule-a-demo/
- Any other Live Chat, Phone, or Email interactions with our Support, Sales or Onboarding teams
Domains
- Any domain that is not listed in the Domains section, is out of scope for this program
Application
- API key disclosure without proven business impact
- Wordpress usernames disclosure
- Pre-Auth Account takeover/OAuth squatting
- Self-XSS that cannot be used to exploit other users
- Verbose messages/files/directory listings without disclosing any sensitive information
- CORS misconfiguration on non-sensitive endpoints
- Missing cookie flags
- Missing security headers
- Cross-site Request Forgery with no or low impact
- Presence of autocomplete attribute on web forms
- Reverse tabnabbing
- Bypassing rate-limits or the non-existence of rate-limits.
- Best practices violations (password complexity, expiration, re-use, etc.)
- Clickjacking without proven impact/unrealistic user interaction
- CSV Injection
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- Tokens leaked to third parties
- Anything related to email spoofing, SPF, DMARC or DKIM
- Content injection without being able to modify the HTML
- Username/email enumeration
- Email bombing
- HTTP Request smuggling without any proven impact
- Homograph attacks
- XMLRPC enabled
- Banner grabbing/Version disclosure
- Not stripping metadata of files
- Same-site scripting
- Subdomain takeover without taking over the subdomain
- Arbitrary file upload without proof of the existence of the uploaded file
- Blind SSRF without proven business impact (pingbacks are not sufficient)
- Disclosed/misconfigured Google Maps API keys
- Host header injection without proven business impact
General
- In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
- Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
- Spam, social engineering and physical intrusion
- DoS/DDoS attacks or brute force attacks
- Vulnerabilities that only work on software that no longer receive security updates
- Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
- Recently discovered zero-day vulnerabilities found in in-scope assets within 7 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
- Reports that state that software is out of date/vulnerable without a proof-of-concept
Severity
This program follows Intigriti's triage standards
FAQ
Where can we get credentials for the app?
Credentials for the WP Engine User Portal will be available soon. Researchers may sign up for the Flywheel App using their @intigriti.me account (SMS Verification required).