Bug Bounty Programs Compared: Wordfence, Patchstack & More

Somewhere right now a researcher is staring at a plugin that runs on a million WordPress sites, holding a bug its author never saw. What happens next depends on where they send the report. Send it to the right bounty program and it turns into a patch, a public advisory with the researcher's name on it, and a payout that can clear $30,000. Send it to the wrong one and it comes back a week later with a polite note that it is out of scope.

Four programs cover most of that ground, from WordPress plugins to Solidity smart contracts: Wordfence, Patchstack, Elementor's Bugcrowd program and OpenZeppelin on Immunefi. The table sets them side by side: what each one wants you to hunt, what it pays at the top, and the fine-print rule most likely to sink an otherwise good report.

Program	Research focus	Top reward	Rule that decides eligibility
Wordfence Intelligence	WordPress plugins and themes, free and premium	$31,200 for standard researchers, $32,760 at the 1337 tier	Scope depends on the vulnerability and your researcher tier; some high-threat findings qualify at 1,000+ active installs
Patchstack	WordPress plugins, themes and core	$33,000 per zero-day, plus a $5,300 monthly top-five pool	Payout scales with active installs and the privilege the exploit needs
Elementor on Bugcrowd	Elementor security concerns other than its WordPress plugins	Set in the engagement brief, not published outside it	Plugin issues go to Patchstack instead
OpenZeppelin on Immunefi	OpenZeppelin Contracts, the Solidity library	$25,000 for a critical finding	Proof of concept required, KYC before payout, local forks only

Which Bug Bounty Program Fits Your Finding?

Match the program to what you found first, and let the payout break ties. The scopes overlap in places: a bug in an Elementor plugin belongs to Patchstack, not to Elementor's own Bugcrowd program.

You found	Send it to	Why
A flaw in a WordPress plugin or theme with 1,000+ installs	Wordfence or Patchstack	Both pay for this class; compare tiers and install bands before you file
A flaw in WordPress core	Patchstack	Its top payout band covers core alongside 15M+ install components
A flaw in an Elementor WordPress plugin	Patchstack	Elementor's reporting page sends plugin issues there
Any other Elementor security issue	Bugcrowd	Elementor lists Bugcrowd for everything outside its plugins
A bug in OpenZeppelin Contracts	Immunefi	The only program in this set that covers Solidity

Wordfence Intelligence: Tiers and Scope

Close-up of a laptop keyboard edge lit by a cyan rim light, with a blurred code editor on the screen behind it — Plugin source on a laptop screen, the raw material of every Wordfence report.

Wordfence runs its bounty through Wordfence Intelligence, its WordPress vulnerability database, and covers free and premium plugins and themes alike. The reward ceiling rises with your researcher tier, and the top one, 1337, opens every plugin and theme with at least 1,000 active installations.

For everyone below that tier, scope depends on the vulnerability class and your researcher standing, so a high-threat bug can qualify on a plugin that a low-severity one cannot. Wordfence publishes a reward estimator for a specific finding, and it is worth running yours through it before you plan the vacation, because the headline figure belongs to the rarest pairing of severity, install base and tier.

Patchstack: Payouts Scale With Install Count

A printed payout statement with a pen across it on a dark wooden desk, an open laptop behind it showing a blurred website admin plugin list — The statement on the desk and the plugin list on the screen belong together, since the install count on one decides the figure on the other.

Patchstack pays per zero-day on a grid of two variables: how many sites run the vulnerable component, and whether the attacker needs a subscriber account or no account at all. The top cell, $33,000, is an unauthenticated flaw in WordPress core or in a component with 15 million or more installs, while a subscriber-level flaw in a plugin with 1,000 installs pays $125, a paid first lesson in how coordinated disclosure works.

Patchstack also runs a monthly leaderboard that splits $5,300 among its five most productive researchers, from $2,000 for first place down to $500 for fifth. A valid report earns its grid payout and a shot at the ranking, but it guarantees neither the maximum cell nor a place among the five.

