WordPress

{
  "id": 0,
  "url": "https://hackerone.com/wordpress",
  "name": "WordPress",
  "handle": "wordpress",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.buddypress.org,bbpress.org,profiles.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "**Do _not_ pentest Trac instances**, it's very annoying to clean up after. Setup a local environment instead; the custom source code is available via the Git command below, in the `trac.wordpress.org` subfolder. **If you ignore this you'll forfeit any bounty.**\n\nThe projects here are kept mostly for archival purposes and non-critical information disclosure will generally not be eligible for a bounty.\n\nOnly report vulnerabilities in our custom code, don't report vulnerabilities that only exist upstream in Trac itself. Report those directly to info@edgewall.com.\n\nAll source code that isn't behind authentication is intended to be public. The source code itself has `High` CVSS impact scores. The applications that manage the code (Trac, Git, SVN, etc) have `Low` scores, except for vulnerabilities that allow modifications to the source code.\n\nMost of the source code in these domains is contained in the \"meta\" repository: `git clone git://meta.git.wordpress.org/`",
        "max_severity": "critical",
        "asset_identifier": "*.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.wordcamp.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "Only the jobs.wordpress.net site is eligible for bounty.\n\nIssues with playground.wordpress.net should use the \"Playground\" asset.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "low",
        "asset_identifier": "*.wordpress.net",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "All wordpress.org domains that **are not listed in other assets**, including (but not limited to) the following:\n* login.wordpress.org\n* developer.wordpress.org\n* make.wordpress.org\n* translate.wordpress.org\n* global.wordpress.org, {locale}.wordpress.org (e.g., de.wordpress.org, es-mx.wordpress.org)\n* learn.wordpress.org\n\nIssues are in scope only if they can be exploited without an authenticated user account or with the default user role that's granted when an account is created on wordpress.org. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "*.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Download source code from: https://buddypress.org/download/\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "BuddyPress Core",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "The Create Block Theme plugin at https://github.com/WordPress/create-block-theme.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible.",
        "max_severity": "critical",
        "asset_identifier": "Create Block Theme",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "All code located under [the GlotPress organization](https://github.com/GlotPress/) on GitHub.\n\nThe most important target is the `glotpress-wp` repository. Other repositories are in scope, but may have a lower importance.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "GlotPress",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Download source code from https://github.com/WordPress/gutenberg",
        "max_severity": "critical",
        "asset_identifier": "Gutenberg",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Only plugins that are officially maintained by WordPress.org are in scope. Most plugins have their own asset, use this asset only for those that don't.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.\n\nNote that some third-party plugins incorrectly list `wordpressdotorg` as a contributor or developer. These are not in scope.",
        "max_severity": "critical",
        "asset_identifier": "Official WordPress plugins",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Please check all other assets before using this one.\n\nThis only covers repos under https://github.com/wordpress that are not covered by any other asset.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible.",
        "max_severity": "critical",
        "asset_identifier": "Other github.com/wordpress repos",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Covers https://playground.wordpress.net and https://github.com/WordPress/wordpress-playground .\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "Playground",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "The SQLite Database Integration plugin at https://github.com/WordPress/sqlite-database-integration.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "SQLite Database Integration",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "The Secure Custom Fields plugin at https://github.com/WordPress/secure-custom-fields.\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "Secure Custom Fields",
        "eligible_for_bounty": true,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "All code located under [the WP-CLI organization](https://github.com/wp-cli) on GitHub.\n\nThe most important targets are the main `wp-cli` repository, and any repositories for commands that are bundled with the distributed `wp-cli` source code, like `cache-command`, `scaffold-command`, etc.\n\nOther repositories are in scope, but may have a lower importance.",
        "max_severity": "critical",
        "asset_identifier": "WP-CLI",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Download source code from: https://wordpress.org/download/source/",
        "max_severity": "critical",
