Wordfence June Bug Bounty: 1,066 Reports, $42,553 Paid
In June 2026, the Wordfence Bug Bounty Program received 1,066 vulnerability submissions from 306 active security researchers, a 4.4% increase in researchers even as total submissions dipped 2.6% from May. The program paid $42,553 in bounties, with an average of $230.02 per validated in-scope report and a top payout of $5,200. Of the submissions, 185 were considered in scope, 1 out of scope, 578 rejected, and 302 duplicates. The Wordfence Threat Intelligence team triages each report, coordinates disclosure with software vendors through a free vulnerability management portal, and releases firewall rules where appropriate.
The program's stated goal is to find and patch vulnerabilities in WordPress plugins and themes before attackers exploit them. Wordfence says that Wordfence Premium, Care, and Response customers receive firewall protection in real time when a new rule ships, while free users receive the same rule after 30 days. In June, 7 new web application firewall (WAF) rules were released, a 16.7% increase from the previous month. The report defines "high threat" vulnerabilities as issues that could lead to full site compromise, such as arbitrary file uploads or remote code execution (RCE), requiring 25 or more active installations and unauthenticated or low-level authenticated access. "Common and dangerous" issues, including stored cross-site scripting (XSS) and SQL injection, must affect software with 500 or more installations.
The top five bounties in June highlight serious authentication and file-handling flaws. The largest single award of $5,200 went to a researcher named vtim for an unauthenticated authentication bypass in UpdraftPlus: WP Backup & Migration Plugin, affecting versions up to 1.26.4 in the free edition and below 2.26.5 in premium, with an install base of 4 million sites. A $2,048 bounty covered an unauthenticated privilege escalation in JetFormBuilder versions up to 3.6.2 via the `_jet_engine_booking_form_id` parameter. Newfold plugins received $1,950 for an authentication bypass caused by empty bearer token secrets, affecting roughly 100,000 installs. WPMU DEV Dashboard versions up to 5.0.0 earned $1,122 for an authentication bypass that allowed arbitrary plugin installation (leading to RCE) through a forged HMAC on the `?wpmudev-hub=` endpoint. WPForms Pro up to version 1.10.1.1 was awarded $975 for an unauthenticated arbitrary file write via chunked upload ordering.
Across all in-scope June submissions, the most common vulnerability type was CWE-79: Cross-Site Scripting, with 60 reports and $5,710 in total rewards (average $95.17). Path traversal (CWE-22) followed with 21 submissions and $2,488, then SQL injection (CWE-89) with 20 and $1,839. However, the highest average rewards went to improper verification of cryptographic signatures (CWE-347) at $5,362.50 per report, and improper authentication (CWE-287) at $2,826. Broken down by authentication level, unauthenticated vulnerabilities made up 89 of the valid reports and earned an average of $359.80, while subscriber-level bugs averaged $89.36, contributor-level $49.73, and author-level $18.83. A small group of 10 "custom" authentication scenarios averaged $1,142.67. Install base also mattered: vulnerabilities in plugins with 1,000,000 to 4,999,999 active installations paid an average of $1,502.25, while off-repository software (not in the official WordPress repository) paid $670.73 and had an average CVSS severity score of 8.52.
The research community leaders for June reflect varied strengths. By volume of in-scope submissions, daroo led with 9 reports and an average reward of $485.80, followed by Rafie Muhammad (8, $208.13), CHOIGYEONGMIN (8, $21.63), 0xd4rk5id3 (7, $188.57), and Athiwat Tiprasaharn (Jitlada) (6, $14.17). Five researchers achieved a perfect average CVSS score of 9.80: Khaled Alenazi (Nxploited) with 2 submissions, Hieus with 1, h0xilo with 1, vtim with 1, and Jiemook with 2. Total earnings were led by vtim ($5,200), daroo ($4,858), d.v4n_s3c ($2,038), sorin vasile ($1,950), and Rafie Muhammad ($1,665). No researchers advanced to the elite (1337) or resourceful tiers in June, and no bug bounty promotions or bonus challenges were active during the month.
The most critical vulnerabilities disclosed in June were actively exploited in the wild. Everest Forms Pro versions up to 1.9.12 contained an unauthenticated remote code execution flaw in the Calculation Addon's `process_filter()` function, which concatenated user-supplied form field values into a PHP code string passed to `eval()` without proper escaping. Attackers could inject arbitrary PHP code by submitting a crafted value in any string-type form field, such as text, email, URL, select, or radio, when a form used the "Complex Calculation" feature. Researcher h0xilo earned $325 for the report. Burst Statistics – Privacy-Friendly WordPress Analytics versions 3.4.0 through 3.4.1.1 allowed authentication bypass and admin account takeover because the `is_mainwp_authenticated()` function incorrectly handled application passwords from the Authorization header. An attacker who knew an administrator username could impersonate that administrator for a single request by sending any random password. Wordfence PRISM submitted this report. Kirki – Freeform Page Builder, Website Builder & Customizer versions 6.0.0 to 6.0.6 accepted an arbitrary email address during password reset requests, letting unauthenticated attackers send any user's password reset link to their own inbox. Researcher CHOIGYEONGMIN received $6,436 for that report. The UpdraftPlus authentication bypass through the UpdraftCentral `udrpc` mechanism was also critical, allowing unauthenticated attackers to bypass authentication entirely on sites with the plugin installed.
For website owners, the June report is a reminder that plugin updates are not optional. The Wordfence program exists to get these flaws fixed and to push protection out to the firewall before public disclosure, but site owners still need to apply patched versions promptly. For those who would rather not manage plugin updates, firewalls, and backups themselves, a managed WordPress host such as AEU Hosting (albhosting.eu) automates security hardening, automatic backups, SSL certificate handling, and performance tuning, with expert support on call to help respond to vulnerabilities like these.