Free tools Windows power users keep installed
One-click scans. No signup required.
For a suspected vulnerability in self-hosted WordPress Core, report it privately through the WordPress HackerOne program. Show a reproducible security impact, keep the details confidential while a fix is pending, and do not assume a bounty is guaranteed. The right reporting route depends on whether the issue affects Core, WordPress.com, an Automattic-maintained product, a plugin, or another project.
What counts as a WordPress security issue?
The key question is whether a bug lets an attacker access a site or data they should not be able to access. A hacked site alone does not establish a vulnerability: a report needs to explain how the attacker gained access and what WordPress code flaw enabled it. Losing a password or access is not a security issue unless a WordPress code bug caused that loss. The Core handbook distinguishes security reporting from general product support; see Reporting Security Vulnerabilities.
WordPress’s September 1, 2026 disclosure-program update emphasizes clear, significant security impact. It encourages reports of issues exploitable without authentication or by low-privileged users, such as Subscribers. For covered assets other than WordPress Core and Gutenberg, administrator-only prerequisites generally make a report ineligible unless there is a high-severity escalation and security impact. A role doing something normally available to another authenticated role is generally not enough by itself. Core and Gutenberg follow their existing eligibility guidance, so do not apply that non-Core rule to them without checking the current policy. Read the program update and the live program terms.
Where should you report a vulnerability?
Identify the affected product and its owner before submitting anything. The reporting route differs by project:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Self-hosted WordPress Core: Submit privately through the WordPress HackerOne program. Do not post suspected security issues on the support forums or Core Trac. This applies even to trunk, beta, or release-candidate code, because sites may run those versions in production.
- WordPress.com or an Automattic-maintained product: The Core handbook directs reports to Automattic’s HackerOne program.
- A WordPress plugin: Use the separate plugin security-reporting instructions referenced by the Core handbook. Do not assume a plugin issue belongs in the Core program.
- Another project or infrastructure: Check the project owner’s security instructions and the current WordPress HackerOne policy. The repository policy describes coverage of Core, related projects, and infrastructure, but the live program maintains the exact covered asset list.
The repository security policy includes a changing supported-branches table. Supported software versions and bounty eligibility are not interchangeable: the table does not establish that every listed branch has identical eligibility. Confirm the current policy before making a version-specific claim or report.
What should a vulnerability report include?
A useful report makes it possible for the security team to understand and verify both the flaw and its consequences. WordPress asks researchers to establish that an issue is a security problem; HackerOne’s general guidance calls for concise, clear reproduction steps or a working proof of concept. Structure the report around the following details:
- Affected asset and version: Name the WordPress component, project, or product and the version or versions where you reproduced the issue.
- Attacker starting point: State whether exploitation requires no account, a low-privileged account, an administrator, or some other access, and list any other prerequisites.
- Reproduction: Give ordered steps, expected and actual results, and a proof of concept where it helps verify the behavior.
- Security impact: Explain what unauthorized access or other security consequence the flaw enables. A bug description without a demonstrated security consequence may not meet the program’s criteria.
These elements translate the official reporting and impact guidance into a practical outline; they are not a quoted WordPress checklist. Avoid including third-party personally identifiable information in a demonstration. HackerOne’s general Vulnerability Disclosure Guidelines provide broader submission guidance, while the specific WordPress program policy controls its own scope and terms.
Why must disclosure stay private?
Private reporting gives the project a chance to investigate, coordinate, and prepare a fix before details are exposed. The WordPress handbook says not to share vulnerability details with anyone else until the fix has been officially released. HackerOne’s general guidance also describes reports as initially non-public so teams can remediate. Follow the terms in the applicable WordPress program policy; general platform guidance does not establish a universal deadline for public disclosure.
Recommended Free Tools
WordPress explains the rationale in its reporting handbook: “It is standard practice to responsibly and privately disclose security vulnerabilities directly to the vendor (the WordPress core development team, in this case) so a fix can be coordinated and prepared in private, and damage from the vulnerability minimized.”
Does reporting a WordPress vulnerability guarantee a bounty?
No. HackerOne’s general guidelines say some security programs offer monetary rewards and some do not; the security team decides whether to award a bounty and how much. Payment can also depend on eligibility and applicable program restrictions. The specific WordPress payout terms can change, so check the live WordPress policy rather than relying on an old announcement. The available guidance does not establish a current WordPress payout table, and no amount should be assumed.
WordPress has announced time-limited bounty bonuses around particular beta and release-candidate periods in the past. Those announcements apply to their specified release cycles, not as standing rewards. The September 2026 program update says the Security Team is focusing reports on valid vulnerabilities with clear, significant impact, as part of broader work on security releases, a backlog of findings, and proactive research and tooling. It directs suspected Core vulnerabilities to the WordPress HackerOne channel.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to decide whether and where to report
Before submitting, check the factors that determine fit and eligibility:
- Asset and owner: Confirm whether the affected code belongs to Core, Gutenberg, WordPress.com, a plugin, an Automattic product, or another project.
- Access and prerequisites: Record the attacker’s authentication state, role, and required conditions. Eligibility guidance differs across assets.
- Demonstrated impact: Explain the unauthorized security consequence rather than reporting only a malfunction or a compromised site.
- Release status: Identify the affected versions and whether the code is released, in a beta, or a release candidate; do not treat pre-release code as safe to disclose publicly.
- Current program terms: Verify scope, eligibility, and disclosure conditions in the live policy for the relevant program. These terms and supported branches can change.
For current program announcements, consult the WordPress Security Team page. Program-specific HackerOne terms are authoritative for participation; the platform’s general guidance is not a substitute for them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
