Here is their bug bounty page for anyone who has found a vulnerability to report: https://hackerone.com/wordpress