Research
Security Research
My public research focuses on security boundaries in real software: authorization, object ownership, trust transitions, sensitive state changes, data lifecycle, and implementation assumptions that fail across interfaces or components.
The disclosures below are selected public findings from coordinated vulnerability research. Detailed technical analysis, validation notes, and references are maintained in the linked write-ups.
Selected Public Vulnerability Research
| CVE | Project | Summary | Links |
|---|---|---|---|
| CVE-2026-16612 | FiboSearch | Autocomplete Exposed Password-Protected WooCommerce Products. Severity: Medium. CVSS: 5.3. CWE: CWE-200. Affected: < 1.34.1. Validated: 1.33.0. In the validated Subscriber scenario, FiboSearch autocomplete returned a password-protected product and product fields even though the normal product permalink still showed the WordPress password form. | Write-up · CVE · NVD · WPVDB |
| CVE-2026-15231 | TaxoPress | AI Preview Private Post Disclosure via Missing Authorization. Severity: Low. CVSS: 2.7. CWE: CWE-639. Affected: < 3.51.0. Fixed: 3.51.0. Contributor-level users could supply a private or draft post identifier to the AI Preview workflow and receive output derived from content they were not authorized to read. | Write-up · CVE · NVD · WPVDB |
| CVE-2026-15248 | Meta Box | Contributor+ Arbitrary Attachment Deletion via Missing Authorization. Severity: Medium. CVSS: 5.5. CWE: CWE-862. Affected: < 5.13.1. Fixed: 5.13.1. Authenticated users with access to a Meta Box file-field workflow could delete media records referenced by other users’ content because the deletion handler did not authorize the supplied object and attachment identifiers. | Write-up · CVE · NVD · WPVDB |
| CVE-2026-14224 | Easy Appointments | Subscriber+ Cross-User Appointment Notification Redirection via IDOR. Severity: Medium. CWE: CWE-639 / CWE-862. Affected: < 3.12.28. Fixed: 3.12.28. A Subscriber could reuse a valid appointment-edit nonce from their own appointment while targeting another user’s appointment metadata, causing later customer notifications to use attacker-controlled email data. | Write-up · CVE · NVD · WPVDB |
| CVE-2026-11571 | Everest Forms | Email CSV Attachment Left Public via Notification Cleanup Mismatch. CWE: CWE-200. Affected: < 3.5.0 in public advisory metadata; validated report range <= 3.4.8. A multi-notification email workflow could generate a per-entry CSV attachment and then fail to remove it when cleanup used the later notification context, leaving submission data accessible from a public uploads path. | Write-up · CVE · NVD · WPVDB |
| CVE-2026-11855 | Simple Membership | Forged Stripe Webhook Metadata to Admin-Context XSS. CWE: CWE-79. Affected: < 4.7.5. Validated: Simple Membership 4.7.4. In the tested default state, an unauthenticated forged Stripe webhook could store attacker-controlled api_version metadata that was later rendered in a WordPress administrator notice without safe output encoding. | Write-up · CVE · NVD · WPVDB |
Current Research Areas
My current research is broader than the public disclosures above and includes:
- secure source-code review and trust-boundary analysis
- web/API authorization and multi-user security
- authentication and security-sensitive state transitions
- file handling and sensitive-data lifecycle
- parsers, libraries, SDKs, and developer tooling
- distributed-system and protocol trust boundaries
- patch and regression security review
- open-source vulnerability research
The public record on this page reflects findings that have completed coordinated disclosure. Ongoing or unpublished research is not listed here.
Research Approach
I prefer a source-first, evidence-driven workflow:
map the attack surface → identify the security invariant → trace attacker-controlled data → challenge the guard → validate behavior → use negative controls → document the consequence
The goal is not to maximize finding count. A well-supported boundary failure with reproducible evidence is more useful than a large collection of suspicious code patterns without demonstrated security impact.
Disclosure Principles
All research documented on this site is performed against systems I own, isolated local labs, or targets covered by an authorized vulnerability-disclosure or bug-bounty program.
I follow coordinated disclosure practices and may temporarily withhold exploit payloads or detailed reproduction steps while affected users are being given time to update.