WPCodeForge takes the security of its WordPress plugins, website and related services seriously. Security vulnerabilities can affect websites, users and data, so we encourage responsible reporting of potential security issues.
This Security Disclosure Policy explains how to report a suspected vulnerability, what information to provide, how WPCodeForge may assess a report and how security issues may be handled.
WPCodeForge is an independently owned and operated WordPress software business. The business is solely owned and operated by James William Steven Parker.
Our Approach to Security
Security is an important consideration in the development and maintenance of WPCodeForge plugins.
Our plugins are designed with consideration for common WordPress and web application security risks, including issues involving authentication, authorisation, user input, database queries, file handling, external requests and administrative functionality.
Security cannot be guaranteed through development practices alone. Vulnerabilities can be discovered after software has been released, including through changes to WordPress, PHP, third-party dependencies and the wider technology environment.
For this reason, responsible vulnerability reporting is an important part of maintaining secure software.
Reporting a Security Vulnerability
If you believe you have discovered a security vulnerability affecting a WPCodeForge plugin, website or service, please report it through our contact form.
Please use a clear subject such as:
Security Vulnerability Report
Providing sufficient technical information allows us to assess the issue more efficiently.
What to Include in a Report
Where possible, a vulnerability report should include:
- The affected WPCodeForge product
- The affected version
- The WordPress version
- The PHP version, if relevant
- A clear description of the vulnerability
- The potential security impact
- Steps required to reproduce the issue
- A proof of concept, where appropriate
- Relevant screenshots, logs or error messages
- Any suggested remediation, if known
Please provide only the information necessary to demonstrate the vulnerability.
Do not include passwords, authentication credentials, private keys, payment information or unrelated personal information.
Responsible Disclosure
We encourage security researchers and other individuals to report vulnerabilities privately before publicly disclosing technical details.
Publicly releasing an exploitable vulnerability before affected software can be assessed and, where appropriate, fixed may expose users to unnecessary risk.
Where possible, please give WPCodeForge a reasonable opportunity to investigate and address a confirmed vulnerability before publishing detailed exploit information.
This does not prevent responsible discussion of security issues. The purpose of this approach is to reduce unnecessary risk to users while a vulnerability is being investigated or remediated.
What Happens After a Report
Security reports may be assessed using a process broadly involving:
- Initial review — We review the information provided and determine whether it appears to describe a genuine security issue.
- Reproduction — Where practical, we attempt to reproduce the reported behaviour.
- Assessment — We assess the nature, severity and potential impact of the vulnerability.
- Remediation — Where appropriate, we develop and test a fix or other mitigation.
- Release — A security update may be released where a software change is required.
- Communication — Relevant information may be communicated to affected users where appropriate.
The exact process can vary depending on the vulnerability, affected product and potential impact.
Vulnerability Severity
Not every security report presents the same level of risk.
When assessing a vulnerability, WPCodeForge may consider factors such as:
- Whether authentication is required
- Whether administrator privileges are required
- Whether the vulnerability can be exploited remotely
- Whether user interaction is required
- Whether sensitive information can be accessed
- Whether unauthorised actions can be performed
- Whether arbitrary code can be executed
- Whether website integrity can be affected
- How widely the affected functionality is used
- Whether practical mitigations are available
A vulnerability’s severity may therefore depend on how it can actually be exploited rather than simply the presence of a particular coding issue.
Security Updates
Where a confirmed vulnerability requires a software change, WPCodeForge may release a security update.
A security update may:
- Fix the underlying vulnerability
- Change how an affected feature operates
- Add additional security controls
- Restrict access to sensitive functionality
- Improve validation or sanitisation
- Update a vulnerable dependency
- Disable functionality where an immediate fix is not practical
Users should keep WPCodeForge plugins and WordPress installations updated where updates are available.
Vulnerabilities in Older Versions
A vulnerability may affect one or more versions of a plugin.
Where appropriate, WPCodeForge may determine that a vulnerability is addressed by upgrading to a newer supported version rather than maintaining separate fixes for every historical release.
Users running older or unsupported versions should therefore check the relevant plugin information and update where appropriate.
Third-Party Vulnerabilities
WPCodeForge plugins may interact with WordPress, PHP, hosting environments, third-party libraries, APIs and other software.
If a reported issue originates from a third-party component, WPCodeForge may investigate whether its own software introduces, increases or mitigates the relevant risk.
Where another provider is responsible for the underlying vulnerability, we may need to coordinate with that provider or direct the report to the appropriate security contact.
WordPress and Core Security Issues
WPCodeForge plugins operate within the WordPress ecosystem.
If a reported vulnerability is actually caused by WordPress core, another plugin, a theme, a hosting environment or another component outside WPCodeForge’s control, we may be unable to resolve the underlying issue ourselves.
We may nevertheless investigate whether WPCodeForge software contributes to the problem and take appropriate action where necessary.
Dependency Security
Third-party dependencies can introduce security risks into software.
Where a WPCodeForge plugin uses an external library or dependency, we may monitor relevant security information and update or replace the dependency where appropriate.
If a dependency becomes vulnerable, the appropriate response may depend on whether the vulnerable functionality is actually used by the plugin and whether an alternative or mitigation is available.
Security Research
WPCodeForge welcomes good-faith security research that is conducted responsibly.
