Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
In just a few short months since our launch in November of last year, the Wordfence Bug Bounty Program has already awarded over $153,000 in bounties to WordPress security researchers who have been responsibly reporting security issues in WordPress plugins and themes to us through our program. We have been validating these vulnerabilities, and then working directly with vendors through our responsible disclosure process to ensure that they are adequately patched from exploitation.
The amount of bounties we have awarded is more than any third-party managed WordPress Bug Bounty Program in the history of WordPress. We have been nothing short of thrilled by the contribution of talented researchers to our program, and the positive impact this work is having on the security of the WordPress ecosystem.
These amazing ethical hackers have discovered and reported some very dangerous vulnerabilities in WordPress plugins and themes that could have impacted millions of users. Instead, the bugs were responsibly reported and patched, protecting end users from the possibility of an 0-day attack, where a vulnerability is discovered by a threat actor before a patch has been released.
Our sincere thanks and congratulations go out to all of the researchers who have participated in the program, submitted bugs, and earned rewards.
Since our launch date, we’ve seen:
- 1,359 Vulnerabilities Submitted
- 899 In-Scope Vulnerabilities Submitted
- $153,057.00 in Bounty Rewards Paid
- Top Bounties Paid
- $4,150.00 paid for an undisclosed vulnerability in a plugin with 400,000 active installations
- $4,125.00 paid for an authorization bypass to privilege escalation vulnerability in a plugin with 400,000 active installations
- $2,776.00 paid for an unauthenticated remote code execution vulnerability in a plugin with 80,000 active installations
We’ve already published 441 of those Vulnerabilities to our free Wordfence Intelligence Vulnerability Database.
As a reminder, this data is free to use via our API or web interface, and you can utilize our free webhooks to receive instant notifications anytime a vulnerability is added, changed, or deleted in our database.
Why We Created The Best Bug Bounty Program In WordPress
The Wordfence mission is to secure the web. To this end, we believe we’ve created the best WordPress bug bounty program possible to give developers, researchers, and ethical hackers a place to contribute their skills and be very well rewarded for it.
Bug Bounty is one of the fastest, safest, and most effective ways to discover and report security flaws in software. It’s used by most of the biggest software companies in the world because it’s so effective. And the more money these bug bounty programs pay out in rewards, the more attention they get from professional ethical hackers. We believe the entire WordPress community deserves the same treatment that these massive venture-backed tech companies receive. That’s why we offer the highest bug bounty payouts in WordPress.
And that’s why we’re excited to make the announcement that just a few short months after its launch, our bug bounty program has already rewarded over $153,000 to researchers, with plenty more to come! We are beyond proud of this investment in making WordPress more secure, and we’re looking forward to seeing the impact for years to come.
Why Care? Bug Bounty Makes The Web A Safer Place.
So how does this exciting announcement affect you as a WordPress site owner?
The short answer is – the more bugs we find, the safer your websites become.
Bug bounty is a unique method for discovering vulnerabilities that is community driven and very similar to the philosophy of open source software that is at the heart of WordPress and Wordfence.
The power lies in the fact that bug bounty researchers are not limited by a single plugin or theme developer’s budget, timeline, or other resources. They are not limited by a CEO’s narrow vision, or a CTO’s lack of prioritization. They are free to explore code on their own time, and leverage any of their unique skills and tools to find as many bugs as they possibly can. Some harness the power of automation tools, some use Sherlock Holmes-like forensic detective skills, some use their developer and coding training, and some hackers lean on sheer determination and hard work. Most use a clever combination of all of the above.
Hackers think differently. They look in places that a well-trained team of developers might not even think of. They test, prod, and break things. And we love that. We want to encourage that type of creative, relentless, and innovative thinking to secure the web. We hope that by fostering this research, we’ll be able to get the most critical vulnerabilities in WordPress software off of the internet before threat actors can find them.
