Afan

Afan is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #709 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Improper Authentication, which accounts for 2 of their findings (40%). Other recurring categories include Improper Privilege Management, Incorrect Privilege Assignment. The average CVSS score across these disclosures is 9.2, peaking at 9.8. Severity breakdown: 3 critical and 2 high.

The most affected software includes 6Storage Rentals (1), Bulk Password Reset (1), Pronamic Pay (1), across 5 distinct plugins, themes and core versions in total.

3 of the 5 disclosed issues have a vendor fix, while 2 remain unpatched. The most severe finding, "User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters", scores 9.8 out of 10.