Researchers should:
- Avoid accessing or modifying data that does not belong to them
- Avoid disrupting websites or services
- Avoid degrading availability
- Avoid installing persistent access mechanisms
- Avoid deleting or modifying data
- Avoid compromising accounts belonging to other people
- Avoid unnecessary collection of personal information
- Stop testing once sufficient evidence has been obtained to demonstrate the vulnerability
Security research should be limited to what is reasonably necessary to establish and demonstrate the reported issue.
Testing Against Other People’s Websites
Do not test a suspected vulnerability against websites that you do not own or have explicit permission to test.
A vulnerability report should not require unauthorised access to another person’s website, account or data.
Where a proof of concept is necessary, use a controlled environment that you own or are explicitly authorised to test.
Proofs of Concept
A proof of concept can be useful when demonstrating a security vulnerability.
Where possible, provide the minimum proof required to demonstrate the issue.
Avoid including:
- Real user credentials
- Real payment information
- Private customer data
- Destructive payloads
- Unnecessary exploit automation
- Data belonging to other people
A safe, controlled demonstration is generally preferable to an exploit against a live third-party website.
Personal and Confidential Information
Security reports may contain technical information that is sensitive.
Please avoid submitting personal or confidential information unless it is necessary to demonstrate the vulnerability.
If you discover personal information while testing, do not unnecessarily copy, retain, distribute or publish it.
Where possible, redact sensitive information before sending screenshots, logs or other supporting material.
Reports That Do Not Represent Vulnerabilities
Not every security-related concern is a security vulnerability.
Examples may include:
- General security recommendations
- Requests for additional security features
- Outdated software warnings unrelated to WPCodeForge
- Issues requiring unrealistic or highly privileged access
- Theoretical concerns without a practical security impact
- Normal WordPress behaviour
- Issues caused entirely by unrelated third-party software
These reports may still be useful, but they may be handled as general feedback rather than as confirmed security vulnerabilities.
Feature Requests and General Security Suggestions
If your message is primarily a suggestion for improving the security or functionality of a WPCodeForge plugin rather than a vulnerability report, you can still contact us through our contact form.
Our Actionable Feedback Policy explains how product suggestions, bug reports and other feedback are assessed.
No Guarantee of a Particular Response Time
WPCodeForge aims to review legitimate security reports as reasonably practicable.
Response times can vary depending on the complexity and severity of the issue, the amount of information supplied and whether additional investigation is required.
We do not guarantee a specific response time, remediation period or outcome for every report.
Where a report indicates a potentially serious vulnerability, it may receive priority according to the potential risk to users.
Public Disclosure
WPCodeForge may disclose information about confirmed vulnerabilities where doing so is appropriate.
Any public security information may take account of:
- The affected product
- The affected versions
- The severity of the vulnerability
- The availability of a fix
- The potential risk to users
- The need to avoid providing unnecessarily actionable exploit information
Where a vulnerability has been resolved, security information may help users understand the importance of applying the relevant update.
Security Advisories
Where appropriate, WPCodeForge may publish a security advisory relating to a confirmed vulnerability.
A security advisory may include:
- The affected product
- Affected versions
- The nature of the vulnerability
- The potential impact
- The fixed version
- Recommended action
- Relevant references
The amount of technical detail provided may depend on the circumstances and the risk associated with disclosure.
Credit for Security Researchers
Where a vulnerability is responsibly reported, WPCodeForge may credit the individual or organisation that reported it, subject to their permission and the circumstances of the disclosure.
If you do not want to be publicly credited, please state this when submitting your report.
We will not assume that a researcher wants their identity publicly disclosed.
AI-Assisted Development
WPCodeForge uses artificial intelligence to assist with plugin development.
AI-assisted development does not remove the need for security review or technical responsibility. AI-generated code can contain vulnerabilities, incorrect assumptions or unsuitable implementations.
WPCodeForge therefore treats AI as a development aid rather than a substitute for security testing, code review or engineering judgement.
Further information is available in our Plugin Development Standards.
Ongoing Security Improvement
Security is an ongoing process rather than a one-time development task.
WPCodeForge may improve its plugins in response to:
- Security research
- Vulnerability reports
- WordPress changes
- PHP changes
- Dependency updates
- User feedback
- Internal testing
- Changes in security best practice
Where appropriate, security improvements may be incorporated into ordinary product updates as well as dedicated security releases.
Our Security Commitment
WPCodeForge aims to respond responsibly when genuine security vulnerabilities are reported.
Our approach is based on:
Responsible reporting — We encourage private disclosure before public disclosure where practical.
Investigation — Reports should be assessed using appropriate technical evidence.
Risk reduction — Confirmed vulnerabilities should be addressed according to their potential impact.
User protection — Security fixes and relevant information should be provided where appropriate.
Transparency — Significant security issues may be communicated responsibly once circumstances allow.
Continuous improvement — Security findings should contribute to improving future software development.
Contact WPCodeForge
To report a suspected security vulnerability affecting a WPCodeForge plugin, website or service, please use our contact form.
Please use the subject line Security Vulnerability Report and provide enough technical information for the issue to be investigated.
For general product bugs, feature requests and other non-security feedback, please refer to our Actionable Feedback Policy.