Bug Bounty Also Makes The WordPress Community A Safer Place
When there are undiscovered security vulnerabilities in WordPress plugins and themes, it puts many of the 835 million websites powered by WordPress in danger.
The longer these vulnerabilities remain undiscovered, the longer bad actors have to discover them and exploit them to hack WordPress websites, steal information and identities, and do damage to millions of businesses that are powered by WordPress without WordPress site owners knowing or having adequate protection.
By encouraging independent ethical hackers to look for and submit bugs and vulnerabilities in WordPress plugins and themes, we find vulnerabilities much faster — which means you are protected faster.
Once a vulnerability is validated by our team, we ensure the Wordfence firewall has adequate protection for the perceived threat, and if not new vulnerability protection is added to the Wordfence firewall to protect our 5 million users. Wordfence Premium, Care, and Response Customers receive this protection in real-time, while Wordfence free users receive this protection after a 30 day delay.
They are then promptly reported to the plugin and theme developers via our responsible disclosure process to ensure that they are alerted to the vulnerabilities and can release patches to their software as fast as possible. Once our team verifies a vulnerability has been patched, or we’ve determined that a vendor is unresponsive or won’t fix the issue, they are added to the Wordfence Intelligence vulnerability database. This database is used to power the Wordfence vulnerability scanner to alert users that a plugin or theme needs an update, and is also free for organizations and enterprises to use via our API, webhooks, and Wordfence CLI.
Bug Bounty Is A Great Way To Earn Money and Give Back For WordPress Developers and Ethical Hackers
Our program isn’t just helping normal website owners either. It’s also a way for WordPress developers and bug bounty researchers to earn money by finding and reporting security flaws in popular WordPress software.
Researchers can earn up to $10,000 per reported vulnerability right now, which is an amazing incentive for developers and ethical hackers alike to turn their coding knowledge into extra income. We’re proud and happy to provide back to the community that is giving so much towards the security of the WordPress ecosystem. And it’s not just about earning money – our platform offers a way for you to earn CVEs, build your bug bounty skills, and give back to the WordPress community while we freely share the vulnerability information with the community.
Sign up as a researcher today so you’re ready when you’ve got your first vulnerability to report!
The Wordfence bug bounty program is unique because we have a uniquely wide scope (any WordPress plugin or theme that has over 50,000 installs) and is having new code added to that scope daily. Once you’ve become a 1337 researcher, your scope automatically increases to any plugin or theme with over 1,000 active installs.
It’s a perfect program for beginners and seasoned veteran bug bounty hunters to apply their talents.
Join In The Fun! Get Started With Bug Bounty By Joining The Wordfence Bug Bounty Program Today
If you are a WordPress developer, ethical hacker, or if you want to learn about bug bounty and get started – the best first steps are to sign up as a researcher and join our Discord community today.
Click Here To Sign Up As A Researcher Today and join our Discord!
Then, you can check out the resources at the bottom of this page to help you get started and learn how to find vulnerabilities, submit them, and earn money from the Wordfence bug bounty program.
Thank You To Our Amazing Researchers
We want to thank all of the amazing researchers who have joined the program, submitted vulnerabilities, and congratulate everyone who has earned rewards. The web is a safer place because of you!
There are new vulnerabilities being created daily, and our researchers have barely scratched the surface, so there will be plenty more rewards to come. So keep on hacking.
Check Out These Additional Resources To Help You Start With WordPress Bug Bounty
- Common WordPress Vulnerabilities and Prevention Through Secure Coding Best Practices (PDF)
- The Wordfence 2023 State of WordPress Security Report (PDF)
- “Popping WordPress Plugins” Interview With Wordfence Senior Researcher Ram Gall On The Critical Thinking Podcast
- “How To Hack WordPress” Youtube Video – by Bug Bounty Reports Explained
The post Record Breaking $153,000+ Already Invested into the Security of the WordPress Ecosystem by Wordfence – More to Come! appeared first on Wordfence.
