Filtered by category: WordFence, tag: security research × Clear
Wordfence Bug Bounty Program Monthly Report – June 2026
Matched: WordPress
Wordfence's June 2026 bug bounty report logged 1,066 vulnerability submissions from 306 researchers. Of these, 185 were accepted as in-scope. Total bounties paid reached $42,553, with the top single award of $5,200 going to a researcher who found an authentication bypass in UpdraftPlus affecting 4 million sites. Key findings included remote code execution in Everest Forms Pro, privilege escalation in Kirki, and a supply chain compromise affecting ShapedPlugin plugins.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.