afei

afei is a security researcher credited with 3 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #1,190 of 3,878 contributors. Their disclosures were published between 2024 and 2026. The most productive year was 2026, with 2 findings.

Their research concentrates on Incomplete Denylist To Cross-Site Scripting, which accounts for 1 of their findings (33%). Other recurring categories include Missing Authorization, Path Traversal: '/Dir/../Filename'. The average CVSS score across these disclosures is 7.0, peaking at 9.1. Severity breakdown: 1 critical and 1 high.

The most affected software includes Ajax Load More (1), Booking Package (1), Super Forms (1), across 3 distinct plugins, themes and core versions in total.

All 3 disclosed issues have since received a vendor fix. The most severe finding, "Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter", scores 9.1 out of 10.