Updates to the WordPress Vulnerability Disclosure Program

WordPress is updating its Vulnerability Disclosure Program guidelines, run through HackerOne, to narrow the scope of eligible reports. For any in-scope asset other than WordPress Core and Gutenberg, issues requiring an administrator-granted role (such as Contributor) will generally no longer qualify unless they show a high-severity escalation. Similarly, one authenticated role being able to perform another role's action won't be sufficient on its own unless it leads to high-impact escalation. WordPress Core and Gutenberg keep the existing eligibility rules for now. The change is part of a broader Core Security Initiative aimed at focusing researcher and team time on vulnerabilities with clear, significant security impact, especially unauthenticated or low-privilege (Subscriber-level) exploits.

Source: https://make.wordpress.org/core/2026/09/01/xpost-updates-to-the-wordpress-vulnerability-disclosure-program. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.