Research
Security Research Portfolio
This page tracks my public vulnerability disclosures and technical write-ups.
Published Vulnerabilities
| CVE | Project | Title | Links |
|---|---|---|---|
| CVE-2026-15248 | Meta Box | Contributor+ Arbitrary Attachment Deletion via Missing Authorization | Write-up · CVE · WPVDB |
| CVE-2026-14224 | Easy Appointments | Subscriber+ IDOR Allows Cross-User Appointment Notification Redirection | Write-up · CVE |
| CVE-2026-11571 | Everest Forms | Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts | Write-up · CVE · WPVDB |
| CVE-2026-11855 | Simple Membership | Unauthenticated Stored Cross-Site Scripting via Stripe Webhook API Version | Write-up · WPVDB |
Current Research Areas
WordPress plugin security, web/API authorization, IDOR, broken access control, stored XSS, webhook trust boundaries, unsafe file operations, sensitive data exposure, and security testing automation.
Disclosure Principles
All research documented on this site is performed against systems I own, isolated local labs, or targets covered by an authorized vulnerability-disclosure or bug-bounty program.
I follow coordinated disclosure practices and may temporarily withhold exploit payloads or detailed reproduction steps while affected users are being given time to update.