Automattic

United States Proprietary automattic.com ↗ Bug Bounty ↗
C
CAUTION
44
Total CVEs
4
Crit / High
35
Medium
28%
Unpatched
6%
Patched
5.6
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
6%
Unpatched
28%
Under Review
61%
Pending
6%
✓ 1 patched ✗ 5 unpatched ~ 11 under review ⏳ 1 pending score
▸ Intelligence by Audience
PoC Available
8 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"automattic" port:443
org:"Automattic" http.status:200
Top EPSS (Exploitation Probability)
CVE-2024-9926 22.80% exploitation probability
CVE-2026-93485 0.38% exploitation probability
CVE-2025-22740 0.33% exploitation probability
CVE-2024-43949 0.30% exploitation probability
CVE-2026-66666 0.29% exploitation probability
🎯 Bug Bounty Program: https://hackerone.com/automattic
Quick Facts for Reporting
Total CVEs tracked
44
Critical severity
1
Actively exploited (CISA)
0
Unpatched ratio
28%
Avg CVSS score
5.6
Security grade
C (CAUTION)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
Hackers are exploiting recently patched WordPress bugs, putting millions of websites at risk - TechCrunch
TechCrunch 2026-07-20
WordPress vulnerabilities massively exploited immediately after disclosure - Techzine Global
Techzine Global 2026-07-21
Hackers Target Millions of WordPress Sites, Experts Urge Immediate Updates - mezha.net
mezha.net 2026-07-20
'WP2Shell' exploit sparks fresh warnings for millions of WordPress websites - Firstpost
Firstpost 2026-07-20
A critical vulnerability in WordPress has led to a wave of hacker attacks - hi-Tech.ua
hi-Tech.ua 2026-07-22
Hackers Exploiting WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites - The Hacker News
The Hacker News 2024-04-26
▸ Recent CVEs showing 20 of 18
CVE IDSeverityPatchEPSSDate
CVE-2026-106608 7.2 HIGH UNKNOWN / UNPATCHED — 2026-10-10
CVE-2026-106601 5.4 MEDIUM UNKNOWN / UNPATCHED — 2026-10-09
CVE-2026-106602 4.8 MEDIUM UNKNOWN / UNPATCHED — 2026-10-09
CVE-2026-66666 ? N/A UNKNOWN / UNPATCHED 0.29% 2026-10-06
CVE-2026-93485 PoC 7.1 HIGH PATCH UNDER REVIEW 0.38% 2026-09-18
CVE-2026-57777 PoC 7.6 HIGH PATCH UNDER REVIEW 0.24% 2026-09-04
CVE-2026-42334 7.5 HIGH PATCHED / FIX AVAILABLE 0.27% 2026-05-14
CVE-2026-39660 5.3 MEDIUM UNKNOWN / UNPATCHED — 2026-04-08
CVE-2023-54332 5.1 MEDIUM UNKNOWN / UNPATCHED 0.29% 2026-01-13
CVE-2025-69015 PoC 3.8 LOW PATCH UNDER REVIEW 0.05% 2025-12-30
CVE-2025-49042 PoC 5.9 MEDIUM PATCH UNDER REVIEW 0.03% 2025-10-29
CVE-2025-57924 PoC 4.3 MEDIUM PATCH UNDER REVIEW 0.02% 2025-09-22
CVE-2025-49325 4.7 MEDIUM PATCH UNDER REVIEW 0.17% 2025-06-06
CVE-2025-22740 PoC 5.3 MEDIUM PATCH UNDER REVIEW 0.33% 2025-03-27
CVE-2024-37242 4.3 MEDIUM PATCH UNDER REVIEW 0.16% 2025-01-02
CVE-2024-43338 4.3 MEDIUM PATCH UNDER REVIEW 0.21% 2024-11-19
CVE-2024-9926 PoC ? N/A PATCH UNDER REVIEW 22.80% 2024-11-07
CVE-2024-43949 PoC 6.5 MEDIUM PATCH UNDER REVIEW 0.30% 2024-08-29
View all 18 CVEs for Automattic →
▸Intel
HQSan Francisco, United States
Founded2005
Employees2,000
CEOMatt Mullenweg
CountryUnited States
LicenseProprietary
Bug BountyView Program ↗
Trust ScoreC — CAUTION
Max CVSS9.9
Last Updated2026-08-03
▸Top Weaknesses
CWE-862
Unknown Weakness Type
15 occurrences in Automattic CVEs (34% of total)
CWE-862 ⓘ
15
CWE-79
Cross-Site Scripting (XSS)
11 occurrences in Automattic CVEs (25% of total)
CWE-79 ⓘ
11
CWE-352
Cross-Site Request Forgery (CSRF)
7 occurrences in Automattic CVEs (16% of total)
CWE-352 ⓘ
7
CWE-22
Unknown Weakness Type
2 occurrences in Automattic CVEs (5% of total)
CWE-22 ⓘ
2
CWE-200
Sensitive Information Exposure
2 occurrences in Automattic CVEs (5% of total)
CWE-200 ⓘ
2
CWE-434
Unrestricted File Upload
1 occurrence in Automattic CVEs (2% of total)
CWE-434 ⓘ
1
CWE-601
Open Redirect
1 occurrence in Automattic CVEs (2% of total)
CWE-601 ⓘ
1
CWE-74
Unknown Weakness Type
1 occurrence in Automattic CVEs (2% of total)
CWE-74 ⓘ
1
▸Company Profile

Automattic is the company behind WordPress.com, WooCommerce, and Jetpack, providing web development, content management, and e-commerce platforms that power a significant portion of the internet. Its products are widely used, making them frequent targets for security research and vulnerabilities, with 36 tracked CVEs. The company's open-source ecosystem and large user base give it substantial cybersecurity relevance.

▸Response Metrics
Est. MTTR ⓘ ~444 days (Critical)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↘ -60% better
CVE count 2026 vs 2025:  10 → 4 CVEs
Patch Speed ⓘ Poor (>65% open)
28% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€610K
Est. GDPR High
€6.1M

Based on 1 critical CVEs, 0 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Automattic C valtersit.com