Security
Vulnerability disclosure policy
How to report a security issue in our own services, and how we coordinate disclosure of vulnerabilities we find in WordPress plugins and themes.
Last updated
On this page6
Report a vulnerability to us
If you found a security issue in vulncrest.com, VulnCrest Radar or the VulnCrest SOC plugin, email [email protected]. Please include the affected URL or component, steps to reproduce and the impact you expect. We acknowledge reports within two business days.
- Do not access, modify or delete data that is not yours.
- Do not run denial-of-service tests, spam or social engineering.
- Give us reasonable time to fix the issue before sharing details publicly.
How we disclose what we find
When our research team finds a vulnerability in a third-party plugin or theme, we report it privately to the vendor and to the Wordfence vulnerability program, which assigns a CVE. We publish our advisory only after a fixed version is available, or when the coordinated deadline passes.
Timeline
- Day 0: private report to the vendor and CNA.
- Up to day 90: vendor ships a fix. We can extend for vendors who are actively working on one.
- After the fix: CVE published, Radar page and advisory go live with remediation details.
- Patch + 30 days (14 days for Medium and below): technical proof may be published, subject to the policy below.
Proof-of-concept policy
We never publish working exploits. Where a technical proof helps defenders, we publish a proof: the minimal request that demonstrates the flaw with a harmless signal such as a time delay or a marker string.
[!IMPORTANT]
A proof is only published when an administrator has approved it, the publish-after date has passed, a patched version exists, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full exploit code stays in a private repository. Proofs are never offered as a reward for creating an account.
Safe harbor
We will not pursue legal action against researchers who act in good faith under this policy, avoid privacy violations and service disruption, and report findings to us promptly.
Encrypted contact
Use our PGP key for sensitive details. Fingerprint:
B51F 32E0 1011 0E10 4C61 9A2D 7F33 8C0D 5E21 90A1