Patchstack Zero-Day Payouts by Active Installs

Active installs	Subscriber-level flaw	Unauthenticated flaw
15M+ or WordPress core	$16,500	$33,000
5M+	$7,200	$14,400
1M+	$3,600	$7,200
500K+	$2,450	$4,900
100K+	$1,300	$2,600
50K+	$700	$1,400
10K+	$300	$600
5K+	$200	$400
1K+	$125	$250

Monthly top-five pool: $2,000, $1,400, $800, $600 and $500, for $5,300 in total.

Elementor on Bugcrowd: Read the Brief First

Elementor splits its reports across two platforms. Its reporting page sends WordPress plugin issues to Patchstack and all other security concerns to its Bugcrowd program. We could not confirm Bugcrowd's current payout range or asset list from outside the engagement, so treat the program brief as the contract: it names the assets in scope, the testing you may run against them, and what earns a reward.

OpenZeppelin on Immunefi: Smart Contracts Only

A black hardware crypto wallet plugged in by USB-C on a desk mat, with a laptop behind it showing blurred lines of code — The wallet gets paid in ETH or USDC. The code gets broken on a local fork, where nobody's real funds sit in the blast radius.

OpenZeppelin Contracts is the widely used Solidity library behind a long list of tokens and governance contracts, and its Immunefi program is the one entry here with nothing to do with web applications. Critical findings pay up to $25,000, every report needs a proof of concept, and OpenZeppelin asks for an invoice and a KYC screen before it pays out in ETH or USDC against a USD-denominated reward.

Testing on mainnet or a public testnet is prohibited. All of it happens on a local fork of either chain, which keeps your exploit proof from becoming somebody else's incident report.

OpenZeppelin on Immunefi: Rewards by Severity

Severity	Maximum reward	Proof of concept
Critical	$25,000	Required
High	$5,000	Required
Medium	$2,500	Required
Low	$1,000	Required

Payouts are denominated in USD and paid in ETH or USDC.
An invoice and a KYC screen come before any reward.
Testing against pricing oracles or third-party contracts is out of bounds, as is automated testing that generates significant traffic.

Where Offensive Skill Goes to Defend

Top-down view of a dark grid desk holding an open notebook with a hand-drawn flowchart, a brass padlock, a laptop, a pen and a cup of coffee — A flowchart, a closed padlock and a cup of coffee, the usual kit for a report written to be fixed.

Every program above pays for the skill set an intruder uses: reading code for the flaw its author missed, then proving it with a working exploit. What changes is where the proof goes. A bounty report goes to the maintainer, the maintainer ships a patch, and the finding becomes a published advisory with your name on it instead of a line in somebody's breach notification.

"I was trying to create a mechanism for hackers to one, stay out of jail, and two, help people become more secure."

Katie Moussouris Founder and CEO, Luta Security, on why she helped create bug bounties, as quoted in CSO Online

That is one answer to the question we left open in our look at cyber threats to the energy and utilities sector, where CISA called the intruders unsophisticated and we asked how someone with that kind of skill gets pulled toward defense. Legal cover, public credit and a five-figure ceiling make a better recruiting pitch than any label. If WordPress plugins are your way in, our guide to preparing and protecting WordPress sites shows what the defenders on the receiving end of your report are working with.

Frequently Asked Questions

Which bug bounty program pays the most for a WordPress vulnerability?: Patchstack advertises the highest single payout in this set, up to $33,000 for an unauthenticated zero-day in WordPress core or a component with 15 million or more installs. Wordfence tops out at $31,200 for standard researchers and $32,760 in its 1337 tier.
Where do I report an Elementor vulnerability?: WordPress plugin issues go to Patchstack. Every other Elementor security concern goes to Elementor's Bugcrowd program, whose brief lists the assets in scope.
Does a valid report always earn the maximum reward?: No. Each program prices a finding by severity and scope, and Patchstack also weighs active installs and the privilege the exploit needs, so the headline figures belong to the rarest combinations of all three.
Why does OpenZeppelin require testing on a local fork?: Its Immunefi rules prohibit testing on mainnet or public testnets. A local fork copies chain state to your own machine, so an exploit proof runs without touching live contracts or anyone's funds.