Security policy
If you have found a security problem in Core Forms or on core-forms.com, this page tells you how to reach us, what to send and what happens next.
How to report an issue
Email gaurav@gatilab.com with "security" in the subject line. The same person who writes the plugin reads that inbox.
Please keep the details private until a fix is out. That means no public forum thread, review or social post about the issue before we have had a chance to fix it.
What to include
- The Core Forms version, plus the WordPress and PHP versions you tested on.
- What an attacker can do, and whether they need to be logged in.
- The steps to reproduce it, or a proof of concept.
- Your name or handle, if you would like credit.
What is in scope
- The Core Forms plugin, including the modules that ship with it.
- This website, core-forms.com.
A problem in a service we connect to, such as a payment processor or an email provider, belongs with that service. Please test on your own install or staging site, and never on someone else's site.
What happens after you report
- We read every report and reply by email.
- If we can reproduce the issue, we fix it in a new release of the plugin.
- The changelog entry for that release says it is a security fix.
- We credit you in that entry if you asked for it.
There is no paid bug bounty program.
Fixed versions
Security fixes go into the latest release of Core Forms. The changelog lists the current version and every release before it, so the first step after any advisory is to update.
security.txt
A machine-readable copy of these contact details is published at /.well-known/security.txt.
Last updated November 11, 2026.