Welcome! WP Engine invites you to evaluate our products and platforms. WP Engine equips its customers with a suite of agility, performance, intelligence, and integration solutions, so you can build and deploy a range of online experiences from campaign sites to content hubs to e-commerce extensions. Good luck and happy hunting!
Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.
| Vulnerability Severity | Time to validate |
|---|---|
| Exceptional | 2 Working days |
| Critical | 2 Working days |
| High | 5 Working days |
| Medium | 15 Working days |
| Low | 15 Working days |
This remains at the discretion of the WP Engine to award.
Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of WP Engine to award.
This is the primary site for researchers to register and test both the Flywheel App as well as the Flywheel Platform. We will not provide credentials or bypass verification controls (i.e, a researcher will need to either provide a valid phone number or credit card to have a live site), but a researcher may register a demo site that matches the platform's functionality without verification. Please use your Intigriti credentials to register. Please note that any issues regarding an individual WordPress installation on the Flywheel platform, outside of plugins owned by WP Engine/Flywheel, will be considered out of scope as we do not monitor or manage customer content. We are, however, very interested in issues that may compromise customer isolation on the platform or cause data to be leaked from either a host or an unrelated customer site.
This site is the landing page for Flywheel-branded services. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and chat functionality are out-of-scope - specifically, the Sales Questions functionality or https://getflywheel.com/schedule-a-demo/. No testing should be done against these targets or any 3rd party services. Please do not contact our Support or Sales teams as part of your testing.
The User Portal for WP Engine. Customers manage their WordPress sites, addons, and billing details through this portal. No credentials will be provided. Researchers are free to test functionally that requires authentication with their own accounts. Please note: no reimbursements will be made for money spent to access this part of the application.
This the landing page for the main WP Engine website. Most of this data is static, but there are a number of dynamic fields and functionalities that are available to be tested. Support, contact forms, and Live Chat are out-of-scope - specifically, the Sales Questions functionality and https://wpengine.com/contact/. No testing should be done against these targets or any 3rd party services.
Please Note: All customer sites on subdomains of wpengine.com, unless explicitly listed as in scope, are out of scope.
Local is the #1 local WordPress development tool.
With NitroPack, you get everything you need for a fast website, in one place. Features like caching, image optimization, and a CDN are ready to go out of the box.
The studiopress.com, demo.studiopress.com, and my.studiopress.com sites are public facing marketing and WordPress theme e-commerce sites. No credentials will be provided. Researchers are free to test functionally that requires authentication with their own accounts.
This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be "internal" services like APIs but have public DNS records and some may be publicly-accessible.
This is an apex domain used for microservices hosted as subdomains and service-to-service APIs - these are intended to be "internal" services like APIs but have public DNS records and some may be publicly-accessible.
We accept any reports of vulnerabilities in plugins or themes managed or developed by WP Engine, with the exception of any application-level vulnerabilities in the Out of Scope section below. These free versions closely mirror their paid counterparts, so any vulnerabilities discovered should be applicable to both the paid or free plugins.
We also accept reports for the following plugins:
Advanced Custom Fields
Better Search Replace
WP Migrate
WP Offload Media for Amazon S3, DigitalOcean Spaces, and Google Cloud Storage
WP Offload SES
We are excited to announce our public bug bounty program! We've done our best to remediate most of our known issues and now would like to request your help to spot the ones we missed! We are specifically looking for reports regarding:
Any other issues that have a demonstrated security impact, aside from those in the Out of scope section below, are eligible for review.
This program follows Intigriti's triage standards
If you do not wish to (or are unable to) receive a bounty payout, please submit reports to our VDP: https://app.intigriti.com/company/programs/wpengine/wpengine/detail
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
