Blog

What the engine found

Disclosures from pointing it at code nobody had audited, and what the pattern behind each one means for anything else built the same way.

8.6

High

9 October 2026

The verification code you never needed

The same WordPress plugin that would email a code to any address also checked codes with a SQL query it built by pasting the values in, then handed the finished string to prepare(). In our lab, one anonymous request made the check say yes without the code. Public as CVE-2026-89299, scored 8.6 of 10 by WPScan, no patch.

Read it →CVE-2026-89299 · CWE-89

8.6
High
9 October 2026
The 2FA plugin that answered questions about your password hashes
A WordPress plugin built as a second factor for logins took a value from an anonymous request, cleaned it as an email address, and pasted it into SQL. Anyone could ask the users table yes-or-no questions, password hashes included. Public as CVE-2026-89213, scored 8.6 of 10 by WPScan, no patch.
8.8
High
7 October 2026
We turned Argo CD's proxy field into a shell
Argo CD copied one repository setting, the proxy for an SSH repo, into a shell command. Anyone allowed to add or edit a repository could run commands inside the component that holds the credentials for other repositories. Public as CVE-2026-55797, scored 8.8 of 10 by the Argo CD maintainers.
8.4
High
26 September 2026
One tool call out of the AI sandbox
An MCP server promised its AI agent could never touch a file outside the project folder. One tool call with the right path could read, overwrite or delete anything the server could reach. Public as GHSA-rxhw-rjp6-53vj, rated High, 8.4 of 10.
3.7
Low
18 September 2026
A sign-in finished by someone else
An OAuth callback meant to redeem a sign-in code from a merchant's own connected account instead accepted one from any anonymous visitor, on every request to the site, and overwrote the store's connection to its ad platform with whatever code the request carried. Public as CVE-2026-92965, scored 3.7 of 10 by WPScan.
5.3
Medium
18 September 2026
The verification email you never asked for
A REST route built to email a verification code to whoever asked for one never checked that the asker and the recipient were the same person, so any anonymous caller could name any address on the internet and the site would email it, no rate limit, no fix. Public as CVE-2026-89300, scored 5.3 of 10 by WPScan.
6.5
Medium · our score
8 September 2026
Redacted, except for the card number
A redaction library that scrubs card numbers out of text before it reaches a log or an AI model said the job was done. Put an accented letter, a Russian greeting or a few emoji in front of the number and part or all of it came through anyway. Public as GHSA-gwjv-qpf9-g36x, rated Medium, with sibling advisories in two more SDKs.
4.3
Medium
7 September 2026
The cookie banner anyone could reset
Two AJAX actions meant to load a cookie-consent plugin's built-in A/B presets carried no capability check and no nonce, so any logged-in Subscriber could fire them and replace the administrator's configured banner, for every visitor, and erase whatever the real test had been measuring. Public as CVE-2026-82185, scored 4.3 of 10 by WPScan.
5.3
Medium
3 September 2026
A review for a place you've never been
A field meant to hold the site owner's own Google Place ID never checked whether they had configured that place, so any visitor could send it any ID and watch the site pay Google for the answer. Public as CVE-2026-84936, scored 5.3 of 10 by WPScan.
7.4
High
2 September 2026
Three characters from a broken homepage
A public form field meant to name an upload folder let an unauthenticated visitor point it at the site root instead, deleting the files WordPress needs to serve the homepage. Public as CVE-2026-81347, scored 7.4 of 10 by WPScan.
9.8
Critical
20 August 2026
The password you never needed
A convenience feature in a plugin that had nothing to do with authentication became a full account takeover. Public as CVE-2026-77264, scored 9.8 of 10 by Wordfence.

See what a scan turns up

Nominate a target. The first scan costs nothing, and we’ll walk you through it.

Get a free scan See the pricing

What the engine found

The verification code you never needed

The 2FA plugin that answered questions about your password hashes

We turned Argo CD's proxy field into a shell

One tool call out of the AI sandbox

A sign-in finished by someone else

The verification email you never asked for

Redacted, except for the card number

The cookie banner anyone could reset

A review for a place you've never been

Three characters from a broken homepage

The password you never needed

See what a scan turns up