As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Bug Bounty Program Monthly Report - May 2026
Wordfence received 1,095 vulnerability submissions in May 2026 across its WordPress bug bounty program, with 149 validated in-scope findings including privilege escalations, arbitrary file uploads, and authentication bypasses affecting plugins with hundreds of thousands of installations. The program awarded $34,454 in total bounties that month, with the highest single bounty of $6,436 for an unauthenticated privilege escalation in Kirki 6.0.0-6.0.6, and released six Web Application Firewall (WAF) rules covering disclosed vulnerabilities.
Why it matters: WordPress site owners and hosting providers need to prioritize patches for high-impact plugin vulnerabilities disclosed through this program, particularly subscriber-level authentication bypass and unauthenticated remote code execution risks that affect plugins with large install bases like Avada Builder (968,000+ sites) and WPML (1,000,000+ sites).
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Wordfence Bug Bounty Program Monthly Report – May 2026
Wordfence received 1,095 vulnerability submissions in May 2026 across its WordPress bug bounty program, with 149 validated in-scope findings including privilege escalations, arbitrary file uploads, and authentication bypasses affecting plugins with hundreds of thousands of installations. The program awarded $34,454 in total bounties that month, with the highest single bounty of $6,436 for an unauthenticated privilege escalation in Kirki 6.0.0-6.0.6, and released six Web Application Firewall (WAF) rules covering disclosed vulnerabilities.
Why it matters: WordPress site owners and hosting providers need to prioritize patches for high-impact plugin vulnerabilities disclosed through this program, particularly subscriber-level authentication bypass and unauthenticated remote code execution risks that affect plugins with large install bases like Avada Builder (968,000+ sites) and WPML (1,000,000+ sites).
- Source published
- First seen by Cybersecurity Tracker