Report a Security Vulnerability | WPSec.com | Online WordPress Security Scan for Vulnerabilities

Vulnerability Reporting Program

Scope of Vulnerability Reporting Program

Any vulnerability that could negatively impact confidential data discovered in a WPSec application, API, or content found on wpsec.com or any associated domains will be eligible for inclusion in the program. Any research or testing that might affect the availability, or degrade the performance, of the WPSec services is strictly prohibited.

Safe Harbor

WPSec considers security research and vulnerability disclosure conducted in good faith and in accordance with this policy to be authorized. We will not pursue or support legal action against researchers who act in good faith, only interact with accounts they own or have explicit permission to access, make every effort to avoid privacy violations, data destruction, and interruption or degradation of our services, and give us a reasonable opportunity to resolve an issue before any public disclosure. If a third party initiates legal action against you for activities conducted in accordance with this policy, we will make our authorization known. If you are ever unsure whether your testing is consistent with this policy, contact us at security [at] wpsec [dot] com before proceeding.

How to Report an Issue

If you believe you have found a security flaw in our software, please contact security [at] wpsec [dot] com using our PGP-key (below). We ask you do not publicly disclose suspected vulnerabilities until we have confirmed a fix is available. Please include your preferred contact method, and enough details to allow us to efficiently reproduce the issue. You can use our PGP public key (below) to encrypt your communications to us. Contact us if you have any questions about our responsible disclosure policy, or refer to the OWASP Vulnerability Disclosure Cheat Sheet for general best practices for security researchers.

Response and Recognition

We will investigate and get back to you as soon as possible, usually within one or two business days. If you are interested in helping find the solution, let us know and we’ll involve you as much as we can. To acknowledge the first person who alerts us to a previously unknown and non-trivial security issue, we show our appreciation by adding their name to the Acknowledgments section on this page, and offer them a cool WPSec Vulnerability T-shirt.

We’ll ask you for:

Your name, website, and handle as you’d like it displayed on this page. Your shipping address and T-shirt size.

Acknowledgements

We thank these people and organizations for making our service more secure:

No one yet — be the first.

Out of scope

* Issues related to software not under WPSec control such as E-mail clients
* Reports from automated web vulnerability scanners that are not validated
* Issues that need social engineering for successful exploitation
* Any physical attempts against WPSec property or data centers
* Social engineering attacks against WPSec employees
* Missing autocomplete attributes
* Missing security flags on non-security-sensitive cookies
* Username or Email enumeration
* Session errors - Such as invalidating sessions on logout or password change
* Missing Best practices
* Spamming
* Issues that require physical access to a victim’s computer for successful exploitation.
* Open ports without an accompanying proof-of-concept demonstrating vulnerability.
* XSS issues that affect only outdated browsers.
* Tab nabbing and window.opener-related issues.
* Issues related to absence of CAA DNS record.
* Discrepancy related to permissions for owner and moderator role.
* Phishing using Open Redirection. Exceptions: Open redirection that leads to leakage of OAuth Access Token, bypass of Content Security Policy,etc.
* Content Spoofing / Content Injection issues
* Banner grabbing issues (Finding info like webserver name, etc.)
* Cross-site Request Forgery (CSRF)
* Issues related to SPF, DKIM and DMARC
* Reflected File Download
* Error Stack Trace or 401/403/500 Server error without an accompanying evidence of vulnerability
* Self-XSS including cases where user himself pastes javascript code into the browser.
* Issues without clearly identified security impact, such as clickjacking on a static website, descriptive error messages, HTTP OPTIONS method enabled, etc.
* Issues related to Payment Fraud.
* Business logic errors, such as bypassing premium features, plan or account limits, and other workflow abuse. Exception: logic flaws that expose another user's confidential data are in scope.
* Issues related to Mixed Content
* iframe/frame related bugs
* Clickjacking (we're actively working on this)
* Brute Force protections

Automated Scanning

If you employ automated scanning tools, their requests must be rate limited to not exceed 3 requests per second without prior approval. Failure to do so may be considered a DoS attack and will result in disqualification from the program.

Automated vulnerability scanners commonly have low priority issues and/or false positives. Before submitting the results from a scanner, please take a moment to confirm that the reported issues are actually valid and exploitable. Please submit an issue only if you have exploited a real vulnerability.

PGP Key

Use the key below when reporting vulnerabilities to security [at] wpsec [dot] com, thanks.