WP Engine VDP

{
  "id": "1e325f65-37de-4094-9079-217e27cab00b",
  "name": "WP Engine VDP",
  "company_handle": "wpengine",
  "handle": "wpengine",
  "url": "https://www.intigriti.com/programs/wpengine/wpengine/detail",
  "status": "open",
  "confidentiality_level": "public",
  "tacRequired": false,
  "twoFactorRequired": false,
  "min_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "max_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "targets": {
    "in_scope": [
      {
        "type": "wildcard",
        "endpoint": "*. advancedcustomfields.com",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "wildcard",
        "endpoint": "*. bettersearchreplace.com",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "wildcard",
        "endpoint": "*.deliciousbrains.com",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "wildcard",
        "endpoint": "*.studiopress.com",
        "description": "The studiopress.com, www.studiopress.com, and my.studiopress.com sites are public facing marketing and WordPress theme e-commerce sites. **No credentials will be provided.** Researchers are free to test functionally that requires authentication with their own accounts. Please note: no reimbursements will be made for money spent to access this part of the application.",
        "impact": "No Bounty"
      },
      {
        "type": "wildcard",
        "endpoint": "*.wpengine.io",
        "description": "This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be \"internal\" services like APIs but have public DNS records and some may be publicly-accessible. To aid in testing, we've provided some initial OSINT for this domain: https://crt.sh/?q=%25wpengine.io",
        "impact": "No Bounty"
      },
      {
        "type": "wildcard",
        "endpoint": "*.wpesvc.net",
        "description": "This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be \"internal\" services like APIs but have public DNS records and some may be publicly-accessible. To aid in testing, we've provided some initial OSINT for this domain: https://crt.sh/?q=%25wpesvc.net",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "app.getflywheel.com",
        "description": "This is the primary site for researchers to register and test both the Flywheel App as well as the Flywheel Platform. We will not provide credentials or bypass verification controls (i.e, a researcher will need to either provide a valid phone number or credit card to have a live site), but a researcher may register a demo site that matches the platform's functionality without verification. **Please use your Intigriti credentials to register.** Please note that any issues regarding an individual WordPress installation on the Flywheel platform, outside of plugins owned by WP Engine/Flywheel, will be considered out of scope as we do not monitor or manage customer content. We are, however, very interested in issues that may compromise customer isolation on the platform or cause data to be leaked from either a host or an unrelated customer site.",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "getflywheel.com",
        "description": "This site is the landing page for Flywheel-branded services. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and chat functionality are out-of-scope - specifically, the Sales Questions functionality or https://getflywheel.com/schedule-a-demo/. No testing should be done against these targets or any 3rd party services. Please do not contact Live Chat agents.",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "https://nitropack.io",
        "description": "With NitroPack, you get everything you need for a fast website, in one place. Features like caching, image optimization, and a CDN are ready to go out of the box.",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "my.wpengine.com",
        "description": "The User Portal for WP Engine. Customers manage their WordPress sites, addons, and billing details through this portal. **No credentials will be provided**. Researchers are free to test functionally that requires authentication with their own accounts. Please note: no reimbursements will be made for money spent to access this part of the application.",
        "impact": "No Bounty"
      },
      {
        "type": "other",
        "endpoint": "NitroPack Plugins",
        "description": "We accept any reports of vulnerabilities in plugins developed by NitroPack, with the exception of any application-level vulnerabilities in the Out of Scope section below.",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "spressforumstg.wpengine.com",
        "description": "The staging environment for the StudioPress community forum, built on WordPress. Researchers are welcome to register an account using their @intigriti.me email address, but should refrain from interacting with the community, making public posts, or performing automated testing which may cause disruption. Do not attempt to gain access to any user accounts not under your control.",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "studiopress.blog",
        "description": "This is a public-facing marketing site built on WordPress. Most of the content on this site consists of static blog posts.",
        "impact": "No Bounty"
      },
      {
        "type": "other",
        "endpoint": "WP Engine-developed WordPress Plugins and Themes",
        "description": "We accept any reports of vulnerabilities in plugins or themes managed or developed by WP Engine, with the exception of any application-level vulnerabilities in the Out of Scope section below.  These free versions closely mirror their paid counterparts, so any vulnerabilities discovered should be applicable to both the paid or free plugins.\n\nWe also accept reports for the following Delicious Brains plugins:\nhttps://wordpress.org/plugins/advanced-custom-fields\n",
        "impact": "No Bounty"
      },
      {
        "type": "url",
        "endpoint": "wpengine.com",
        "description": "This the landing page for the main WP Engine website. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and chat functionality are out-of-scope - specifically, the Sales Questions functionality and wpengine.com/contact/. No testing should be done against these targets or any 3rd party services.",
        "impact": "No Bounty"
      }
    ],
    "out_of_scope": [
      {
        "type": "url",
        "endpoint": " https://getflywheel.com/schedule-a-demo/",
        "description": null,
        "impact": "Out of scope"
      },
      {
        "type": "url",
        "endpoint": "https://wpengine.com/contact/",
        "description": null,
        "impact": "Out of scope"
      }
    ]
  }
}