Security & Vulnerability Disclosure Policy

Last updated: September 7, 2026

At WP-Buy, we take the security of our website, WordPress plugins, customer accounts, and related services seriously.

We appreciate responsible security researchers, developers, customers, and members of the community who help identify and report potential security vulnerabilities.

This policy explains how to report a suspected security issue, what types of testing are permitted, and what we expect from anyone conducting security research involving WP-Buy systems or products.

Reporting a Security Vulnerability

If you believe you have discovered a security vulnerability affecting:

• www.wp-buy.com
• A WordPress plugin developed or distributed by WP-Buy
• Customer account functionality
• Licensing or update systems
• Download delivery systems
• WP-Buy APIs or publicly accessible services
• Other infrastructure operated directly by WP-Buy

please report it privately here:

Please do not publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and address it.

What to Include in Your Report

A useful vulnerability report should include as much of the following information as possible:

• The affected product, plugin, page, URL, or service
• The affected plugin version, if applicable
• A clear description of the vulnerability
• Steps required to reproduce the issue
• Proof-of-concept information where appropriate
• Screenshots, request/response samples, or technical evidence
• The potential security impact
• Any conditions required for successful exploitation
• Your recommended remediation, if available
• Your preferred contact information

Please avoid including unnecessary personal, customer, or confidential information.

Responsible Testing

We welcome good-faith security research that is performed carefully and does not negatively affect our customers, website, infrastructure, or business operations.

When conducting security testing, you must:

• Test only what is reasonably necessary to demonstrate the vulnerability.
• Avoid accessing, downloading, modifying, or deleting data belonging to other users.
• Avoid disrupting website availability or performance.
• Avoid intentionally damaging systems or data.
• Stop testing if you encounter sensitive customer or business information.
• Report security vulnerabilities privately and promptly.
• Give us a reasonable opportunity to investigate and remediate the issue before public disclosure.

Prohibited Activities

The following activities are not authorized under this policy:

• Denial-of-service or distributed denial-of-service attacks
• Traffic flooding, resource exhaustion, or stress testing against production infrastructure
• Destructive testing
• Malware deployment
• Ransomware or extortion
• Social engineering
• Phishing
• Credential theft
• Brute-force attacks against customer or administrator accounts
• Physical attacks
• Attacks against WP-Buy employees, customers, hosting providers, or third-party vendors
• Modification or deletion of customer information
• Downloading large quantities of sensitive or private data
• Intentionally maintaining unauthorized access after demonstrating a vulnerability
• Using a vulnerability for financial fraud, commercial exploitation, or unauthorized access
• Publishing sensitive vulnerability details before reasonable remediation efforts have taken place

Automated vulnerability scanners may be used responsibly, but high-volume scanning that causes excessive server load, degradation, or service disruption is not permitted.

Customer and Personal Data

If you unintentionally gain access to personal information, customer information, authentication credentials, license information, orders, payment-related information, private files, or other sensitive data:

1. Stop testing immediately.
2. Do not download, copy, share, modify, or retain the information beyond what is strictly necessary to report the vulnerability.
3. Notify us as soon as possible.
4. Delete any locally stored sensitive information after it is no longer required for the security report.

WordPress Plugin Vulnerabilities

For vulnerabilities affecting a WP-Buy WordPress plugin, please include:

• Plugin name
• Plugin version
• WordPress version
• PHP version, where relevant
• Whether authentication is required
• Required WordPress user role, if applicable
• Required configuration or plugin settings
• Reproduction steps
• Proof of concept
• Security impact

We strongly encourage researchers to test WordPress plugin vulnerabilities in a local development environment or a website they are explicitly authorized to test.

Please avoid testing exploit code against websites belonging to WP-Buy customers or unrelated third parties.

Third-Party Services

Some functionality on WP-Buy may depend on external services such as hosting providers, payment processors, content delivery networks, email providers, WordPress services, or other third-party platforms.

Security vulnerabilities that exist exclusively within a third-party product or infrastructure should normally be reported directly to the affected third-party provider.

If you believe a third-party issue creates a specific vulnerability in WP-Buy’s implementation, you may still report it to us.

Out-of-Scope Reports

The following issues may not normally be considered security vulnerabilities unless they create a demonstrated security impact:

• Missing security headers without a practical exploitation scenario
• Missing security.txt
• Software version disclosure without an exploitable vulnerability
• Username enumeration without additional security impact
• Clickjacking on pages that perform no sensitive actions
• Self-XSS
• Issues requiring an already-compromised administrator account
• Browser behavior affecting obsolete or unsupported browsers
• SSL/TLS configuration recommendations that do not represent a practical vulnerability
• Rate-limit recommendations without demonstrated abuse
• Email spoofing reports without evidence of an exploitable WP-Buy configuration
• Findings produced only by automated scanners without verification
• General WordPress configuration recommendations
• Publicly available information
• Reports about vulnerabilities that have already been fixed in the latest available version

We may nevertheless review such reports if they identify a meaningful security improvement.

Vulnerability Disclosure

We ask researchers to coordinate disclosure with us.

Please do not publicly disclose technical details that could enable exploitation until:

• We have confirmed the issue;
• A fix or mitigation has been prepared where reasonably possible; and
• Customers have had a reasonable opportunity to update or apply the mitigation.

Complex vulnerabilities may require additional investigation, development, testing, and deployment time.

Security Updates

When a vulnerability affecting one of our WordPress products is confirmed, we may take appropriate measures such as:

• Releasing a security update
• Applying server-side mitigation
• Updating affected functionality
• Notifying affected users where appropriate
• Updating documentation
• Coordinating disclosure with relevant security organizations or platforms

Customers should always keep WordPress, plugins, themes, PHP, and other server components updated.

Bug Bounty and Compensation

Submitting a vulnerability report does not automatically create eligibility for financial compensation or a bug bounty.

WP-Buy does not guarantee payment, rewards, credits, licenses, or other compensation for vulnerability reports unless such compensation has been explicitly agreed upon separately.

We may, at our discretion, acknowledge researchers who provide particularly valuable responsible disclosures.

Researcher Recognition

With the researcher’s permission, WP-Buy may publicly acknowledge individuals or organizations that responsibly report significant security vulnerabilities.

Researchers may also request that their identity remain private.

Good-Faith Security Research

We consider security research to be performed in good faith when the researcher:

• Makes a genuine effort to avoid harm;
• Respects privacy;
• Avoids unnecessary access to data;
• Does not exploit the vulnerability beyond what is necessary to demonstrate it;
• Reports the issue privately;
• Cooperates reasonably during investigation; and
• Follows this policy.

This policy does not authorize activities that violate applicable laws or the rights of third parties.

Our Commitment

When we receive a legitimate security report, we aim to:

• Review the report carefully
• Verify reproducible vulnerabilities
• Assess the potential impact
• Develop an appropriate fix or mitigation where necessary
• Communicate with the reporter when additional information is required
• Protect customers from unnecessary public exposure of security issues

Response and remediation time can vary depending on severity, complexity, reproducibility, affected products, and required testing.

Security Contact

Security vulnerabilities should be reported here:

Security policy:

https://www.wp-buy.com/security-policy/

Security.txt:

https://www.wp-buy.com/.well-known/security.txt

Please use this contact only for genuine security-related reports.

For licensing, downloads, installation assistance, account questions, or general product support, please use the normal WP-Buy support channels instead.