Patchstack

At a glance#

• Platform: Self-hosted, report through their own form
• Rewards: Yes. A monthly pool of at least $5,300, paid out from $2,000 for first place down to $500 for fifth. Zero-day bounties range from $250 to $33,000 depending on install count and whether authentication is needed
• Public disclosure: Mandatory. Everything is published to the Patchstack vulnerability database, and you may not share details with anyone before that
• Report to: patchstack.com/database/report

In scope#

The WordPress ecosystem: core, plugins and themes, free and premium.

A component qualifies only if it has 1,000 or more active installs, is publicly available, and has been updated in the last three years. Only the latest version counts.

Vulnerability classes they pay for include SQL injection, site-wide XSS, arbitrary file operations, remote code execution, privilege escalation and broken access control, each subject to conditions in their guidelines.

Out of scope#

• Configuration issues and expected functionality
• Incomplete patches
• Anything with high attack complexity
• Minor data leakage
• Open redirects, which they treat as inherently out of scope
• Authenticated shortcode issues with no sensitive disclosure
• CSV injection, CAPTCHA bypasses and full path disclosure

Reporting#

Through patchstack.com/database/report only. Email submissions are not accepted. Reports need a text-based proof of concept with the HTTP requests and payloads, and ideally video.