Alexis Lafontaine

Alexis Lafontaine is a security researcher credited with 5 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #766 of 3,515 contributors. The disclosure was published in 2026.

Their research concentrates on Missing Authorization, which accounts for 4 of their findings (80%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type. The average CVSS score across these disclosures is 6.4, peaking at 9.8. Severity breakdown: 1 critical and 0 high.

The most affected software includes Pix for WooCommerce (1), Post Timeline (1), Royal MCP (1), across 5 distinct plugins, themes and core versions in total.

4 of the 5 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload", scores 9.8 out of 10.

2026

Critical

High

Medium

Low

Global Rank

#766

of 3,515 researchers

Vulns

Critical1

High0

Medium4

Low0

Affected Assets

5plugins

Avg CVSS

6.4

Average score of vulnerabilities

Researcher Submissions

5 records


2026-08-07 00:00	SMEPay: UPI Gateway for WooCommerce <= 1.0.5 - Missing Authorization SMEPay <= 1.0.5	`CVE-2026-66461`	5.3 Medium	Alexis Lafontaine	No
2026-05-14 00:00	Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update Smartcat Translator for WPML <= 3.1.77	`CVE-2026-4683`	6.5 Medium	Alexis Lafontaine	Yes
2026-04-21 00:00	Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.2 - Missing Authorization Royal MCP <= 1.4.2	`CVE-2026-40775`	5.3 Medium	Alexis Lafontaine	Yes
2026-03-12 18:45	Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload Pix for WooCommerce <= 1.5.0	`CVE-2026-3891`	9.8 Critical	Alexis Lafontaine	Yes
2026-02-26 00:00	Post Timeline <= 2.4.1 - Missing Authorization Post Timeline <= 2.4.1	`CVE-2026-32421`	5.3 Medium	Alexis Lafontaine	Yes

Showing 1–5 of 5 reports