MainWP Child

SQL Injection

Cross Site Scripting (XSS)

Remote/Local File Inclusion

Cross-Site Request Forgery (CSRF)

Open Redirection

Bypass Vulnerability

Broken Access Control

Privilege Escalation

Arbitrary File Read/Download/Upload/Deletion

Sensitive Data Exposure

Arbitrary/Remote Code Execution

Server Side Request Forgery (SSRF)

Denial of Service

PHP Object Injection

Deserialization of untrusted data

Insecure Direct Object References (IDOR)

CSV Injection

Broken Authentication

Path Traversal

Race Condition

Cross-Site Request Forgery (CSRF) on read-only actions

Pre-requisite of another vulnerability

Pre-requisite of specific or unusual conditions

Vulnerabilities that requires exotic server configurations or outdated server software

Missing encryption/hashing on potential sensitive information

Spoofing of data (User Agent, IP address, etc.) with no serious security impact

You must be the first reporter of a vulnerability

It must be a real and measurable vulnerability (CVSS 3.1 base score not lower than 2.6 points)

There must be impact on at least one of three CIA parameters (Confidentiality, Integrity, or Availability) via network attack vector

It doesn't require chaining with other vulnerabilities

Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through patchstack.com

Once reported, the vulnerability information should not be shared with other parties until disclosure

Reports are examined by our security analysts - our analysis is always based on worst case exploitation & the business criticality of the vulnerability, as is the reward we pay