H1 HackerOne LIVE
WordPress
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://wordpress.org/
- managed triage
- no
- response efficiency
- 71%
- time to bounty
- 1036h avg
18 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.wordpress.org | domain | yes | critical | 2026-09-20 |
codex.wordpress.org,codex.bbpress.org,codex.buddypress.org | domain | yes | medium | 2026-09-20 |
doaction.org | domain | yes | critical | 2026-09-20 |
mercantile.wordpress.org | domain | yes | medium | 2026-09-20 |
planet.wordpress.org | domain | yes | critical | 2026-09-20 |
wordpressfoundation.org | domain | yes | medium | 2026-09-20 |
*.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org, github.com/WordPress | source code | yes | critical | 2026-09-20 |
BuddyPress Core | source code | yes | critical | 2026-09-20 |
GlotPress | source code | yes | critical | 2026-09-20 |
Gutenberg | source code | yes | critical | 2026-09-20 |
Official WordPress plugins | source code | yes | critical | 2026-09-20 |
WP-CLI | source code | yes | critical | 2026-09-20 |
WordPress Core | source code | yes | critical | 2026-09-20 |
bbPress Core | source code | yes | critical | 2026-09-20 |
*.buddypress.org,bbpress.org,profiles.wordpress.org | wildcard | yes | critical | 2026-09-20 |
*.wordcamp.org | wildcard | yes | critical | 2026-09-20 |
*.wordpress.net | wildcard | yes | low | 2026-09-20 |
*.wordpress.org | wildcard | yes | critical | 2026-09-20 |
10 out of scope — black ICE, don't touch
irclogs.wordpress.orgdomainlists.wordpress.orgdomainstatus.wordpress.org,glotpress.blog,wordpress.tvdomain335703880mobileorg.wordpress.androidmobileArchived GitHub repositoriesotherDigital Ocean, AWS, etcotherhttps://github.com/wordpress-mobile/source code*.wordpress.comwildcardmunin-*.wordpress.orgwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.