1337_Wannabe

1337_Wannabe is a security researcher credited with 32 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #178 of 3,515 contributors. Their disclosures were published between 2024 and 2025. The most productive year was 2024, with 27 findings.

Their research concentrates on Missing Authorization, which accounts for 15 of their findings (47%). Other recurring categories include SQL Injection, Cross-Site Scripting. The average CVSS score across these disclosures is 7.1, peaking at 10.0. Severity breakdown: 6 critical and 8 high.

The most affected software includes LearnPress (2), Accessibility by AllAccessible (1), Advanced Contact form 7 DB (1), across 31 distinct plugins, themes and core versions in total.

All 32 disclosed issues have since received a vendor fix. The most severe finding, "InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete", scores 10.0 out of 10.

20242025

Critical

High

Medium

Low

Global Rank

#178

of 3,515 researchers

Vulns

Critical6

High8

Medium18

Low0

Affected Assets

34plugins

Avg CVSS

7.1

Average score of vulnerabilities

Researcher Submissions

32 records


2025-01-30 00:42	MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update MWB HubSpot for WooCommerce <= 1.5.9	`CVE-2024-10591`	8.8 High	1337_Wannabe	Yes
2025-01-24 18:17	Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters Flexmls® IDX Plugin <= 3.14.26	`CVE-2024-10552`	6.4 Medium	1337_Wannabe	Yes
2025-01-15 00:00	Admin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting OrderConvo <= 13.2	`CVE-2024-13355`	5.4 Medium	1337_Wannabe	Yes
2025-01-08 22:10	Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion Post Grid Master <= 3.4.12	`CVE-2024-11642`	9.8 Critical	1337_Wannabe	Yes
2025-01-06 00:00	SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update SMS Alert <= 3.7.6	`CVE-2024-11725`	8.8 High	1337_Wannabe	Yes
2024-12-03 00:00	Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update Accessibility by AllAccessible <= 1.3.4	`CVE-2024-11643`	8.8 High	1337_Wannabe	Yes
2024-11-25 17:39	Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read Product Input Fields for WooCommerce <= 1.9	`CVE-2024-10857`	6.5 Medium	1337_Wannabe	Yes
2024-11-20 00:00	Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration Tutor LMS <= 2.7.6	`CVE-2024-10393`	5.3 Medium	1337_Wannabe	Yes
2024-11-19 00:00	ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion ProfileGrid <= 5.9.3.6	`CVE-2024-10900`	6.5 Medium	1337_Wannabe	Yes
2024-08-16 14:24	InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete InPost PL <= 1.4.4	`CVE-2024-6500`	10.0 Critical	1337_Wannabe	Yes

Showing 1–10 of 32 reports