In June 2026, the Wordfence Bug Bounty Program received 1066 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate.
Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency.
Join the Wordfence Bug Bounty Program
Help secure the WordPress ecosystem while earning rewards for your security research.
We’re actively seeking skilled researchers to identify vulnerabilities in WordPress plugins and themes, with prompt payments and transparent processes.
As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle.
In this report, we highlight key metrics of the Bug Bounty Program from June 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed.
If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page.
WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software
Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database.
This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster.
Program Submission Highlights – June 2026
The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly.
Real-Time Protection Impact
Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days.
Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure.
Total Submissions
Active Researchers
High Threat
Common & Dangerous
WAF Rules Released
Vulnerability Focus Areas
- High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations.
- Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations.
Bounty Insights – June 2026
Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users.
Total Bounties Awarded
Average Bounty Per Submission
Highest Single Bounty
Top 5 Bounties Awarded
Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges.
WordPress Software Vulnerability Submission Insights – June 2026
This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most.
Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential.
Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate
| In Scope | Out of Scope | Rejected | Duplicate |
|---|---|---|---|
| 185 | 1 | 578 | 302 |
Top 10 Most Commonly Submitted In-Scope Vulnerability Types
The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem.
| Vulnerability Type | Total Submissions | Total Rewards | Avg. Reward |
|---|---|---|---|
| CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 60 | $5,710.00 | $95.17 |
| CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 21 | $2,488.00 | $118.48 |
| CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 20 | $1,839.00 | $91.95 |
| CWE 269: Improper Privilege Management | 15 | $4,599.00 | $306.60 |
| CWE 434: Unrestricted Upload of File with Dangerous Type | 9 | $1,995.00 | $221.67 |
| CWE 287: Improper Authentication | 4 | $11,304.00 | $2,826.00 |
| CWE 862: Missing Authorization | 8 | $906.00 | $113.25 |
| CWE 639: Authorization Bypass Through User-Controlled Key | 5 | $207.00 | $41.40 |
| CWE 347: Improper Verification of Cryptographic Signature | 2 | $10,725.00 | $5,362.50 |
| CWE 94: Improper Control of Generation of Code (‘Code Injection’) | 3 | $678.00 | $226.00 |
Top 10 Highest Rewarded In-Scope Vulnerability Types
While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value.
| Vulnerability Type | Total Rewards | Total Submissions | Avg. Reward |
|---|---|---|---|
| CWE 287: Improper Authentication | $11,304.00 | 4 | $2,826.00 |
| CWE 347: Improper Verification of Cryptographic Signature | $10,725.00 | 2 | $5,362.50 |
| CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | $5,710.00 | 60 | $95.17 |
| CWE 269: Improper Privilege Management | $4,599.00 | 15 | $306.60 |
| CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | $2,488.00 | 21 | $118.48 |
| CWE 434: Unrestricted Upload of File with Dangerous Type | $1,995.00 | 9 | $221.67 |
| CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | $1,839.00 | 20 | $91.95 |
| CWE 862: Missing Authorization | $906.00 | 8 | $113.25 |
| CWE 94: Improper Control of Generation of Code (‘Code Injection’) | $678.00 | 3 | $226.00 |
| CWE 23: Relative Path Traversal | $675.00 | 1 | $675.00 |
In-Scope Vulnerability Distribution by Authentication Level
Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure.
| Authentication Level | Total Vulnerabilities | Avg. Reward |
|---|---|---|
| Unauthenticated | 89 | $359.80 |
| Subscriber | 37 | $89.36 |
| Contributor | 30 | $49.73 |
| Author | 15 | $18.83 |
| Custom | 10 | $1,142.67 |
| Unauthenticated – UI Required | 7 | $116.57 |
Vulnerability Submission Install Count Spread
Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it.
| Install Range | Total Vulnerabilities | Average CVSS | Avg. Reward |
|---|---|---|---|
| 1,000–49,999 | 63 | 7.34 | $108.00 |
| 100,000–999,999 | 36 | 6.70 | $205.09 |
| Off-Repo | 32 | 8.52 | $670.73 |
| 0–499 | 17 | 8.55 | $22.41 |
| 50,000–99,999 | 17 | 6.58 | $209.08 |
| 500–999 | 8 | 7.45 | $26.57 |
| 1,000,000–4,999,999 | 4 | 7.53 | $1,502.25 |
| 5,000,000+ | 1 | 6.4 | $72.00 |
Top WordPress Security Researchers – June 2026
Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence.