        "asset_identifier": "WordPress Core",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "api.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "Download source code from: https://bbpress.org/download/\n\nIssues are in scope only if they can be exploited without an authenticated user account. Issues that require authenticated roles like Contributor+ or those that can only be granted by an admin are ineligible unless you can demonstrate a significant and high impact escalation, like a clear path to admin escalation or remote code execution.",
        "max_severity": "critical",
        "asset_identifier": "bbPress Core",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "These are wikis, they're intended to be freely edited by anonymous users. We are not interested in vulnerabilities unless they have a severe impact.",
        "max_severity": "medium",
        "asset_identifier": "codex.wordpress.org,codex.bbpress.org,codex.buddypress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "doaction.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "This site runs uses [the WooCommerce plugin](https://woocommerce.com/), but we don't accept reports for that. We only accept reports for our custom code. If you find any vulnerabilities that are also present in WooCommerce itself, please [report them to Automattic](/automattic).\n\nPlease don't submit test orders (especially automated ones). They don't test any of our custom code, and are a pain to clean up.\n\nAdditionally, price manipulation is a common invalid report, please see #682344.",
        "max_severity": "medium",
        "asset_identifier": "mercantile.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "none",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "planet.wordpress.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "medium",
        "asset_identifier": "wordpressfoundation.org",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "none"
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "All WordPress.com vulnerabilities should be reported to [Automattic's HackerOne program](https://hackerone.com/automattic). \n\n**WordPress.com vulnerabilities reported here will be marked as `Not Applicable`.**",
        "max_severity": "none",
        "asset_identifier": "*.wordpress.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "**Please, report vulnerabilities for the WordPress mobile apps through the [Automattic HackerOne page](/automattic).**\n",
        "max_severity": "none",
        "asset_identifier": "335703880",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "Archived code repositories (e.g. in GitHub) are out of scope, unless you have verified that code from it is imported and actively being used.",
        "max_severity": "none",
        "asset_identifier": "Archived GitHub repositories",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "Unless otherwise noted, we own and operate dedicated servers, rather than using services like AWS, Digital Ocean, etc. Third-parties frequently create S3 buckets, droplets, etc that have security issues, and have \"WordPress\" in the name. These are not ours, and reports about them will be closed as `Not Applicable`.",
        "max_severity": "none",
        "asset_identifier": "Digital Ocean, AWS, etc",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "**Please, report vulnerabilities for the WordPress mobile apps through the [Automattic HackerOne page](/automattic).**\n",
        "max_severity": "none",
        "asset_identifier": "https://github.com/wordpress-mobile/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "These are public logs of very old conversations. We are not interested in vulnerabilities unless they have a severe impact (e.g., RCE, XSS, modifying the logs, etc). DoS is not severe in this case.",
        "max_severity": "none",
        "asset_identifier": "irclogs.wordpress.org",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": false,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "URL",
        "instruction": "We are not interested in vulnerabilities unless they have a severe impact.",
        "max_severity": "none",
        "asset_identifier": "lists.wordpress.org",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": false,
        "availability_requirement": "low",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "We are not interested in vulnerabilities unless they have a severe impact (e.g., RCE, SSRF). Metrics data is intentionally made public.",
        "max_severity": "none",
        "asset_identifier": "munin-*.wordpress.org",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": false,
        "availability_requirement": "none",
        "confidentiality_requirement": "none"
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "**Please, report vulnerabilities for the WordPress mobile apps through the [Automattic HackerOne page](/automattic).**\n",
        "max_severity": "none",
        "asset_identifier": "org.wordpress.android",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "These are hosted on WordPress.com and we don't have access to modify the code, servers, etc. Check [Automattic's HackerOne program](https://hackerone.com/automattic) for details on reporting vulnerabilities with WordPress.com sites.",
        "max_severity": "none",
        "asset_identifier": "status.wordpress.org,glotpress.blog,wordpress.tv",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://wordpress.org/",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 710,
  "response_efficiency_percentage": 90,
  "average_time_to_report_resolved": null,
  "average_time_to_first_program_response": null
}