WP Engine Bug Bounty

{
  "id": "afc4415d-c004-4cf8-9a12-e0f18cde6db5",
  "name": "WP Engine Bug Bounty",
  "company_handle": "wpengine",
  "handle": "wpenginebugbounty",
  "url": "https://www.intigriti.com/programs/wpengine/wpenginebugbounty/detail",
  "status": "open",
  "confidentiality_level": "public",
  "tacRequired": false,
  "twoFactorRequired": false,
  "min_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "max_bounty": {
    "value": 2500,
    "currency": "EUR"
  },
  "targets": {
    "in_scope": [
      {
        "type": "url",
        "endpoint": "https://app.getflywheel.com",
        "description": "This is the primary site for researchers to register and test both the Flywheel App as well as the Flywheel Platform. We will not provide credentials or bypass verification controls (i.e, a researcher will need to either provide a valid phone number or credit card to have a live site), but a researcher may register a demo site that matches the platform's functionality without verification. **Please use your Intigriti credentials to register.** Please note that any issues regarding an individual WordPress installation on the Flywheel platform, outside of plugins owned by WP Engine/Flywheel, will be considered out of scope as we do not monitor or manage customer content. We are, however, very interested in issues that may compromise customer isolation on the platform or cause data to be leaked from either a host or an unrelated customer site.",
        "impact": "Tier 1"
      },
      {
        "type": "url",
        "endpoint": "https://getflywheel.com",
        "description": "This site is the landing page for Flywheel-branded services. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and chat functionality are out-of-scope - specifically, the Sales Questions functionality or https://getflywheel.com/schedule-a-demo/. No testing should be done against these targets or any 3rd party services. Please do not contact our Support or Sales teams as part of your testing.",
        "impact": "Tier 1"
      },
      {
        "type": "url",
        "endpoint": "https://my.wpengine.com",
        "description": "The User Portal for WP Engine. Customers manage their WordPress sites, addons, and billing details through this portal. **No credentials will be provided**. Researchers are free to test functionally that requires authentication with their own accounts. Please note: no reimbursements will be made for money spent to access this part of the application.\n\nResearchers may sign up for a free trial of our Headless Platform which provides full access to the User Portal and WP Engine platform for testing.  The trial signup page can be found at https://wpengine.com/headless-wordpress/ .  Please use your Intigriti researcher email address when signing up.",
        "impact": "Tier 1"
      },
      {
        "type": "url",
        "endpoint": "https://payments.wpengine.com",
        "description": null,
        "impact": "Tier 1"
      },
      {
        "type": "url",
        "endpoint": "https://wpengine.com",
        "description": "This the landing page for the main WP Engine website. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and Live Chat are out-of-scope - specifically, the Sales Questions functionality and https://wpengine.com/contact/. No testing should be done against these targets or any 3rd party services.\n\n**Please Note:** All customer sites on subdomains of wpengine.com, unless explicitly listed as in scope, are out of scope.",
        "impact": "Tier 1"
      },
      {
        "type": "wildcard",
        "endpoint": "*. advancedcustomfields.com",
        "description": null,
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*. bettersearchreplace.com",
        "description": null,
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.deliciousbrains.com",
        "description": null,
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.localwp.com",
        "description": "Local is the #1 local WordPress development tool.",
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.nitropack.io",
        "description": "With NitroPack, you get everything you need for a fast website, in one place. Features like caching, image optimization, and a CDN are ready to go out of the box.",
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.studiopress.com",
        "description": "The studiopress.com, demo.studiopress.com, and my.studiopress.com sites are public facing marketing and WordPress theme e-commerce sites. **No credentials will be provided.** Researchers are free to test functionally that requires authentication with their own accounts.",
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.wpengine.io",
        "description": "This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be \"internal\" services like APIs but have public DNS records and some may be publicly-accessible.",
        "impact": "Tier 2"
      },
      {
        "type": "wildcard",
        "endpoint": "*.wpesvc.net",
        "description": "This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be \"internal\" services like APIs but have public DNS records and some may be publicly-accessible.",
        "impact": "Tier 2"
      },
      {
        "type": "other",
        "endpoint": "WP Engine-developed WordPress Plugins and Themes",
        "description": "We accept any reports of vulnerabilities in plugins or themes managed or developed by WP Engine, with the exception of any application-level vulnerabilities in the Out of Scope section below.  These free versions closely mirror their paid counterparts, so any vulnerabilities discovered should be applicable to both the paid or free plugins.\n\nWe also accept reports for the following plugins:\nAdvanced Custom Fields\nBetter Search Replace \nWP Migrate\nWP Offload Media for Amazon S3, DigitalOcean Spaces, and Google Cloud Storage\nWP Offload SES",
        "impact": "Tier 2"
      },
      {
        "type": "url",
        "endpoint": "https://makeshift.film",
        "description": null,
        "impact": "Tier 3"
      },
      {
        "type": "url",
        "endpoint": "https://studiopress.blog",
        "description": null,
        "impact": "Tier 3"
      },
      {
        "type": "url",
        "endpoint": "https://torquemag.io",
        "description": null,
        "impact": "Tier 3"
      },
      {
        "type": "url",
        "endpoint": "https://velocitize.com",
        "description": "This domain is deprecated and bounties are no longer paid.",
        "impact": "No Bounty"
      }
    ],
    "out_of_scope": [
      {
        "type": "url",
        "endpoint": "marketing.nitropack.io",
        "description": "This asset is hosted at a third-party vendor and is not eligible for bounties.",
        "impact": "Out of scope"
      }
    ]
  }
}