Top 5 Researchers based on Volume of In-Scope Submissions
Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates.
| Researcher | Total Submissions | Avg. Reward |
|---|---|---|
| daroo | 9 | $485.80 |
| Rafie Muhammad | 8 | $208.13 |
| CHOIGYEONGMIN | 8 | $21.63 |
| 0xd4rk5id3 | 7 | $188.57 |
| Athiwat Tiprasaharn (Jitlada) | 6 | $14.17 |
Top 5 Researchers Based on Average CVSS of In-Scope Submissions
Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps.
| Researcher | Average CVSS | Total Submissions | Avg. Reward |
|---|---|---|---|
| Khaled Alenazi (Nxploited) | 9.80 | 2 | $390.00 |
| Hieus | 9.80 | 1 | $23.00 |
| h0xilo | 9.80 | 1 | $342.00 |
| vtim | 9.80 | 1 | $5,200.00 |
| Jiemook | 9.80 | 2 | $65.50 |
Top 5 Researchers Based On Total Bounties Earned
Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting.
| Researcher | Total Earned | Total Submissions | Avg. Reward |
|---|---|---|---|
| vtim | $5,200.00 | 1 | $5,200.00 |
| daroo | $4,858.00 | 9 | $539.78 |
| d.v4n_s3c | $2,038.00 | 5 | $407.60 |
| sorin vasile | $1,950.00 | 1 | $1,950.00 |
| Rafie Muhammad | $1,665.00 | 8 | $208.13 |
Researchers Promoted to the Next Tier
Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly.
Elite Researcher Tier (1337)
Resourceful Researcher Tier
Current WordPress Bug Bounty Program Promotions
As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem.
At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions.
Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion.
No promotions currently running.New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator.
Critical WordPress Software Vulnerability Highlights – June 2026
These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional.
If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code.
Attackers Actively Exploiting Critical Vulnerability in Everest Forms Pro Plugin
Everest Forms Pro <= 1.9.12 – Unauthenticated Remote Code Execution via Calculation Field
h0xilo
$325.00
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon’s process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the “Complex Calculation” feature.
Read the complete vulnerability analysis
Attackers Actively Exploiting Critical Vulnerability in Burst Statistics Plugin
Burst Statistics 3.4.0 – 3.4.1.1 – Authentication Bypass to Admin Account Takeover
Wordfence PRISM
N/A
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.
Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin
Kirki 6.0.0 – 6.0.6 – Unauthenticated Privilege Escalation via ‘handle_forgot_password’
CHOIGYEONGMIN
$6,436.00
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) – Unauthenticated Authentication Bypass via UpdraftCentral udrpc
Critical Unauthenticated Authentication Bypass Vulnerability Patched in UpdraftPlus WordPress Plugin
vtim
$5,200.00
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 (free) and versions up to 2.26.5 (premium) via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels
Multiple ShapedPlugin Plugins < (Various Versions) – Backdoored Software
Shane
N/A
As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to our Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signatures set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of our mission to secure the web by Defense in Depth.
Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin
Gravity SMTP <= 2.1.4 – Unauthenticated Sensitive Information Exposure via REST API
Osvaldo Noe Gonzalez Del Rio (Os)
$800.00
The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin’s register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.
Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin
Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value
daroo
$3,600.00
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate ‘delete’ cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.
Conclusion
WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites.
If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer.
The post Wordfence Bug Bounty Program Monthly Report – June 2026 appeared first on Wordfence.