Blog

What the engine found

Disclosures from pointing it at code nobody had audited, and what the pattern behind each one means for anything else built the same way.

5.3

Medium

3 September 2026

A review for a place you've never been

A field meant to hold the site owner's own Google Place ID never checked whether they had configured that place, so any visitor could send it any ID and watch the site pay Google for the answer. Public as CVE-2026-84936, scored 5.3 of 10 by WPScan.

Read it →CVE-2026-84936 · CWE-284

7.4
High
2 September 2026
Three characters from a broken homepage
A public form field meant to name an upload folder let an unauthenticated visitor point it at the site root instead, deleting the files WordPress needs to serve the homepage. Public as CVE-2026-81347, scored 7.4 of 10 by WPScan.
9.8
Critical
20 August 2026
The password you never needed
A convenience feature in a plugin that had nothing to do with authentication became a full account takeover. Public as CVE-2026-77264, scored 9.8 of 10 by Wordfence.

See what a scan turns up

Nominate a target. The first scan costs nothing, and we’ll walk you through it.

Get a free scan See the pricing

What the engine found

A review for a place you've never been

Three characters from a broken homepage

The password you never needed

See what a scan turns up