In brief. WordPress is a bug bounty program on HackerOne. Its critical reports have paid an average of $439 (HackerOne figures, November 9, 2026). It received 2,275 reports in the 90 days to November 9, 2026, about 95 per in-scope asset.
Work at WordPress? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.
Ask BugRater to submit itReports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.
These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 9 Nov 2026.
What it pays, by severity
$200,000 paid to researchers in total, $55,000 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.
Intake & responsiveness, last 90 days
Response targets it sets itself
These are targets the program set. They don't show whether it meets them.
Barriers to submitting
Over 81 days (408 snapshots): intake up 1,135 reports; response efficiency up 29 points; 90-day payout down $5,000.
See how this program’s report load compares to others
Source: HackerOne Hacktivity (public disclosures) Program: https://hackerone.com/wordpress Disclosed reports analyzed: 86 Bounties: none in disclosed reports --- Aggregated from publicly disclosed HackerOne reports. Ratings derived from triage timing and bounty data.
Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.
| # | Researcher | Reputation | Recognised / submitted |
|---|---|---|---|
| 1 | rafiem | 4,274 | 215 / 306 70% |
| 2 | paulos__ | 1,350 | 73 / 100 73% |
| 3 | simonscannell | 410 | 9 / 10 90% |
| 4 | hoangkien1020 | 344 | 12 / 13 92% |
| 5 | skansing | 326 | 13 / 15 87% |
| 6 | bornwinnerrr | 312 | 17 / 26 65% |
| 7 | p4p3r_hak | 278 | 16 / 44 36% |
| 8 | buggedout | 274 | 4 / 5 80% |
| 9 | karimeo | 259 | 6 / 6 100% |
| 10 | foobar7 | 205 | 9 / 10 90% |
| 10 | ysx | 90 | 5 / 5 100% |
| 11 | jakubk | 197 | 18 / 42 43% |
| 12 | ngonhuy | 186 | 12 / 17 71% |
| 13 | yuvraj_dighe | 178 | 9 / 9 100% |
| 14 | svennergr | 136 | 3 / 3 100% |
| 14 | vvh1te3zz | 130 | 14 / 18 78% |
| 15 | argareksapatii | 119 | 7 / 12 58% |
| 16 | codertom | 112 | 7 / 9 78% |
| 17 | jdgrimes | 106 | 5 / 7 71% |
| 18 | ducnt_ | 103 | 3 / 3 100% |
| 18 | kolchylilah | 103 | 7 / 10 70% |
| 20 | evanricafort | 100 | 7 / 21 33% |
| 21 | hanno | 98 | 4 / 5 80% |
| 21 | mopman | 98 | 4 / 4 100% |
| 22 | mickey_cyberkid | 96 | 5 / 5 100% |
Showing the top 25 of 697 credited on HackerOne.
HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 8 Nov 2026.
Beautiful sites of any kind.
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.buddypress.org,bbpress.org,profiles.wordpress.org | WILDCARD | ✓ bounty | Critical |
| *.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org | SOURCE CODE | ✓ bounty | Critical |
| *.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org, github.com/WordPress | SOURCE CODE | ✓ bounty | Critical |
| *.wordcamp.org | WILDCARD | ✓ bounty | Critical |
| *.wordpress.net | WILDCARD | ✓ bounty | Low |
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.wordpress.org | WILDCARD | ✓ bounty | Critical |
| api.wordpress.org | URL | ✓ bounty | Critical |
| bbPress Core | SOURCE CODE | ✓ bounty | Critical |
| BuddyPress Core | SOURCE CODE | ✓ bounty | Critical |
| codex.wordpress.org,codex.bbpress.org,codex.buddypress.org | URL | ✓ bounty | Medium |
| doaction.org | URL | ✓ bounty | Critical |
| github.com/wordpress | SOURCE CODE | ✓ bounty | Critical |
| GlotPress | SOURCE CODE | ✓ bounty | Critical |
| Gutenberg | SOURCE CODE | ✓ bounty | Critical |
| gutenberg.run | URL | ✓ bounty | Low |
| mercantile.wordpress.org | URL | ✓ bounty | Medium |
| Official WordPress plugins | SOURCE CODE | ✓ bounty | Critical |
| planet.wordpress.org | URL | ✓ bounty | Critical |
| Playground | SOURCE CODE | ✓ bounty | Critical |
| Secure Custom Fields | SOURCE CODE | ✓ bounty | Critical |
| SQLite Database Integration | SOURCE CODE | ✓ bounty | Critical |
| WordPress Core | SOURCE CODE | ✓ bounty | Critical |
| wordpressfoundation.org | URL | ✓ bounty | Medium |
| WP-CLI | SOURCE CODE | ✓ bounty | Critical |
| *.wordpress.com | WILDCARD | out | None |
| Archived GitHub repositories | OTHER | out | None |
| Create Block Theme | SOURCE CODE | submit only | Critical |
| Digital Ocean, AWS, etc | OTHER | out | None |
| https://github.com/wordpress-mobile/ | SOURCE CODE | out | None |
| https://github.com/wordpress-mobile/WordPress-iOS | SOURCE CODE | out | None |
| irclogs.wordpress.org | URL | out | None |
| lists.wordpress.org | URL | out | None |
| munin-*.wordpress.org | WILDCARD | out | None |
| org.wordpress.android | GOOGLE PLAY APP ID | out | None |
| Other github.com/wordpress repos | SOURCE CODE | submit only | Critical |
| status.wordpress.org,glotpress.blog,wordpress.tv | URL | out | None |
| wordpress.tv | URL | out | None |
| 335703880 | APPLE STORE APP ID | out | None |
Log in to comment