Vulnerability disclosure policy for WordPress plugins under the CRA

Short answer: Manufacturers in scope must have and enforce a coordinated vulnerability disclosure policy and a contact address for reports. For a WordPress plugin, publish it where researchers actually look: Plugin readme ‘Security’ section, security.txt on your site, and the WordPress.org/Patchstack-style disclosure channel.

What a CVD policy for a WordPress plugin should cover

• Where and how to report (email/form/platform), languages, encryption.
• What you promise: acknowledgement time, status updates, target fix timelines.
• Safe-harbour wording for good-faith research.
• How you coordinate disclosure and credit reporters.
• Link to your support period and how fixes reach users.

Related: Is my WordPress plugin in scope? · 24h reporting

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30