> Wordfence Bug Bounty Program Monthly Report – July 2026

In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate. Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency. Join the Wordfence Bug Bounty Program Help secure the WordPress ecosystem while earning rewards for your security research. We’re actively seeking skilled researchers to identify vulnerabilities in WordPress plugins and themes, with prompt payments and transparent processes. Start Your Security Research Journey As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle. In this report, we highlight key metrics of the Bug Bounty Program from July 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed. Table of Contents Program Submission Highlights – July 2026 WordPress Software Vulnerability Submission Insights – July 2026 Bounty Insights – July 2026 Top WordPress Security Researchers – July 2026 Current WordPress Bug Bounty Program Promotions Critical WordPress Software Vulnerability Highlights – July 2026 Conclusion   If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page. WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database. This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster. Get Started With the Vendor Portal Today   Program Submission Highlights – July 2026 The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly. Real-Time Protection Impact Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days. Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure. Total Submissions 1077 +1.0% from last month Active Researchers 281 -8.2% from last month High Threat 84 +44.8% from last month Common & Dangerous 73 +62.2% from last month WAF Rules Released 15 +114.3% from last month   Vulnerability Focus Areas High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations. Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations. Bounty Insights – July 2026 Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users. Total Bounties Awarded $51,183 July 2026 Average Bounty Per Submission $210.63 Per validated in-scope submission Highest Single Bounty $15,600 Top researcher reward Top 5 Bounties Awarded Vulnerability Bounty Install Count Elementor Pro <= 4.2.1 – Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass $15,600.00 5,000,000 Forminator Forms <= 1.56.1 – Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration $2,048.00 600,000 User Profile Builder <= 3.16.4 – Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via ‘username’ Parameter $975.00 40,000 Independent Analytics <= 2.15.0 – Unauthenticated Stored Cross-Site Scripting $804.00 100,000 Unlimited Elements For Elementor <= 2.0.16 – Unauthenticated SQL Injection $800.00 300,000 Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges. WordPress Software Vulnerability Submission Insights – July 2026 This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most. Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential. Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate In Scope Out of Scope Rejected Duplicate 243 17 610 207 Top 10 Most Commonly Submitted In-Scope Vulnerability Types The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem. Vulnerability Type Total Submissions Total Rewards Avg. Reward CWE 79: Improper Neutralization of Input During Web Page Generation 80 $13,415.00 $167.69 CWE 434: Unrestricted Upload of File with Dangerous Type 18 $21,909.00 $1,217.17 CWE 89: Improper Neutralization of Special Elements used in an SQL Command 18 $2,968.00 $164.89 CWE 269: Improper Privilege Management 16 $3,245.00 $202.81 CWE 22: Improper Limitation of a Pathname to a Restricted Directory 10 $2,825.00 $282.50 CWE 287: Improper Authentication 11 $1,213.00 $110.27 CWE 639: Authorization Bypass Through User-Controlled Key 9 $816.00 $90.67 CWE 862: Missing Authorization 9 $724.00 $80.44 CWE 94: Improper Control of Generation of Code 3 $121.00 $40.33 CWE 288: Authentication Bypass Using an Alternate Path or Channel 2 $277.00 $138.50   Top 10 Highest Rewarded In-Scope Vulnerability Types While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value. Vulnerability Type Total Rewards Total Submissions Avg. Reward CWE 434: Unrestricted Upload of File with Dangerous Type $21,909.00 18 $1,217.17 CWE 79: Improper Neutralization of Input During Web Page Generation $13,415.00 80 $167.69 CWE 269: Improper Privilege Management $3,245.00 16 $202.81 CWE 89: Improper Neutralization of Special Elements used in an SQL Command $2,968.00 18 $164.89 CWE 22: Improper Limitation of a Pathname to a Restricted Directory $2,825.00 10 $282.50 CWE 287: Improper Authentication $1,213.00 11 $110.27 CWE 704: Incorrect Type Conversion or Cast $975.00 1 $975.00 CWE 639: Authorization Bypass Through User-Controlled Key $816.00 9 $90.67 CWE 862: Missing Authorization $724.00 9 $80.44 CWE 502: Deserialization of Untrusted Data $615.00 1 $615.00 In-Scope Vulnerability Distribution by Authentication Level Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure. Authentication Level Total Vulnerabilities Avg. Reward Unauthenticated 163 $350.84 Subscriber 60 $133.37 Unauthenticated – UI Required 14 $74.00 Custom 4 $19.67   Vulnerability Submission Install Count Spread Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it. Install Range Total Vulnerabilities Average CVSS Avg. Reward 1,000–49,999 81 7.4 $147.53 100,000–999,999 38 7.0 $384.87 Off-Repo 31 9.0 $871.60 0–499 23 9.2 $24.64 500–999 20 7.6 $57.05 50,000–99,999 17 7.1 $134.54 1,000,000–4,999,999 1 7.2 $672.00   Top WordPress Security Researchers – July 2026 Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence. Top 5 Researchers based on Volume of In-Scope Submissions Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates. Researcher Total Submissions Avg. Reward daroo 19 $574.26 d.v4n_s3c 10 $281.30 theviper17y 9 $67.89 Supakiad S. (m3ez) 8 $294.38 Jonah Burgess (CryptoCat) 8 $70.75 Top 5 Researchers Based on Average CVSS of In-Scope Submissions Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps. Researcher Average CVSS Total Submissions Avg. Reward 0xd4rk5id3 9.8 2 $33.00 Talal Nasraddeen 9.8 1 $228.00 Tin Pham (TF1T) 9.8 1 $488.00 Adam Rayyan Aryasatya 9.8 2 $179.00 t4g0 9.8 1 $455.00 Top 5 Researchers Based On Total Bounties Earned Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting. Researcher Total Earned Total Submissions Avg. Reward Austin Ginder $15,810.00 3 $5,270.00 daroo $10,911.00 19 $574.26 d.v4n_s3c $2,813.00 10 $281.30 Supakiad S. (m3ez) $2,355.00 8 $294.38 Adrien Brunner $1,718.00 8 $214.75 Researchers Promoted to the Next Tier Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly. Elite Researcher Tier (1337) 0 researchers advanced to elite status No Elite Researcher Promotions No researchers advanced to elite (1337) status this month Resourceful Researcher Tier 0 researchers advanced to resourceful status No Resourceful Researcher Promotions No researchers advanced to resourceful status this month Current WordPress Bug Bounty Program Promotions As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem. At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions. Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion. No promotions currently running. New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator. Critical WordPress Software Vulnerability Highlights – July 2026 These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional. If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code. WP2Shell WordPress Exploit Technical Analysis and Real Attack Data WordPress Core 6.9 – 7.0.1 – Remote Code Execution via REST API Batch Request Route Confusion Found by: Adam Kues Bounty Awarded: N/A Technical Details: WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route’s input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server. Read the complete vulnerability analysis   Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 – 10.8.8 – Unauthenticated Authentication Bypass via Hardcoded Backdoor in ‘_wplogin’ Parameter Submitted by: Wordfence PRISM Bounty Awarded: N/A Technical Details: The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in versions 10.8.7 and 10.8.8. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress’s `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin’s source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account. Read the complete vulnerability analysis   wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade Submitted by: N/A Bounty Awarded: N/A Technical Details: On Friday, July 17, 2026, the WordPress Security Team released security updates for WordPress Core addressing two vulnerabilities that, when chained together, can lead to unauthenticated remote code execution. The chain, now commonly referred to as wp2shell , was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber , and we want to thank him for his work and responsible disclosure. WordPress released patched versions 6.8.6 , 6.9.5 , and 7.0.2 on July 17. The WordPress release notes describe the update as addressing one critical and one high severity security issue, and state that forced automatic updates were enabled for affected versions due to the severity of the issue. Read the complete vulnerability analysis   Conclusion WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites. If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer. The post Wordfence Bug Bounty Program Monthly Report – July 2026 appeared first on Wordfence.